@stamhoofd/backend 2.143.1 → 2.145.0

package/src/endpoints/auth/PatchUserEndpoint.ts

@@ -10,6 +10,7 @@ import { LoginMethod, NewUser, PermissionLevel, SignupResponse, UserPermissions
 import { Context } from '../../helpers/Context.js';
 import { MemberUserSyncer } from '../../helpers/MemberUserSyncer.js';
 import { AuthenticatedStructures } from '../../helpers/AuthenticatedStructures.js';
+import { SessionService } from '../../services/SessionService.js';
 import { VerificationCodeService } from '../../services/VerificationCodeService.js';
 
 type Params = { id: string };
@@ -163,7 +164,7 @@ export class PatchUserEndpoint extends Endpoint<Params, Query, Body, ResponseBod
             // password changes
             await editUser.changePassword(request.body.password);
             await PasswordToken.clearFor(editUser.id);
-            await Token.clearFor(editUser.id, token.accessToken);
+            await SessionService.clearFor({ userId: editUser.id, keepAccessToken: token.accessToken });
         }
 
         if (request.body.hasPassword === false) {
@@ -179,7 +180,7 @@ export class PatchUserEndpoint extends Endpoint<Params, Query, Body, ResponseBod
                 }
                 editUser.password = null;
                 await PasswordToken.clearFor(editUser.id);
-                await Token.clearFor(editUser.id, token.accessToken);
+                await SessionService.clearFor({ userId: editUser.id, keepAccessToken: token.accessToken });
             }
         }
 

package/src/endpoints/auth/VerifyEmailEndpoint.ts

@@ -2,12 +2,13 @@ import type { Decoder } from '@simonbackx/simple-encoding';
 import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
-import { EmailVerificationCode, Token, User } from '@stamhoofd/models';
-import { Token as TokenStruct, VerifyEmailRequest } from '@stamhoofd/structures';
+import { EmailVerificationCode, User } from '@stamhoofd/models';
+import { SessionLoginMethod, Token as TokenStruct, VerifyEmailRequest } from '@stamhoofd/structures';
 
 import { Context } from '../../helpers/Context.js';
 import { TwoFactorHelper } from '../../helpers/TwoFactorHelper.js';
 import { BalanceItemService } from '../../services/BalanceItemService.js';
+import { SessionService } from '../../services/SessionService.js';
 
 type Params = Record<string, never>;
 type Query = undefined;
@@ -130,10 +131,10 @@ export class VerifyEmailEndpoint extends Endpoint<Params, Query, Body, ResponseB
         // the request already comes from a session of that same user (changing your email
         // address while signed in): the second factor was checked when it was created.
         if (authenticatedUser?.id !== user.id) {
-            await TwoFactorHelper.assertSecondFactorOrThrow(user, organization, request.request.getVersion(), { loginMethod: 'email', i18n: request.i18n });
+            await TwoFactorHelper.assertSecondFactorOrThrow(user, organization, request.request.getVersion(), { loginMethod: SessionLoginMethod.Email, i18n: request.i18n });
         }
 
-        const token = await Token.createToken(user);
+        const token = await SessionService.createSession(user, { loginMethod: SessionLoginMethod.Email });
         await user.markActive();
 
         const st = new TokenStruct(token);

package/src/endpoints/global/email/GetAdminEmailsEndpoint.test.ts

@@ -1,11 +1,12 @@
 import { Request } from '@simonbackx/simple-endpoints';
-import type { Organization, RegistrationPeriod, User } from '@stamhoofd/models';
-import { Email, EmailRecipient, MemberFactory, OrganizationFactory, RegistrationPeriodFactory, Token, UserFactory } from '@stamhoofd/models';
+import type { Organization, RegistrationPeriod, User, Token } from '@stamhoofd/models';
+import { Email, EmailRecipient, MemberFactory, OrganizationFactory, RegistrationPeriodFactory, UserFactory } from '@stamhoofd/models';
 import { EmailStatus, LimitedFilteredRequest, PermissionLevel, Permissions, Replacement } from '@stamhoofd/structures';
 import { TestUtils } from '@stamhoofd/test-utils';
 import { testServer } from '../../../../tests/helpers/TestServer.js';
 import { GetAdminEmailsEndpoint } from './GetAdminEmailsEndpoint.js';
 import { Formatter } from '@stamhoofd/utility';
+import { SessionService } from '../../../services/SessionService.js';
 
 const baseUrl = `/email`;
 
@@ -39,7 +40,7 @@ describe('Endpoint.getAdminEmails', () => {
             user,
         }).create();
 
-        userToken = await Token.createToken(user);
+        userToken = await SessionService.createSession(user);
     });
 
     const getAdminEmails = async (query: LimitedFilteredRequest = new LimitedFilteredRequest({ limit: 10 }), token: Token = userToken, testOrganization: Organization = organization) => {

package/src/endpoints/global/email/GetUserEmailsEndpoint.test.ts

@@ -1,12 +1,13 @@
 import { Request } from '@simonbackx/simple-endpoints';
-import type { Organization, RegistrationPeriod, User } from '@stamhoofd/models';
-import { Email, EmailRecipient, MemberFactory, OrganizationFactory, RegistrationPeriodFactory, Token, UserFactory } from '@stamhoofd/models';
+import type { Organization, RegistrationPeriod, User, Token } from '@stamhoofd/models';
+import { Email, EmailRecipient, MemberFactory, OrganizationFactory, RegistrationPeriodFactory, UserFactory } from '@stamhoofd/models';
 import { EmailContent, EmailStatus, LimitedFilteredRequest, Replacement } from '@stamhoofd/structures';
 import { Language } from '@stamhoofd/types/Language';
 import { TestUtils } from '@stamhoofd/test-utils';
 import { testServer } from '../../../../tests/helpers/TestServer.js';
 import { GetUserEmailsEndpoint } from './GetUserEmailsEndpoint.js';
 import { Formatter } from '@stamhoofd/utility';
+import { SessionService } from '../../../services/SessionService.js';
 
 const baseUrl = `/user/email`;
 
@@ -39,7 +40,7 @@ describe('Endpoint.GetUserEmails', () => {
             user,
         }).create();
 
-        userToken = await Token.createToken(user);
+        userToken = await SessionService.createSession(user);
     });
 
     afterEach(async () => {
@@ -726,7 +727,7 @@ describe('Endpoint.GetUserEmails', () => {
         expect(response.body.results.find(e => e.id === email.id)).toBeUndefined();
 
         // Test that is IS included if we request the same data via the 'otherUser' token
-        const otherUserToken = await Token.createToken(otherUser);
+        const otherUserToken = await SessionService.createSession(otherUser);
         const responseForOtherUser = await getUserEmails(new LimitedFilteredRequest({ limit: 10 }), otherUserToken);
         expect(responseForOtherUser.body.results.find(e => e.id === email.id)).toBeDefined();
     });
@@ -805,7 +806,7 @@ describe('Endpoint.GetUserEmails', () => {
                 host: organization.getApiHost(),
                 query: new LimitedFilteredRequest({ limit: 10 }),
                 headers: {
-                    'authorization': 'Bearer ' + userToken.accessToken,
+                    authorization: 'Bearer ' + userToken.accessToken,
                     ...(language ? { 'accept-language': language } : {}),
                 },
             });

package/src/endpoints/global/email/PatchEmailEndpoint.test.ts

@@ -1,14 +1,15 @@
 import type { AutoEncoderPatchType } from '@simonbackx/simple-encoding';
 import { PatchMap } from '@simonbackx/simple-encoding';
 import { Request } from '@simonbackx/simple-endpoints';
-import type { Organization, RegistrationPeriod, User } from '@stamhoofd/models';
-import { Email, EmailRecipient, GroupFactory, MemberFactory, OrganizationFactory, RegistrationFactory, RegistrationPeriodFactory, Token, UserFactory } from '@stamhoofd/models';
+import type { Organization, RegistrationPeriod, User, Token } from '@stamhoofd/models';
+import { Email, EmailRecipient, GroupFactory, MemberFactory, OrganizationFactory, RegistrationFactory, RegistrationPeriodFactory, UserFactory } from '@stamhoofd/models';
 import { AccessRight, EmailContent, EmailRecipientFilter, EmailRecipientSubfilter, EmailStatus, Email as EmailStruct, OrganizationEmail, Parent, PermissionLevel, Permissions, PermissionsResourceType, ResourcePermissions, UserPermissions, Version } from '@stamhoofd/structures';
 import { Language } from '@stamhoofd/types/Language';
 import { STExpect, TestUtils } from '@stamhoofd/test-utils';
 import { testServer } from '../../../../tests/helpers/TestServer.js';
 import { PatchEmailEndpoint } from './PatchEmailEndpoint.js';
 import { EmailRecipientFilterType } from '@stamhoofd/structures/email/EmailRecipientFilterType.js';
+import { SessionService } from '../../../services/SessionService.js';
 
 // Import recipient loaders to initialize them
 import { Formatter } from '@stamhoofd/utility';
@@ -82,7 +83,7 @@ describe('Endpoint.PatchEmailEndpoint', () => {
         })
             .create();
 
-        token = await Token.createToken(user);
+        token = await SessionService.createSession(user);
 
         user2 = await new UserFactory({
             organization,
@@ -99,7 +100,7 @@ describe('Endpoint.PatchEmailEndpoint', () => {
         })
             .create();
 
-        token2 = await Token.createToken(user2);
+        token2 = await SessionService.createSession(user2);
     });
 
     test('Should throw for invalid senderId', async () => {

package/src/endpoints/global/email-recipients/GetEmailRecipientsEndpoint.test.ts

@@ -1,10 +1,11 @@
 import { STExpect, TestUtils } from '@stamhoofd/test-utils';
 import { GetEmailRecipientsEndpoint } from './GetEmailRecipientsEndpoint.js';
 import { AccessRight, EmailStatus, LimitedFilteredRequest, OrganizationEmail, PermissionLevel, Permissions, PermissionsResourceType, ResourcePermissions } from '@stamhoofd/structures';
-import type { Organization, RegistrationPeriod, User } from '@stamhoofd/models';
-import { Email, EmailRecipient, OrganizationFactory, RegistrationPeriodFactory, Token, UserFactory } from '@stamhoofd/models';
+import type { Organization, RegistrationPeriod, User, Token } from '@stamhoofd/models';
+import { Email, EmailRecipient, OrganizationFactory, RegistrationPeriodFactory, UserFactory } from '@stamhoofd/models';
 import { Request } from '@simonbackx/simple-endpoints';
 import { testServer } from '../../../../tests/helpers/TestServer.js';
+import { SessionService } from '../../../services/SessionService.js';
 
 const baseUrl = `/email-recipients`;
 
@@ -57,7 +58,7 @@ describe('Endpoint.GetEmailRecipients', () => {
         })
             .create();
 
-        token = await Token.createToken(user);
+        token = await SessionService.createSession(user);
 
         user2 = await new UserFactory({
             organization,
@@ -73,7 +74,7 @@ describe('Endpoint.GetEmailRecipients', () => {
         })
             .create();
 
-        token2 = await Token.createToken(user2);
+        token2 = await SessionService.createSession(user2);
     });
 
     test('It can request all email recipients if read permission for all senders', async () => {

package/src/endpoints/global/events/PatchEventNotificationsEndpoint.test.ts

@@ -10,6 +10,7 @@ import { testServer } from '../../../../tests/helpers/TestServer.js';
 import '../../../audit-logs/init.js';
 import { AuditLogService } from '../../../services/AuditLogService.js';
 import { PatchEventNotificationsEndpoint } from './PatchEventNotificationsEndpoint.js';
+import { SessionService } from '../../../services/SessionService.js';
 
 const baseUrl = `/event-notifications`;
 const endpoint = new PatchEventNotificationsEndpoint();
@@ -34,7 +35,7 @@ const TestRequest = {
     }) {
         const request = Request.buildJson('PATCH', baseUrl, options.organization?.getApiHost(), options.body);
         if (options.user) {
-            const token = await Token.createToken(options.user);
+            const token = await SessionService.createSession(options.user);
             request.headers.authorization = 'Bearer ' + token.accessToken;
         }
         return await testServer.test(endpoint, request);

package/src/endpoints/global/events/PatchEventsEndpoint.test.ts

@@ -8,6 +8,7 @@ import { AccessRight, Event, Group, GroupSettings, GroupType, OrganizationEventT
 import { STExpect, TestUtils } from '@stamhoofd/test-utils';
 import { testServer } from '../../../../tests/helpers/TestServer.js';
 import { PatchEventsEndpoint } from './PatchEventsEndpoint.js';
+import { SessionService } from '../../../services/SessionService.js';
 
 const baseUrl = `/events`;
 const endpoint = new PatchEventsEndpoint();
@@ -32,7 +33,7 @@ const TestRequest = {
     }) {
         const request = Request.buildJson('PATCH', baseUrl, options.organization?.getApiHost(), options.body);
         if (options.user) {
-            const token = await Token.createToken(options.user);
+            const token = await SessionService.createSession(options.user);
             request.headers.authorization = 'Bearer ' + token.accessToken;
         }
         return await testServer.test(endpoint, request);

package/src/endpoints/global/files/UploadFile.test.ts

@@ -6,6 +6,7 @@ import { TestUtils } from '@stamhoofd/test-utils';
 import { promises as fs } from 'fs';
 import type { IncomingMessage } from 'node:http';
 import { Readable } from 'node:stream';
+import { SessionService } from '../../../services/SessionService.js';
 
 import { testServer } from '../../../../tests/helpers/TestServer.js';
 import { UploadFile } from './UploadFile.js';
@@ -59,7 +60,7 @@ describe('Endpoint.UploadFile', () => {
             organization,
             permissions: Permissions.create({ level: PermissionLevel.Full }),
         }).create();
-        const token = await Token.createToken(user);
+        const token = await SessionService.createSession(user);
 
         const boundary = '--------------------------StamhoofdTest';
         const body = Buffer.concat([

package/src/endpoints/global/files/UploadFile.ts

@@ -1,4 +1,4 @@
-import { PutObjectCommand, S3Client } from '@aws-sdk/client-s3'; // ES Modules import
+import { PutObjectCommand } from '@aws-sdk/client-s3'; // ES Modules import
 import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
@@ -11,7 +11,8 @@ import { v4 as uuidv4 } from 'uuid';
 import type { Decoder } from '@simonbackx/simple-encoding';
 import { AutoEncoder, BooleanDecoder, field } from '@simonbackx/simple-encoding';
 import { Context } from '../../../helpers/Context.js';
-import { limiter } from './UploadImage.js';
+import { limiter, organizationLimiter } from './UploadImage.js';
+import type { Organization } from '@stamhoofd/models';
 import { Image } from '@stamhoofd/models';
 
 type Params = Record<string, never>;
@@ -58,11 +59,20 @@ export class UploadFile extends Endpoint<Params, Query, Body, ResponseBody> {
     }
 
     async handle(request: DecodedRequest<Params, Query, Body>) {
-        await Context.setOptionalOrganizationScope();
-        const { user } = await Context.authenticate();
+        const organization = await Context.setOptionalOrganizationScope();
+        const { user } = await Context.optionalAuthenticate();
 
-        if (!Context.auth.canUpload({ private: request.query.isPrivate })) {
-            throw Context.auth.error();
+        // Webshops allow for file upload, but don't have a user attached
+        if (user) {
+            if (!Context.auth?.canUpload({ private: request.query.isPrivate })) {
+                throw Context.auth.error();
+            }
+        } else if (!organization) {
+            throw new SimpleError({
+                code: 'permission_denied',
+                message: 'Endpoints needs organization if no user is present',
+                human: $t('%ZlM'),
+            });
         }
 
         if (!STAMHOOFD.SPACES_BUCKET || !STAMHOOFD.SPACES_ENDPOINT || !STAMHOOFD.SPACES_KEY || !STAMHOOFD.SPACES_SECRET) {
@@ -77,7 +87,14 @@ export class UploadFile extends Endpoint<Params, Query, Body, ResponseBody> {
             throw new Error('Not supported without real request');
         }
 
-        limiter.track(user.id, 1);
+        if (user) {
+            limiter.track(user.id, 1);
+        } else {
+            limiter.track(request.request.getIP(), 1);
+            if (organization) {
+                organizationLimiter.track(organization.id, 1);
+            }
+        }
 
         const form = formidable({ maxFileSize: 20 * 1024 * 1024, maxFields: 1, keepExtensions: true });
         const file = await new Promise<FormidableFile>((resolve, reject) => {
@@ -89,34 +106,43 @@ export class UploadFile extends Endpoint<Params, Query, Body, ResponseBody> {
                 }));
                 return;
             }
-            form.parse(request.request.request, (err, fields, files) => {
-                if (err) {
-                    reject(err);
-                    return;
+            try {
+                if (request.request.request?.destroyed) {
+                    throw new Error('Request destroyed before parsing');
                 }
-
-                if (!files.file || !Array.isArray(files.file) || files.file.length !== 1) {
-                    reject(new SimpleError({
-                        code: 'missing_field',
-                        message: 'Missing file',
-                        field: 'file',
-                    }));
-                    return;
-                }
-
-                resolve(files.file[0]);
-            });
+                form.parse(request.request.request, (err, fields, files) => {
+                    console.log('form.parse', err, fields, files);
+                    if (err) {
+                        reject(err);
+                        return;
+                    }
+
+                    if (!files.file || !Array.isArray(files.file) || files.file.length !== 1) {
+                        reject(new SimpleError({
+                            code: 'missing_field',
+                            message: 'Missing file',
+                            field: 'file',
+                        }));
+                        return;
+                    }
+
+                    resolve(files.file[0]);
+                });
+            } catch (e) {
+                console.error(e);
+                reject(e);
+            }
         });
 
         try {
-            return await this.upload(request, file, user);
+            return await this.upload(request, file, organization, user);
         } finally {
             // Formidable wrote the upload to a temporary file
             await fs.rm(file.filepath, { force: true }).catch(() => { /* we can't do anything about this */ });
         }
     }
 
-    private async upload(request: DecodedRequest<Params, Query, Body>, file: FormidableFile, user: { id: string }) {
+    private async upload(request: DecodedRequest<Params, Query, Body>, file: FormidableFile, organization: Organization | null, user?: { id: string }) {
         if (!STAMHOOFD.SPACES_BUCKET || !STAMHOOFD.SPACES_ENDPOINT || !STAMHOOFD.SPACES_KEY || !STAMHOOFD.SPACES_SECRET) {
             throw new SimpleError({
                 code: 'not_available',
@@ -156,6 +182,8 @@ export class UploadFile extends Endpoint<Params, Query, Body, ResponseBody> {
         if (request.query.isPrivate && user) {
             // Private files
             prefix += 'users/' + user.id + '/';
+        } else if (request.query.isPrivate && !user && organization) {
+            prefix += 'anonymous/' + organization.id + '/';
         } else {
             // Public files
             prefix += 'p/';

package/src/endpoints/global/files/UploadImage.test.ts

@@ -5,6 +5,7 @@ import { PermissionLevel, Permissions } from '@stamhoofd/structures';
 import { TestUtils } from '@stamhoofd/test-utils';
 import type { IncomingMessage } from 'node:http';
 import { Readable } from 'node:stream';
+import { SessionService } from '../../../services/SessionService.js';
 
 import { testServer } from '../../../../tests/helpers/TestServer.js';
 import { UploadImage } from './UploadImage.js';
@@ -52,7 +53,7 @@ describe('Endpoint.UploadImage', () => {
             organization,
             permissions: Permissions.create({ level: PermissionLevel.Full }),
         }).create();
-        const token = await Token.createToken(user);
+        const token = await SessionService.createSession(user);
 
         const boundary = '--------------------------StamhoofdTest';
         const body = Buffer.concat([

package/src/endpoints/global/files/UploadImage.ts

@@ -3,6 +3,7 @@ import { AutoEncoder, BooleanDecoder, field, ObjectData } from '@simonbackx/simp
 import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
+import type { Organization } from '@stamhoofd/models';
 import { Image, RateLimiter } from '@stamhoofd/models';
 import { Image as ImageStruct, ResolutionRequest, supportedImageTypes } from '@stamhoofd/structures';
 import formidable from 'formidable';
@@ -44,6 +45,15 @@ export const limiter = new RateLimiter({
         },
     ],
 });
+export const organizationLimiter = new RateLimiter({
+    limits: [
+        {
+            // Max 200 per day
+            limit: 200,
+            duration: 60 * 1000 * 60 * 24,
+        },
+    ],
+});
 
 export class UploadImage extends Endpoint<Params, Query, Body, ResponseBody> {
     queryDecoder = Query as Decoder<Query>;
@@ -63,11 +73,20 @@ export class UploadImage extends Endpoint<Params, Query, Body, ResponseBody> {
     }
 
     async handle(request: DecodedRequest<Params, Query, Body>) {
-        await Context.setOptionalOrganizationScope();
-        const { user } = await Context.authenticate();
+        const organization = await Context.setOptionalOrganizationScope();
+        const { user } = await Context.optionalAuthenticate();
 
-        if (!Context.auth.canUpload({ private: request.query.isPrivate })) {
-            throw Context.auth.error();
+        // Webshops allow for file upload, but don't have a user attached
+        if (user) {
+            if (!Context.auth?.canUpload({ private: request.query.isPrivate })) {
+                throw Context.auth.error();
+            }
+        } else if (!organization) {
+            throw new SimpleError({
+                code: 'permission_denied',
+                message: 'Endpoints needs organization if no user is present',
+                human: $t('%ZlM'),
+            });
         }
 
         if (!STAMHOOFD.SPACES_BUCKET || !STAMHOOFD.SPACES_ENDPOINT || !STAMHOOFD.SPACES_KEY || !STAMHOOFD.SPACES_SECRET) {
@@ -82,7 +101,14 @@ export class UploadImage extends Endpoint<Params, Query, Body, ResponseBody> {
             throw new Error('Not supported without real request');
         }
 
-        limiter.track(user.id, 1);
+        if (user) {
+            limiter.track(user.id, 1);
+        } else {
+            limiter.track(request.request.getIP(), 1);
+            if (organization) {
+                organizationLimiter.track(organization.id, 1);
+            }
+        }
 
         const form = formidable({
             maxFileSize: 5 * 1024 * 1024,
@@ -147,7 +173,7 @@ export class UploadImage extends Endpoint<Params, Query, Body, ResponseBody> {
             }
 
             const fileContent = await fs.readFile(file.filepath);
-            const image = await Image.create(fileContent, imageType.contentType, resolutions, request.query.isPrivate, user);
+            const image = await Image.create(fileContent, imageType.contentType, resolutions, request.query.isPrivate, user, organization as Organization | null | undefined);
             return new Response(ImageStruct.create(image));
         } finally {
             // Formidable wrote the upload to a temporary file

package/src/endpoints/global/files/upload-security.test.ts

@@ -7,6 +7,7 @@ import { File, PermissionLevel, Permissions } from '@stamhoofd/structures';
 import { TestUtils } from '@stamhoofd/test-utils';
 import type { IncomingMessage } from 'node:http';
 import { Readable } from 'node:stream';
+import { SessionService } from '../../../services/SessionService.js';
 
 import { testServer } from '../../../../tests/helpers/TestServer.js';
 import { FileSignService } from '../../../services/FileSignService.js';
@@ -116,12 +117,12 @@ describe('Upload security', () => {
             permissions: Permissions.create({ level: PermissionLevel.Full }),
         }).create();
         adminUserId = admin.id;
-        adminToken = (await Token.createToken(admin)).accessToken;
+        adminToken = (await SessionService.createSession(admin)).accessToken;
 
         // A user without any permissions: it may only upload private files
         const member = await new UserFactory({ organization }).create();
         memberUserId = member.id;
-        memberToken = (await Token.createToken(member)).accessToken;
+        memberToken = (await SessionService.createSession(member)).accessToken;
     });
 
     beforeEach(() => {

package/src/endpoints/global/groups/GetGroupsEndpoint.test.ts

@@ -1,6 +1,6 @@
 import { Request } from '@simonbackx/simple-endpoints';
-import type { Organization, RegistrationPeriod } from '@stamhoofd/models';
-import { GroupFactory, OrganizationFactory, OrganizationRegistrationPeriodFactory, RegistrationPeriodFactory, Token, UserFactory } from '@stamhoofd/models';
+import type { Organization, RegistrationPeriod, Token } from '@stamhoofd/models';
+import { GroupFactory, OrganizationFactory, OrganizationRegistrationPeriodFactory, RegistrationPeriodFactory, UserFactory } from '@stamhoofd/models';
 import type { StamhoofdFilter } from '@stamhoofd/structures';
 import { BundleDiscountGroupPriceSettings, GroupPrice, GroupType, LimitedFilteredRequest } from '@stamhoofd/structures';
 import { STExpect, TestUtils } from '@stamhoofd/test-utils';
@@ -8,6 +8,7 @@ import { testServer } from '../../../../tests/helpers/TestServer.js';
 import { initAdmin, initBundleDiscount, initPlatformAdmin } from '../../../../tests/init/index.js';
 import { GetGroupsEndpoint } from './GetGroupsEndpoint.js';
 import { Database } from '@simonbackx/simple-database';
+import { SessionService } from '../../../services/SessionService.js';
 
 const baseUrl = `/groups`;
 
@@ -68,7 +69,7 @@ describe('Endpoint.GetGroupsEndpoint', () => {
         const { organization: otherOrganization } = await initOrganization(registrationPeriod1);
 
         const user = await new UserFactory({ organization }).create();
-        const token = await Token.createToken(user);
+        const token = await SessionService.createSession(user);
 
         const waitingList = await new GroupFactory({
             organization,