@stamhoofd/backend 2.143.1 → 2.145.0

package/src/endpoints/auth/CreateTokenEndpoint.test.ts

@@ -1,6 +1,9 @@
 import { Request } from '@simonbackx/simple-endpoints';
-import { OrganizationFactory, Token, User, UserFactory } from '@stamhoofd/models';
-import { Token as TokenStruct } from '@stamhoofd/structures';
+import type { Organization } from '@stamhoofd/models';
+import { OrganizationFactory, Token, User, UserFactory, UserSession } from '@stamhoofd/models';
+import { SESSION_DURATIONS } from '@stamhoofd/models/constants/sessions.js';
+import { PermissionLevel, Permissions, SessionClientType, Token as TokenStruct } from '@stamhoofd/structures';
+import { SessionService } from '../../services/SessionService.js';
 
 import { testServer } from '../../../tests/helpers/TestServer.js';
 import { CreateTokenEndpoint } from './CreateTokenEndpoint.js';
@@ -41,7 +44,7 @@ describe('Endpoint.CreateToken', () => {
         // Also check UTF8 passwords
         const password = '54😂test👌🏾86s&é';
         const user = await new UserFactory({ organization, password }).create();
-        const token = await Token.createToken(user);
+        const token = await SessionService.createSession(user);
 
         const r = Request.buildJson('POST', '/oauth/token', organization.getApiHost(), {
             grant_type: 'refresh_token',
@@ -94,7 +97,7 @@ describe('Endpoint.CreateToken', () => {
         test('refreshing a token marks the user as active again', async () => {
             const organization = await new OrganizationFactory({}).create();
             const user = await new UserFactory({ organization, password }).create();
-            const token = await Token.createToken(user);
+            const token = await SessionService.createSession(user);
 
             const monthsAgo = new Date(Date.now() - 90 * 24 * 60 * 60 * 1000);
             monthsAgo.setMilliseconds(0);
@@ -125,4 +128,207 @@ describe('Endpoint.CreateToken', () => {
             expect(await getLastActiveAt(user)).toBeNull();
         });
     });
+
+    describe('session length', () => {
+        const password = 'test-password-1234';
+        const DAY = 24 * 60 * 60 * 1000;
+
+        function expectValidFor(date: Date, duration: number) {
+            expect(date.getTime()).toBeGreaterThan(Date.now() + duration - 5000);
+            expect(date.getTime()).toBeLessThanOrEqual(Date.now() + duration);
+        }
+
+        async function login(organization: Organization, user: User, platform: string | null = null): Promise<Token> {
+            const r = Request.buildJson('POST', '/oauth/token', organization.getApiHost(), {
+                grant_type: 'password',
+                username: user.email,
+                password,
+            });
+            if (platform) {
+                r.headers['x-platform'] = platform;
+            }
+
+            const response = await testServer.test(endpoint, r);
+            if (!(response.body instanceof TokenStruct)) {
+                throw new Error('Expected TokenStruct');
+            }
+
+            const token = await Token.getByAccessToken(response.body.accessToken);
+            expect(token).toBeDefined();
+            return token!;
+        }
+
+        async function refresh(organization: Organization, refreshToken: string): Promise<Token> {
+            const r = Request.buildJson('POST', '/oauth/token', organization.getApiHost(), {
+                grant_type: 'refresh_token',
+                refresh_token: refreshToken,
+            });
+
+            const response = await testServer.test(endpoint, r);
+            if (!(response.body instanceof TokenStruct)) {
+                throw new Error('Expected TokenStruct');
+            }
+
+            const token = await Token.getByAccessToken(response.body.accessToken);
+            expect(token).toBeDefined();
+            return token!;
+        }
+
+        async function getSession(token: Token): Promise<UserSession> {
+            const session = await UserSession.getByID(token.sessionId);
+            if (!session) throw new Error('Expected user session');
+            return session;
+        }
+
+        test('an administrator that signs in in a browser gets a limited session', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const admin = await new UserFactory({
+                organization,
+                password,
+                permissions: Permissions.create({ level: PermissionLevel.Full }),
+            }).create();
+
+            const token = await login(organization, admin, 'web');
+
+            expect((await getSession(token)).clientType).toBe(SessionClientType.Browser);
+            expectValidFor(token.refreshTokenValidUntil, SESSION_DURATIONS.admin[SessionClientType.Browser].refreshToken);
+        });
+
+        test('an administrator that signs in in the native app has no maximum session length', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const admin = await new UserFactory({
+                organization,
+                password,
+                permissions: Permissions.create({ level: PermissionLevel.Full }),
+            }).create();
+
+            const token = await login(organization, admin, 'ios');
+
+            expect((await getSession(token)).clientType).toBe(SessionClientType.iOS);
+            expectValidFor(token.refreshTokenValidUntil, SESSION_DURATIONS.admin[SessionClientType.iOS].refreshToken);
+
+            const browserSessionDuration = SESSION_DURATIONS.admin[SessionClientType.Browser].session;
+            if (browserSessionDuration === null) {
+                throw new Error('Expected browser administrator sessions to have a maximum length');
+            }
+            const userSession = await getSession(token);
+            userSession.startedAt = new Date(Date.now() - 2 * browserSessionDuration);
+            await userSession.save();
+
+            const renewed = await refresh(organization, token.refreshToken);
+            expectValidFor(renewed.refreshTokenValidUntil, SESSION_DURATIONS.admin[SessionClientType.iOS].refreshToken);
+        });
+
+        test('renewing the same active token twice revokes the first replacement', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const user = await new UserFactory({ organization, password }).create();
+            const original = await login(organization, user);
+
+            const firstReplacement = await refresh(organization, original.refreshToken);
+            const secondReplacement = await refresh(organization, original.refreshToken);
+
+            expect(secondReplacement.sessionId).toBe(original.sessionId);
+            expect(await Token.getByAccessToken(firstReplacement.accessToken)).toBeUndefined();
+            expect(await Token.getByAccessToken(original.accessToken)).toBeDefined();
+            expect(await Token.getByAccessToken(secondReplacement.accessToken)).toBeDefined();
+
+            const sessionTokens = await Token.where({ sessionId: original.sessionId });
+            expect(sessionTokens.map(token => token.id).sort()).toEqual([original.id, secondReplacement.id].sort());
+
+            const forkRequest = Request.buildJson('POST', '/oauth/token', organization.getApiHost(), {
+                grant_type: 'refresh_token',
+                refresh_token: firstReplacement.refreshToken,
+            });
+            await expect(testServer.test(endpoint, forkRequest)).rejects.toMatchObject({ code: 'invalid_refresh_token' });
+        });
+
+        test('an SSO handoff refresh token can only be exchanged once', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const user = await new UserFactory({ organization }).create();
+            const handoff = await SessionService.createSSOHandoff(user);
+
+            const sessionToken = await refresh(organization, handoff.refreshToken);
+            expect(sessionToken.sessionId).toBe(handoff.sessionId);
+
+            await expect(refresh(organization, handoff.refreshToken)).rejects.toMatchObject({
+                code: 'invalid_refresh_token',
+            });
+        });
+
+        test('concurrent exchanges cannot fork an SSO handoff', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const user = await new UserFactory({ organization }).create();
+            const handoff = await SessionService.createSSOHandoff(user);
+
+            const exchanges = await Promise.allSettled([
+                refresh(organization, handoff.refreshToken),
+                refresh(organization, handoff.refreshToken),
+            ]);
+
+            expect(exchanges.filter(result => result.status === 'fulfilled')).toHaveLength(1);
+            const rejected = exchanges.filter(result => result.status === 'rejected');
+            expect(rejected).toHaveLength(1);
+            expect(rejected[0].reason).toMatchObject({ code: 'invalid_refresh_token' });
+        });
+
+        test('renewing an access token does not extend the session past its maximum length', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const admin = await new UserFactory({
+                organization,
+                password,
+                permissions: Permissions.create({ level: PermissionLevel.Full }),
+            }).create();
+
+            const token = await login(organization, admin, 'web');
+
+            const sessionDuration = SESSION_DURATIONS.admin[SessionClientType.Browser].session;
+            if (sessionDuration === null) {
+                throw new Error('Expected browser administrator sessions to have a maximum length');
+            }
+            const sessionStartedAt = new Date(Date.now() - sessionDuration + DAY);
+            sessionStartedAt.setMilliseconds(0);
+            const userSession = await getSession(token);
+            userSession.startedAt = sessionStartedAt;
+            await userSession.save();
+
+            const renewed = await refresh(organization, token.refreshToken);
+
+            expect((await getSession(renewed)).startedAt).toEqual(sessionStartedAt);
+            expect(renewed.refreshTokenValidUntil.getTime()).toBeLessThanOrEqual(sessionStartedAt.getTime() + sessionDuration);
+            expect(renewed.refreshTokenValidUntil.getTime()).toBeGreaterThan(Date.now());
+        });
+
+        test('a session that reached its maximum length cannot be renewed', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const admin = await new UserFactory({
+                organization,
+                password,
+                permissions: Permissions.create({ level: PermissionLevel.Full }),
+            }).create();
+
+            const token = await login(organization, admin, 'web');
+            const sessionDuration = SESSION_DURATIONS.admin[SessionClientType.Browser].session;
+            if (sessionDuration === null) {
+                throw new Error('Expected browser administrator sessions to have a maximum length');
+            }
+            const userSession = await getSession(token);
+            userSession.startedAt = new Date(Date.now() - sessionDuration - DAY);
+            await userSession.save();
+            token.refreshTokenValidUntil = new Date(Date.now() + DAY);
+            await token.save();
+
+            const otherSession = await login(organization, admin, 'web');
+
+            const r = Request.buildJson('POST', '/oauth/token', organization.getApiHost(), {
+                grant_type: 'refresh_token',
+                refresh_token: token.refreshToken,
+            });
+
+            await expect(testServer.test(endpoint, r)).rejects.toMatchObject({ code: 'invalid_refresh_token' });
+            expect(await Token.getByAccessToken(otherSession.accessToken)).toBeDefined();
+
+            await expect(testServer.test(endpoint, r)).rejects.toMatchObject({ code: 'invalid_refresh_token' });
+            expect(await Token.getByAccessToken(otherSession.accessToken)).toBeDefined();
+        });
+    });
 });

package/src/endpoints/auth/CreateTokenEndpoint.ts

@@ -3,13 +3,14 @@ import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { EmailVerificationCode, MFATOTP, MFAToken, PasswordToken, Platform, Token, User, WebauthnCredential } from '@stamhoofd/models';
 import type { ChallengeGrantStruct, MFAGrantStruct, PasswordGrantStruct, PasswordTokenGrantStruct, RefreshTokenGrantStruct, RequestChallengeGrantStruct } from '@stamhoofd/structures';
-import { CreateTokenStruct, LoginMethod, MFAMethodType, SignupResponse, Token as TokenStruct } from '@stamhoofd/structures';
+import { CreateTokenStruct, LoginMethod, MFAMethodType, SessionLoginMethod, SignupResponse, Token as TokenStruct } from '@stamhoofd/structures';
 
 import { Context } from '../../helpers/Context.js';
 import { RecoveryCodeHelper } from '../../helpers/RecoveryCodeHelper.js';
 import { TOTPHelper } from '../../helpers/TOTPHelper.js';
 import { mfaVerificationRateLimiter, TwoFactorHelper } from '../../helpers/TwoFactorHelper.js';
 import { WebauthnHelper } from '../../helpers/WebauthnHelper.js';
+import { SessionService } from '../../services/SessionService.js';
 import { VerificationCodeService } from '../../services/VerificationCodeService.js';
 
 type Params = Record<string, never>;
@@ -45,7 +46,7 @@ export class CreateTokenEndpoint extends Endpoint<Params, Query, Body, ResponseB
 
         switch (request.body.grantType) {
             case 'refresh_token': {
-                const oldToken = await Token.getByRefreshToken(request.body.refreshToken);
+                const oldToken = await SessionService.getByRefreshToken(request.body.refreshToken);
                 if (!oldToken) {
                     throw new SimpleError({
                         code: 'invalid_refresh_token',
@@ -63,19 +64,7 @@ export class CreateTokenEndpoint extends Endpoint<Params, Query, Body, ResponseB
                     });
                 }
 
-                // Important to create a new token before adjusting the old token
-                const token = await Token.createToken(oldToken.user);
-
-                // In the rare event our response doesn't reach the client anymore, we don't want the client to sign out...
-                // So we allow a small rotation overlap period
-                const leeway = 60 * 1000;
-                oldToken.refreshTokenValidUntil = new Date(Math.min(oldToken.refreshTokenValidUntil.getTime(), Date.now() + leeway));
-
-                // Invalidate the corresponding access token
-                oldToken.accessTokenValidUntil = new Date(Date.now() - 60 * 60 * 1000);
-
-                // Do not delete the old one, only expire it fast so it will get deleted in the future
-                await oldToken.save();
+                const token = await SessionService.rotateSession(oldToken);
 
                 if (!token) {
                     throw new SimpleError({
@@ -150,9 +139,9 @@ export class CreateTokenEndpoint extends Endpoint<Params, Query, Body, ResponseB
                 // Second factor / forced enrollment: block the session until the user
                 // completes (or first sets up) a second factor. Shared with every other
                 // grant that mints a session from a single primary credential.
-                await TwoFactorHelper.assertSecondFactorOrThrow(user, organization, request.request.getVersion(), { loginMethod: 'password', i18n: request.i18n });
+                await TwoFactorHelper.assertSecondFactorOrThrow(user, organization, request.request.getVersion(), { loginMethod: SessionLoginMethod.Password, i18n: request.i18n });
 
-                const token = await Token.createToken(user, new Date());
+                const token = await SessionService.createSession(user, { loginMethod: SessionLoginMethod.Password, authenticatedAt: new Date() });
 
                 if (!token) {
                     throw new SimpleError({
@@ -264,7 +253,7 @@ export class CreateTokenEndpoint extends Endpoint<Params, Query, Body, ResponseB
                     });
                 }
 
-                const token = await Token.createToken(user, new Date());
+                const token = await SessionService.createSession(user, { loginMethod: mfaToken.loginMethod, authenticatedAt: new Date() });
                 await user.markActive();
 
                 const st = new TokenStruct(token);
@@ -314,10 +303,10 @@ export class CreateTokenEndpoint extends Endpoint<Params, Query, Body, ResponseB
                 //
                 // The link was emailed to the account, so this is also how a long-inactive
                 // admin confirms their email address and gets to enroll after all.
-                await TwoFactorHelper.assertSecondFactorOrThrow(passwordToken.user, organization, request.request.getVersion(), { loginMethod: 'email', i18n: request.i18n, allowTemporarySession: true });
+                await TwoFactorHelper.assertSecondFactorOrThrow(passwordToken.user, organization, request.request.getVersion(), { loginMethod: SessionLoginMethod.Email, i18n: request.i18n, allowTemporarySession: true });
 
                 // Important to create a new token before adjusting the old token
-                const token = await Token.createToken(passwordToken.user, new Date());
+                const token = await SessionService.createSession(passwordToken.user, { loginMethod: SessionLoginMethod.Email, authenticatedAt: new Date() });
 
                 // TODO: make token short lived until renewal
 

package/src/endpoints/auth/DeleteTokenEndpoint.test.ts

@@ -0,0 +1,29 @@
+import { Request } from '@simonbackx/simple-endpoints';
+import { OrganizationFactory, Token, UserFactory, UserSession } from '@stamhoofd/models';
+
+import { testServer } from '../../../tests/helpers/TestServer.js';
+import { SessionService } from '../../services/SessionService.js';
+import { DeleteTokenEndpoint } from './DeleteTokenEndpoint.js';
+
+describe('Endpoint.DeleteToken', () => {
+    const endpoint = new DeleteTokenEndpoint();
+
+    test('ends the session and deletes every token in it', async () => {
+        const organization = await new OrganizationFactory({}).create();
+        const user = await new UserFactory({ organization }).create();
+        const original = await SessionService.createSession(user);
+        const renewed = await SessionService.rotateSession(original);
+        const otherSession = await SessionService.createSession(user);
+
+        const request = Request.buildJson('DELETE', '/oauth/token', organization.getApiHost());
+        request.headers.authorization = 'Bearer ' + original.accessToken;
+        await testServer.test(endpoint, request);
+
+        expect(await UserSession.getByID(original.sessionId)).toBeUndefined();
+        expect(await Token.getByAccessToken(original.accessToken, true)).toBeUndefined();
+        expect(await Token.getByAccessToken(renewed.accessToken, true)).toBeUndefined();
+        expect(await UserSession.getByID(otherSession.sessionId)).toBeDefined();
+        expect(await Token.getByAccessToken(otherSession.accessToken, true)).toBeDefined();
+    });
+
+});

package/src/endpoints/auth/DeleteTokenEndpoint.ts

@@ -2,6 +2,7 @@ import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 
 import { Context } from '../../helpers/Context.js';
+import { SessionService } from '../../services/SessionService.js';
 
 type Params = Record<string, never>;
 type Query = undefined;
@@ -25,7 +26,7 @@ export class DeleteTokenEndpoint extends Endpoint<Params, Query, Body, ResponseB
     async handle(_: DecodedRequest<Params, Query, Body>) {
         await Context.setOptionalOrganizationScope();
         const { token } = await Context.authenticate({ allowWithoutAccount: true });
-        await token.delete();
+        await SessionService.endSession(token);
 
         return new Response(undefined);
     }

package/src/endpoints/auth/GetUserEndpoint.test.ts

@@ -3,6 +3,7 @@ import { MemberFactory, OrganizationFactory, Token, UserFactory } from '@stamhoo
 
 import { MFATestHelper } from '../../../tests/helpers/MFATestHelper.js';
 import { testServer } from '../../../tests/helpers/TestServer.js';
+import { SessionService } from '../../services/SessionService.js';
 import { GetUserEndpoint } from './GetUserEndpoint.js';
 import { STExpect } from '@stamhoofd/test-utils';
 
@@ -13,7 +14,7 @@ describe('Endpoint.GetUser', () => {
     test('Request user details when signed in', async () => {
         const organization = await new OrganizationFactory({}).create();
         const user = await new UserFactory({ organization }).create();
-        const token = await Token.createToken(user);
+        const token = await SessionService.createSession(user);
 
         const r = Request.buildJson('GET', '/v1/user', organization.getApiHost());
         r.headers.authorization = 'Bearer ' + token.accessToken;
@@ -23,13 +24,32 @@ describe('Endpoint.GetUser', () => {
         expect(response.body.id).toEqual(user.id);
     });
 
+    test('using a renewed token retires the previous active token', async () => {
+        const organization = await new OrganizationFactory({}).create();
+        const user = await new UserFactory({ organization }).create();
+        const original = await SessionService.createSession(user);
+        const replacement = await SessionService.rotateSession(original);
+
+        const originalRequest = Request.buildJson('GET', '/v1/user', organization.getApiHost());
+        originalRequest.headers.authorization = 'Bearer ' + original.accessToken;
+        await testServer.test(endpoint, originalRequest);
+
+        const replacementRequest = Request.buildJson('GET', '/v1/user', organization.getApiHost());
+        replacementRequest.headers.authorization = 'Bearer ' + replacement.accessToken;
+        await testServer.test(endpoint, replacementRequest);
+
+        await expect(testServer.test(endpoint, originalRequest)).rejects.toThrow(STExpect.simpleError({
+            code: 'invalid_access_token',
+        }));
+    });
+
     test('Two-factor authentication is reported on the user and on the accounts of a member', async () => {
         const organization = await new OrganizationFactory({}).create();
         const user = await new UserFactory({ organization }).create();
         await new MemberFactory({ organization, user }).create();
         await MFATestHelper.addConfirmedTOTP(user);
 
-        const token = await Token.createToken(user);
+        const token = await SessionService.createSession(user);
         const r = Request.buildJson('GET', '/v1/user', organization.getApiHost());
         r.headers.authorization = 'Bearer ' + token.accessToken;
 
@@ -44,7 +64,7 @@ describe('Endpoint.GetUser', () => {
     test('A user without a second factor is not reported as having two-factor authentication', async () => {
         const organization = await new OrganizationFactory({}).create();
         const user = await new UserFactory({ organization }).create();
-        const token = await Token.createToken(user);
+        const token = await SessionService.createSession(user);
 
         const r = Request.buildJson('GET', '/v1/user', organization.getApiHost());
         r.headers.authorization = 'Bearer ' + token.accessToken;
@@ -62,7 +82,7 @@ describe('Endpoint.GetUser', () => {
     test('Request user details with invalid token is not working', async () => {
         const organization = await new OrganizationFactory({}).create();
         const user = await new UserFactory({ organization }).create();
-        const token = await Token.createToken(user);
+        const token = await SessionService.createSession(user);
 
         const r = Request.buildJson('GET', '/v1/user', organization.getApiHost());
         r.headers.authorization = 'Bearer ' + token.accessToken + 'd';
@@ -73,7 +93,9 @@ describe('Endpoint.GetUser', () => {
     test('Request user details with expired token is not working', async () => {
         const organization = await new OrganizationFactory({}).create();
         const user = await new UserFactory({ organization }).create();
-        const token = await Token.createExpiredToken(user);
+        const token = await SessionService.createSession(user);
+        token.accessTokenValidUntil = new Date(Date.now() - 1000);
+        await token.save();
 
         const r = Request.buildJson('GET', '/v1/user', organization.getApiHost());
         r.headers.authorization = 'Bearer ' + token.accessToken;
@@ -84,7 +106,7 @@ describe('Endpoint.GetUser', () => {
     test('Can request details of an API user by token without knowing the organization scope', async () => {
         const organization = await new OrganizationFactory({}).create();
         const user = await new UserFactory({ organization, apiUser: true }).create();
-        const token = await Token.createToken(user);
+        const token = await SessionService.createSession(user);
 
         const r = Request.buildJson('GET', '/v1/user');
         r.headers.authorization = 'Bearer ' + token.accessToken;
@@ -98,13 +120,13 @@ describe('Endpoint.GetUser', () => {
     test('Cannot request details of an normal user by token without knowing the organization scope', async () => {
         const organization = await new OrganizationFactory({}).create();
         const user = await new UserFactory({ organization }).create();
-        const token = await Token.createToken(user);
+        const token = await SessionService.createSession(user);
 
         const r = Request.buildJson('GET', '/v1/user');
         r.headers.authorization = 'Bearer ' + token.accessToken;
 
         await expect(testServer.test(endpoint, r)).rejects.toThrow(STExpect.simpleError({
-            code: 'invalid_access_token'
+            code: 'invalid_access_token',
         }));
     });
 
@@ -112,14 +134,13 @@ describe('Endpoint.GetUser', () => {
         const wrongOrganization = await new OrganizationFactory({}).create();
         const organization = await new OrganizationFactory({}).create();
         const user = await new UserFactory({ organization, apiUser: true }).create();
-        const token = await Token.createToken(user);
+        const token = await SessionService.createSession(user);
 
         const r = Request.buildJson('GET', '/v1/user', wrongOrganization.getApiHost());
         r.headers.authorization = 'Bearer ' + token.accessToken;
 
         await expect(testServer.test(endpoint, r)).rejects.toThrow(STExpect.simpleError({
-            code: 'invalid_access_token'
+            code: 'invalid_access_token',
         }));
     });
-
 });

package/src/endpoints/auth/MFA.security.test.ts

@@ -1,10 +1,13 @@
 import { Request } from '@simonbackx/simple-endpoints';
-import { isSimpleError, isSimpleErrors, SimpleError } from '@simonbackx/simple-errors';
-import { EmailVerificationCode, MFARecoveryCode, MFATOTP, MFAToken, Organization, OrganizationFactory, PasswordToken, Token, User, UserFactory, WebauthnCredential } from '@stamhoofd/models';
+import type { SimpleError } from '@simonbackx/simple-errors';
+import { isSimpleError, isSimpleErrors } from '@simonbackx/simple-errors';
+import type { Organization } from '@stamhoofd/models';
+import { EmailVerificationCode, MFARecoveryCode, MFATOTP, MFAToken, OrganizationFactory, PasswordToken, Token, User, UserFactory, WebauthnCredential } from '@stamhoofd/models';
 import { NewUser, PermissionLevel, Permissions, Token as TokenStruct } from '@stamhoofd/structures';
 import { TestUtils } from '@stamhoofd/test-utils';
 import crypto from 'crypto';
 import { authenticator } from 'otplib';
+import { SessionService } from '../../services/SessionService.js';
 
 import { MFATestHelper } from '../../../tests/helpers/MFATestHelper.js';
 import { testServer } from '../../../tests/helpers/TestServer.js';
@@ -49,8 +52,7 @@ function firstError(e: unknown): SimpleError {
 async function captureError(promise: Promise<unknown>): Promise<SimpleError> {
     try {
         await promise;
-    }
-    catch (e) {
+    } catch (e) {
         return firstError(e);
     }
     throw new Error('Expected the request to be rejected, but it succeeded');
@@ -79,7 +81,7 @@ function withSetup(request: Request, setupToken: string) {
 }
 
 async function freshToken(user: User): Promise<Token> {
-    return await Token.createToken(user, new Date());
+    return await SessionService.createSession(user, { authenticatedAt: new Date() });
 }
 
 async function addConfirmedTOTP(user: User): Promise<{ id: string; secret: string }> {
@@ -649,9 +651,9 @@ describe('MFA security', () => {
             // separately and are not browser sessions.
             const organization = await new OrganizationFactory({}).create();
             const apiUser = await new UserFactory({ organization, apiUser: true }).create();
-            const apiToken = await Token.createToken(apiUser);
+            const apiToken = await SessionService.createSession(apiUser);
 
-            expect(await Token.deleteOtherSessions(apiUser.id, null)).toBe(0);
+            expect(await SessionService.deleteOtherSessions({ userId: apiUser.id, keepAccessToken: null })).toBe(0);
             expect(await Token.getByAccessToken(apiToken.accessToken, true)).toBeDefined();
         });
     });

package/src/endpoints/auth/MFA.test.ts

@@ -1,10 +1,14 @@
-import { Endpoint, Request } from '@simonbackx/simple-endpoints';
-import { isSimpleError, isSimpleErrors, SimpleError } from '@simonbackx/simple-errors';
+import type { Endpoint } from '@simonbackx/simple-endpoints';
+import { Request } from '@simonbackx/simple-endpoints';
+import type { SimpleError } from '@simonbackx/simple-errors';
+import { isSimpleError, isSimpleErrors } from '@simonbackx/simple-errors';
 import { EmailMocker } from '@stamhoofd/email';
-import { AuditLog, EmailTemplateFactory, EmailVerificationCode, MFARecoveryCode, MFATOTP, MFAToken, Organization, PasswordToken, Platform, Token, User, UserFactory, OrganizationFactory, WebauthnChallenge, WebauthnCredential } from '@stamhoofd/models';
-import { AuditLogReplacementType, AuditLogType, EmailTemplateType, MFAMethodType, PermissionLevel, Permissions, Token as TokenStruct } from '@stamhoofd/structures';
+import type { Organization } from '@stamhoofd/models';
+import { AuditLog, EmailTemplateFactory, EmailVerificationCode, MFARecoveryCode, MFATOTP, MFAToken, PasswordToken, Platform, Token, User, UserFactory, OrganizationFactory, UserSession, WebauthnChallenge, WebauthnCredential } from '@stamhoofd/models';
+import { AuditLogReplacementType, AuditLogType, EmailTemplateType, MFAMethodType, PermissionLevel, Permissions, SessionLoginMethod, Token as TokenStruct } from '@stamhoofd/structures';
 import { authenticator } from 'otplib';
 import crypto from 'crypto';
+import { SessionService } from '../../services/SessionService.js';
 
 import { MFATestHelper } from '../../../tests/helpers/MFATestHelper.js';
 import { testServer } from '../../../tests/helpers/TestServer.js';
@@ -43,8 +47,7 @@ function firstError(e: unknown): SimpleError {
 async function captureError(promise: Promise<unknown>): Promise<SimpleError> {
     try {
         await promise;
-    }
-    catch (e) {
+    } catch (e) {
         return firstError(e);
     }
     throw new Error('Expected the request to throw');
@@ -106,12 +109,12 @@ function bearer(request: Request, token: Token) {
 }
 
 async function freshToken(user: User): Promise<Token> {
-    return await Token.createToken(user, new Date());
+    return await SessionService.createSession(user, { authenticatedAt: new Date() });
 }
 
 async function staleToken(user: User): Promise<Token> {
     // A token as produced by a refresh_token rotation (never authenticatedAt).
-    return await Token.createToken(user);
+    return await SessionService.createSession(user);
 }
 
 async function requireMfa(organization: Organization | null, email: string, password: string): Promise<{ token: string; methods: string[]; webauthnAuthenticationOptions: unknown }> {
@@ -668,8 +671,7 @@ describe('MFA', () => {
                 const err = await captureError(testServer.test(tokenEndpoint, passwordLogin(organization, user.email, password)));
                 expect(err.code).toBe('require_email_confirmation');
                 expect(send).toHaveBeenCalledOnce();
-            }
-            finally {
+            } finally {
                 send.mockRestore();
             }
         });
@@ -690,7 +692,7 @@ describe('MFA', () => {
             // The identity provider authenticated the user, so there is nothing to confirm.
             const { organization, user } = await inactiveAdmin();
 
-            const requirement = await TwoFactorHelper.getSecondFactorRequirement(user, organization, { loginMethod: 'sso' });
+            const requirement = await TwoFactorHelper.getSecondFactorRequirement(user, organization, { loginMethod: SessionLoginMethod.SSO });
             expect(requirement.type).toBe('setup');
         });
     });
@@ -1414,14 +1416,14 @@ describe('MFA', () => {
             const { organization, user } = await adminOfOrgRequiringTwoFactor({ withPassword: false });
             await addConfirmedTOTP(user);
 
-            const requirement = await TwoFactorHelper.getSecondFactorRequirement(user, organization, { loginMethod: 'sso' });
+            const requirement = await TwoFactorHelper.getSecondFactorRequirement(user, organization, { loginMethod: SessionLoginMethod.SSO });
             expect(requirement.type).toBe('challenge');
         });
 
         test('an SSO-only account is not forced to enroll: the provider is the second factor', async () => {
             const { organization, user } = await adminOfOrgRequiringTwoFactor({ withPassword: false });
 
-            const requirement = await TwoFactorHelper.getSecondFactorRequirement(user, organization, { loginMethod: 'sso' });
+            const requirement = await TwoFactorHelper.getSecondFactorRequirement(user, organization, { loginMethod: SessionLoginMethod.SSO });
             expect(requirement.type).toBe('none');
         });
 
@@ -1430,16 +1432,41 @@ describe('MFA', () => {
             // requirement is not satisfied by signing in through SSO.
             const { organization, user } = await adminOfOrgRequiringTwoFactor({ withPassword: true });
 
-            const requirement = await TwoFactorHelper.getSecondFactorRequirement(user, organization, { loginMethod: 'sso' });
+            const requirement = await TwoFactorHelper.getSecondFactorRequirement(user, organization, { loginMethod: SessionLoginMethod.SSO });
             expect(requirement.type).toBe('setup');
         });
 
         test('a password login is always forced to enroll', async () => {
             const { organization, user } = await adminOfOrgRequiringTwoFactor({ withPassword: true });
 
-            const requirement = await TwoFactorHelper.getSecondFactorRequirement(user, organization, { loginMethod: 'password' });
+            const requirement = await TwoFactorHelper.getSecondFactorRequirement(user, organization, { loginMethod: SessionLoginMethod.Password });
             expect(requirement.type).toBe('setup');
         });
+
+        test('the session of an SSO login that passed a second factor is an SSO session', async () => {
+            // The session is only created after the second factor, so the challenge has to
+            // remember how the user got there: it decides how long the session may live.
+            const { organization, user } = await adminOfOrgRequiringTwoFactor({ withPassword: false });
+            const { secret } = await addConfirmedTOTP(user);
+
+            const requirement = await TwoFactorHelper.getSecondFactorRequirement(user, organization, { loginMethod: SessionLoginMethod.SSO });
+            if (requirement.type !== 'challenge') {
+                throw new Error('Expected a challenge');
+            }
+
+            const response = await testServer.test(tokenEndpoint, mfaGrant(organization, {
+                mfa_token: requirement.challenge.token,
+                method: 'TOTP',
+                code: authenticator.generate(secret),
+            }));
+            if (!(response.body instanceof TokenStruct)) {
+                throw new Error('Expected TokenStruct');
+            }
+
+            const token = await Token.getByAccessToken(response.body.accessToken);
+            expect((await UserSession.getByID(token!.sessionId))!.loginMethod).toBe(SessionLoginMethod.SSO);
+            expect(token!.refreshTokenValidUntil.getTime()).toBeLessThanOrEqual(Date.now() + 3 * 60 * 60 * 1000);
+        });
     });
 
     // -----------------------------------------------------------------------