@stamhoofd/backend 2.144.0 → 2.145.0

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@stamhoofd/backend",
-    "version": "2.144.0",
+    "version": "2.145.0",
     "type": "module",
     "main": "./dist/index.js",
     "exports": {
@@ -58,27 +58,27 @@
         "@aws-sdk/client-sqs": "3.1090.0",
         "@aws-sdk/s3-request-presigner": "3.1090.0",
         "@bwip-js/node": "4.11.2",
-        "@mollie/api-client": "4.6.0",
         "@simonbackx/simple-database": "1.37.1",
         "@simonbackx/simple-encoding": "2.26.11",
         "@simonbackx/simple-endpoints": "1.22.0",
         "@simonbackx/simple-errors": "1.5.0",
         "@simonbackx/simple-logging": "1.0.1",
         "@simplewebauthn/server": "13.3.2",
-        "@stamhoofd/backend-env": "2.144.0",
-        "@stamhoofd/backend-i18n": "2.144.0",
-        "@stamhoofd/backend-middleware": "2.144.0",
-        "@stamhoofd/crons": "2.144.0",
-        "@stamhoofd/email": "2.144.0",
-        "@stamhoofd/excel-writer": "2.144.0",
-        "@stamhoofd/logging": "2.144.0",
-        "@stamhoofd/models": "2.144.0",
-        "@stamhoofd/object-differ": "2.144.0",
-        "@stamhoofd/queues": "2.144.0",
-        "@stamhoofd/sql": "2.144.0",
-        "@stamhoofd/structures": "2.144.0",
-        "@stamhoofd/types": "2.144.0",
-        "@stamhoofd/utility": "2.144.0",
+        "@stamhoofd/backend-env": "2.145.0",
+        "@stamhoofd/backend-i18n": "2.145.0",
+        "@stamhoofd/backend-middleware": "2.145.0",
+        "@stamhoofd/crons": "2.145.0",
+        "@stamhoofd/email": "2.145.0",
+        "@stamhoofd/excel-writer": "2.145.0",
+        "@stamhoofd/logging": "2.145.0",
+        "@stamhoofd/models": "2.145.0",
+        "@stamhoofd/object-differ": "2.145.0",
+        "@stamhoofd/queues": "2.145.0",
+        "@stamhoofd/sql": "2.145.0",
+        "@stamhoofd/structures": "2.145.0",
+        "@stamhoofd/types": "2.145.0",
+        "@stamhoofd/utility": "2.145.0",
+        "@stamhoofd/vies": "2.145.0",
         "archiver": "7.0.1",
         "argon2": "0.44.0",
         "axios": "1.18.1",
@@ -89,11 +89,11 @@
         "handlebars": "4.7.9",
         "jose": "5.10.0",
         "jsonwebtoken": "9.0.3",
-        "jsvat-next": "3.0.4",
         "libphonenumber-js": "1.13.9",
         "luxon": "3.7.2",
         "mailparser": "3.9.14",
         "mockdate": "3.0.5",
+        "mollie-api-typescript": "1.12.23",
         "mysql2": "3.23.1",
         "node-rsa": "2.0.0",
         "openid-client": "5.7.1",
@@ -102,7 +102,7 @@
         "uuid": "14.0.1"
     },
     "devDependencies": {
-        "@stamhoofd/test-utils": "2.144.0",
+        "@stamhoofd/test-utils": "2.145.0",
         "@types/cookie": "0.6.0",
         "@types/luxon": "3.7.2",
         "@types/mailparser": "3.4.6",
@@ -117,5 +117,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "31bc31b2a56d9516e8bc6be5779bc58af0022a88"
+    "gitHead": "ee58cd6383c03df39218d8589679638019241e15"
 }

package/src/crons/mollie-chargebacks.ts

@@ -42,40 +42,42 @@ export async function checkMollieChargebacksFor(service: MollieService, checkAll
     // Check last 3 days
     const offset = new Date(Date.now() - 1000 * 60 * 60 * 24 * 4);
 
-    // due to a bug in mollie client code, testmode paramter is missing in the typescript definitions
-    // eslint-disable-next-line @typescript-eslint/no-unsafe-argument
-    for await (const chargeback of service.client.chargebacks.iterate({ sort: 'desc', testmode: service.testMode } as any)) {
-        if (!checkAll && new Date(chargeback.createdAt) < offset) {
-            break;
-        }
+    const pages = await service.client.chargebacks.all({ sort: 'desc', limit: 250 });
 
-        // Check if this chargeback has been handled
-        const existingChargeback = await MolliePayment.select().where('mollieId', chargeback.id).first(false);
-        if (existingChargeback) {
-            // We can break because all older chargebacks will also be handled
-            break;
-        }
+    pagesLoop: for await (const page of pages) {
+        for (const chargeback of page.result.embedded.chargebacks) {
+            if (!checkAll && new Date(chargeback.createdAt) < offset) {
+                break pagesLoop;
+            }
+
+            // Check if this chargeback has been handled
+            const existingChargeback = await MolliePayment.select().where('mollieId', chargeback.id).first(false);
+            if (existingChargeback) {
+                // We can break because all older chargebacks will also be handled
+                break pagesLoop;
+            }
 
-        if (chargeback.paymentId) {
-            const molliePayment = await MolliePayment.select().where('mollieId', chargeback.paymentId).first(false);
-            if (molliePayment) {
-                const payment = await Payment.getByID(molliePayment.paymentId);
-                if (payment) {
-                    try {
-                        const amount = Math.round(parseFloat(chargeback.amount.value) * 100) * 100;
-                        const createdPayment = await PaymentService.registerChargeback(payment, amount, new Date(chargeback.createdAt));
+            if (chargeback.paymentId) {
+                const molliePayment = await MolliePayment.select().where('mollieId', chargeback.paymentId).first(false);
+                if (molliePayment) {
+                    const payment = await Payment.getByID(molliePayment.paymentId);
+                    if (payment) {
+                        try {
+                            const amount = Math.round(parseFloat(chargeback.amount.value) * 100) * 100;
+                            const createdPayment = await PaymentService.registerChargeback(payment, amount, new Date(chargeback.createdAt));
 
-                        // Link Mollie chargeback ID (so we can set settlement later in the settlements cron)
-                        const molliePayment = new MolliePayment();
-                        molliePayment.paymentId = createdPayment.id;
-                        molliePayment.mollieId = chargeback.id;
-                        await molliePayment.save();
-                    } catch (e) {
-                        console.error('Failed to register chargeback ' + chargeback.id, e);
+                            // Link Mollie chargeback ID (so we can set settlement later in the settlements cron)
+                            const molliePayment = new MolliePayment();
+                            molliePayment.paymentId = createdPayment.id;
+                            molliePayment.mollieId = chargeback.id;
+                            await molliePayment.save();
+                        } catch (e) {
+                            console.error('Failed to register chargeback ' + chargeback.id, e);
+                        }
                     }
+                } else {
+                    console.error('Invalid chargeback payment id ' + chargeback.paymentId + ', not found');
                 }
-            } else {
-                console.error('Invalid chargeback payment id ' + chargeback.paymentId + ', not found');
             }
         }
     }

package/src/crons/mollie-refunds.ts

@@ -1,7 +1,7 @@
-import { RefundStatus } from '@mollie/api-client';
 import { registerCron } from '@stamhoofd/crons';
 import { MolliePayment, MollieToken, Organization, Payment } from '@stamhoofd/models';
 import { PaymentStatus, PaymentType } from '@stamhoofd/structures';
+import type { ListEntityRefundStatus } from 'mollie-api-typescript/models';
 import { MollieService } from '../services/MollieService.js';
 import { PaymentService } from '../services/PaymentService.js';
 
@@ -49,73 +49,75 @@ export async function checkMollieRefundsFor(service: MollieService, checkAll = f
     // Check last 7 days
     const offset = new Date(Date.now() - 1000 * 60 * 60 * 24 * 7);
 
-    // due to a bug in mollie client code, testmode paramter is missing in the typescript definitions
-    // eslint-disable-next-line @typescript-eslint/no-unsafe-argument
-    for await (const refund of service.client.refunds.iterate({ sort: 'desc', testmode: service.testMode } as any)) {
-        const createdAt = new Date(refund.createdAt);
+    const pages = await service.client.refunds.all({ sort: 'desc', limit: 250 });
 
-        if (createdAt < MOLLIE_REFUNDS_MINIMUM_DATE) {
-            break;
-        }
+    pagesLoop: for await (const page of pages) {
+        for (const refund of page.result.embedded.refunds) {
+            const createdAt = new Date(refund.createdAt);
 
-        if (!checkAll && createdAt < offset) {
-            break;
-        }
+            if (createdAt < MOLLIE_REFUNDS_MINIMUM_DATE) {
+                break pagesLoop;
+            }
 
-        // Check if this refund is already registered (refunds created via the API are linked on
-        // creation, so we cannot break here: an older refund created in the Mollie UI could still
-        // be unhandled). Registered refunds that are still pending locally are reconciled: Mollie
-        // refunds can still fail or be canceled until they are actually executed.
-        const existingRefund = await MolliePayment.select().where('mollieId', refund.id).first(false);
-        if (existingRefund) {
-            await reconcileRefundStatus(existingRefund.paymentId, refund.status, createdAt);
-            continue;
-        }
+            if (!checkAll && createdAt < offset) {
+                break pagesLoop;
+            }
 
-        // Refunds that were canceled or failed before we ever registered them can be ignored
-        if (refund.status === RefundStatus.canceled || refund.status === RefundStatus.failed) {
-            continue;
-        }
+            // Check if this refund is already registered (refunds created via the API are linked on
+            // creation, so we cannot break here: an older refund created in the Mollie UI could still
+            // be unhandled). Registered refunds that are still pending locally are reconciled: Mollie
+            // refunds can still fail or be canceled until they are actually executed.
+            const existingRefund = await MolliePayment.select().where('mollieId', refund.id).first(false);
+            if (existingRefund) {
+                await reconcileRefundStatus(existingRefund.paymentId, refund.status, createdAt);
+                continue;
+            }
 
-        // Safety net: when creating a refund via the API succeeded, but saving the link afterwards
-        // failed, the local refund payment already exists. Restore the link instead of registering
-        // the refund twice (the metadata is set in PaymentService.createRefund).
-        const metadata = refund.metadata as { refundPaymentId?: string } | null;
-        if (metadata?.refundPaymentId) {
-            const localRefund = await Payment.getByID(metadata.refundPaymentId);
-            if (localRefund && localRefund.type === PaymentType.Refund) {
-                console.error('Restoring missing link for Mollie refund ' + refund.id + ' to payment ' + localRefund.id);
-                const link = new MolliePayment();
-                link.paymentId = localRefund.id;
-                link.mollieId = refund.id;
-                await link.save();
-
-                await reconcileRefundStatus(localRefund.id, refund.status, createdAt);
+            // Refunds that were canceled or failed before we ever registered them can be ignored
+            if (refund.status === 'canceled' || refund.status === 'failed') {
                 continue;
             }
-        }
 
-        if (refund.paymentId) {
-            const molliePayment = await MolliePayment.select().where('mollieId', refund.paymentId).first(false);
-            if (molliePayment) {
-                const payment = await Payment.getByID(molliePayment.paymentId);
-                if (payment) {
-                    try {
-                        const amount = Math.round(parseFloat(refund.amount.value) * 100) * 100;
-                        const status = MollieService.refundStatusToPaymentStatus(refund.status) === PaymentStatus.Succeeded ? PaymentStatus.Succeeded : PaymentStatus.Pending;
-                        const createdPayment = await PaymentService.registerRefund(payment, amount, createdAt, status);
-
-                        // Link Mollie refund ID (so we don't register it twice and can set the settlement later)
-                        const molliePayment = new MolliePayment();
-                        molliePayment.paymentId = createdPayment.id;
-                        molliePayment.mollieId = refund.id;
-                        await molliePayment.save();
-                    } catch (e) {
-                        console.error('Failed to register refund ' + refund.id, e);
+            // Safety net: when creating a refund via the API succeeded, but saving the link afterwards
+            // failed, the local refund payment already exists. Restore the link instead of registering
+            // the refund twice (the metadata is set in PaymentService.createRefund).
+            const metadata = refund.metadata as { refundPaymentId?: string } | null;
+            if (metadata?.refundPaymentId) {
+                const localRefund = await Payment.getByID(metadata.refundPaymentId);
+                if (localRefund && localRefund.type === PaymentType.Refund) {
+                    console.error('Restoring missing link for Mollie refund ' + refund.id + ' to payment ' + localRefund.id);
+                    const link = new MolliePayment();
+                    link.paymentId = localRefund.id;
+                    link.mollieId = refund.id;
+                    await link.save();
+
+                    await reconcileRefundStatus(localRefund.id, refund.status, createdAt);
+                    continue;
+                }
+            }
+
+            if (refund.paymentId) {
+                const molliePayment = await MolliePayment.select().where('mollieId', refund.paymentId).first(false);
+                if (molliePayment) {
+                    const payment = await Payment.getByID(molliePayment.paymentId);
+                    if (payment) {
+                        try {
+                            const amount = Math.round(parseFloat(refund.amount.value) * 100) * 100;
+                            const status = MollieService.refundStatusToPaymentStatus(refund.status) === PaymentStatus.Succeeded ? PaymentStatus.Succeeded : PaymentStatus.Pending;
+                            const createdPayment = await PaymentService.registerRefund(payment, amount, createdAt, status);
+
+                            // Link Mollie refund ID (so we don't register it twice and can set the settlement later)
+                            const molliePayment = new MolliePayment();
+                            molliePayment.paymentId = createdPayment.id;
+                            molliePayment.mollieId = refund.id;
+                            await molliePayment.save();
+                        } catch (e) {
+                            console.error('Failed to register refund ' + refund.id, e);
+                        }
                     }
+                } else {
+                    console.error('Invalid refund payment id ' + refund.paymentId + ', not found');
                 }
-            } else {
-                console.error('Invalid refund payment id ' + refund.paymentId + ', not found');
             }
         }
     }
@@ -129,7 +131,7 @@ export async function checkMollieRefundsFor(service: MollieService, checkAll = f
  * Update a locally registered refund that is still pending when Mollie reports a final status
  * (refunded, failed or canceled).
  */
-async function reconcileRefundStatus(paymentId: string, mollieStatus: RefundStatus, createdAt: Date) {
+async function reconcileRefundStatus(paymentId: string, mollieStatus: ListEntityRefundStatus, createdAt: Date) {
     const payment = await Payment.getByID(paymentId);
     if (!payment || !payment.organizationId) {
         return;

package/src/endpoints/admin/organizations/PatchOrganizationsEndpoint.ts

@@ -10,6 +10,7 @@ import { Organization as OrganizationStruct } from '@stamhoofd/structures';
 import { Formatter } from '@stamhoofd/utility';
 import { AuthenticatedStructures } from '../../../helpers/AuthenticatedStructures.js';
 import { Context } from '../../../helpers/Context.js';
+import { SQL } from '@stamhoofd/sql';
 
 type Params = Record<string, never>;
 type Query = undefined;
@@ -64,13 +65,23 @@ export class PatchOrganizationsEndpoint extends Endpoint<Params, Query, Body, Re
 
             // Financial records may not disappear together with the organization that had to pay them
             const payerRecordCounts = await Promise.all([
-                BalanceItem.select().where('payingOrganizationId', id).count(),
-                Payment.select().where('payingOrganizationId', id).count(),
-                ApplicationFee.select().where('payingOrganizationId', id).count(),
-                Invoice.select().where('payingOrganizationId', id).count(),
+                BalanceItem.select().where('payingOrganizationId', id).first(false),
+                Payment.select().where('payingOrganizationId', id).first(false),
+                ApplicationFee.select().where('payingOrganizationId', id).first(false),
+                Invoice.select().where('payingOrganizationId', id).first(false),
+                Payment.select()
+                    .where('organizationId', id)
+                    .where(
+                        SQL.where('serviceFeePayout', '!=', 0)
+                            .or('serviceFeeManual', '!=', 0)
+                            .or('serviceFeeManualCharged', '!=', 0)
+                            .or('transferFeeManual', '!=', 0)
+                            .or('transferFeeManualCharged', '!=', 0),
+                    )
+                    .first(false),
             ]);
 
-            if (payerRecordCounts.some(count => count > 0)) {
+            if (payerRecordCounts.some(hasSome => hasSome !== null)) {
                 throw new SimpleError({
                     code: 'organization_has_financial_records',
                     message: 'Organization is still referenced as paying organization',

package/src/endpoints/auth/CreateTokenEndpoint.test.ts

@@ -1,6 +1,9 @@
 import { Request } from '@simonbackx/simple-endpoints';
-import { OrganizationFactory, Token, User, UserFactory } from '@stamhoofd/models';
-import { Token as TokenStruct } from '@stamhoofd/structures';
+import type { Organization } from '@stamhoofd/models';
+import { OrganizationFactory, Token, User, UserFactory, UserSession } from '@stamhoofd/models';
+import { SESSION_DURATIONS } from '@stamhoofd/models/constants/sessions.js';
+import { PermissionLevel, Permissions, SessionClientType, Token as TokenStruct } from '@stamhoofd/structures';
+import { SessionService } from '../../services/SessionService.js';
 
 import { testServer } from '../../../tests/helpers/TestServer.js';
 import { CreateTokenEndpoint } from './CreateTokenEndpoint.js';
@@ -41,7 +44,7 @@ describe('Endpoint.CreateToken', () => {
         // Also check UTF8 passwords
         const password = '54😂test👌🏾86s&é';
         const user = await new UserFactory({ organization, password }).create();
-        const token = await Token.createToken(user);
+        const token = await SessionService.createSession(user);
 
         const r = Request.buildJson('POST', '/oauth/token', organization.getApiHost(), {
             grant_type: 'refresh_token',
@@ -94,7 +97,7 @@ describe('Endpoint.CreateToken', () => {
         test('refreshing a token marks the user as active again', async () => {
             const organization = await new OrganizationFactory({}).create();
             const user = await new UserFactory({ organization, password }).create();
-            const token = await Token.createToken(user);
+            const token = await SessionService.createSession(user);
 
             const monthsAgo = new Date(Date.now() - 90 * 24 * 60 * 60 * 1000);
             monthsAgo.setMilliseconds(0);
@@ -125,4 +128,207 @@ describe('Endpoint.CreateToken', () => {
             expect(await getLastActiveAt(user)).toBeNull();
         });
     });
+
+    describe('session length', () => {
+        const password = 'test-password-1234';
+        const DAY = 24 * 60 * 60 * 1000;
+
+        function expectValidFor(date: Date, duration: number) {
+            expect(date.getTime()).toBeGreaterThan(Date.now() + duration - 5000);
+            expect(date.getTime()).toBeLessThanOrEqual(Date.now() + duration);
+        }
+
+        async function login(organization: Organization, user: User, platform: string | null = null): Promise<Token> {
+            const r = Request.buildJson('POST', '/oauth/token', organization.getApiHost(), {
+                grant_type: 'password',
+                username: user.email,
+                password,
+            });
+            if (platform) {
+                r.headers['x-platform'] = platform;
+            }
+
+            const response = await testServer.test(endpoint, r);
+            if (!(response.body instanceof TokenStruct)) {
+                throw new Error('Expected TokenStruct');
+            }
+
+            const token = await Token.getByAccessToken(response.body.accessToken);
+            expect(token).toBeDefined();
+            return token!;
+        }
+
+        async function refresh(organization: Organization, refreshToken: string): Promise<Token> {
+            const r = Request.buildJson('POST', '/oauth/token', organization.getApiHost(), {
+                grant_type: 'refresh_token',
+                refresh_token: refreshToken,
+            });
+
+            const response = await testServer.test(endpoint, r);
+            if (!(response.body instanceof TokenStruct)) {
+                throw new Error('Expected TokenStruct');
+            }
+
+            const token = await Token.getByAccessToken(response.body.accessToken);
+            expect(token).toBeDefined();
+            return token!;
+        }
+
+        async function getSession(token: Token): Promise<UserSession> {
+            const session = await UserSession.getByID(token.sessionId);
+            if (!session) throw new Error('Expected user session');
+            return session;
+        }
+
+        test('an administrator that signs in in a browser gets a limited session', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const admin = await new UserFactory({
+                organization,
+                password,
+                permissions: Permissions.create({ level: PermissionLevel.Full }),
+            }).create();
+
+            const token = await login(organization, admin, 'web');
+
+            expect((await getSession(token)).clientType).toBe(SessionClientType.Browser);
+            expectValidFor(token.refreshTokenValidUntil, SESSION_DURATIONS.admin[SessionClientType.Browser].refreshToken);
+        });
+
+        test('an administrator that signs in in the native app has no maximum session length', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const admin = await new UserFactory({
+                organization,
+                password,
+                permissions: Permissions.create({ level: PermissionLevel.Full }),
+            }).create();
+
+            const token = await login(organization, admin, 'ios');
+
+            expect((await getSession(token)).clientType).toBe(SessionClientType.iOS);
+            expectValidFor(token.refreshTokenValidUntil, SESSION_DURATIONS.admin[SessionClientType.iOS].refreshToken);
+
+            const browserSessionDuration = SESSION_DURATIONS.admin[SessionClientType.Browser].session;
+            if (browserSessionDuration === null) {
+                throw new Error('Expected browser administrator sessions to have a maximum length');
+            }
+            const userSession = await getSession(token);
+            userSession.startedAt = new Date(Date.now() - 2 * browserSessionDuration);
+            await userSession.save();
+
+            const renewed = await refresh(organization, token.refreshToken);
+            expectValidFor(renewed.refreshTokenValidUntil, SESSION_DURATIONS.admin[SessionClientType.iOS].refreshToken);
+        });
+
+        test('renewing the same active token twice revokes the first replacement', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const user = await new UserFactory({ organization, password }).create();
+            const original = await login(organization, user);
+
+            const firstReplacement = await refresh(organization, original.refreshToken);
+            const secondReplacement = await refresh(organization, original.refreshToken);
+
+            expect(secondReplacement.sessionId).toBe(original.sessionId);
+            expect(await Token.getByAccessToken(firstReplacement.accessToken)).toBeUndefined();
+            expect(await Token.getByAccessToken(original.accessToken)).toBeDefined();
+            expect(await Token.getByAccessToken(secondReplacement.accessToken)).toBeDefined();
+
+            const sessionTokens = await Token.where({ sessionId: original.sessionId });
+            expect(sessionTokens.map(token => token.id).sort()).toEqual([original.id, secondReplacement.id].sort());
+
+            const forkRequest = Request.buildJson('POST', '/oauth/token', organization.getApiHost(), {
+                grant_type: 'refresh_token',
+                refresh_token: firstReplacement.refreshToken,
+            });
+            await expect(testServer.test(endpoint, forkRequest)).rejects.toMatchObject({ code: 'invalid_refresh_token' });
+        });
+
+        test('an SSO handoff refresh token can only be exchanged once', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const user = await new UserFactory({ organization }).create();
+            const handoff = await SessionService.createSSOHandoff(user);
+
+            const sessionToken = await refresh(organization, handoff.refreshToken);
+            expect(sessionToken.sessionId).toBe(handoff.sessionId);
+
+            await expect(refresh(organization, handoff.refreshToken)).rejects.toMatchObject({
+                code: 'invalid_refresh_token',
+            });
+        });
+
+        test('concurrent exchanges cannot fork an SSO handoff', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const user = await new UserFactory({ organization }).create();
+            const handoff = await SessionService.createSSOHandoff(user);
+
+            const exchanges = await Promise.allSettled([
+                refresh(organization, handoff.refreshToken),
+                refresh(organization, handoff.refreshToken),
+            ]);
+
+            expect(exchanges.filter(result => result.status === 'fulfilled')).toHaveLength(1);
+            const rejected = exchanges.filter(result => result.status === 'rejected');
+            expect(rejected).toHaveLength(1);
+            expect(rejected[0].reason).toMatchObject({ code: 'invalid_refresh_token' });
+        });
+
+        test('renewing an access token does not extend the session past its maximum length', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const admin = await new UserFactory({
+                organization,
+                password,
+                permissions: Permissions.create({ level: PermissionLevel.Full }),
+            }).create();
+
+            const token = await login(organization, admin, 'web');
+
+            const sessionDuration = SESSION_DURATIONS.admin[SessionClientType.Browser].session;
+            if (sessionDuration === null) {
+                throw new Error('Expected browser administrator sessions to have a maximum length');
+            }
+            const sessionStartedAt = new Date(Date.now() - sessionDuration + DAY);
+            sessionStartedAt.setMilliseconds(0);
+            const userSession = await getSession(token);
+            userSession.startedAt = sessionStartedAt;
+            await userSession.save();
+
+            const renewed = await refresh(organization, token.refreshToken);
+
+            expect((await getSession(renewed)).startedAt).toEqual(sessionStartedAt);
+            expect(renewed.refreshTokenValidUntil.getTime()).toBeLessThanOrEqual(sessionStartedAt.getTime() + sessionDuration);
+            expect(renewed.refreshTokenValidUntil.getTime()).toBeGreaterThan(Date.now());
+        });
+
+        test('a session that reached its maximum length cannot be renewed', async () => {
+            const organization = await new OrganizationFactory({}).create();
+            const admin = await new UserFactory({
+                organization,
+                password,
+                permissions: Permissions.create({ level: PermissionLevel.Full }),
+            }).create();
+
+            const token = await login(organization, admin, 'web');
+            const sessionDuration = SESSION_DURATIONS.admin[SessionClientType.Browser].session;
+            if (sessionDuration === null) {
+                throw new Error('Expected browser administrator sessions to have a maximum length');
+            }
+            const userSession = await getSession(token);
+            userSession.startedAt = new Date(Date.now() - sessionDuration - DAY);
+            await userSession.save();
+            token.refreshTokenValidUntil = new Date(Date.now() + DAY);
+            await token.save();
+
+            const otherSession = await login(organization, admin, 'web');
+
+            const r = Request.buildJson('POST', '/oauth/token', organization.getApiHost(), {
+                grant_type: 'refresh_token',
+                refresh_token: token.refreshToken,
+            });
+
+            await expect(testServer.test(endpoint, r)).rejects.toMatchObject({ code: 'invalid_refresh_token' });
+            expect(await Token.getByAccessToken(otherSession.accessToken)).toBeDefined();
+
+            await expect(testServer.test(endpoint, r)).rejects.toMatchObject({ code: 'invalid_refresh_token' });
+            expect(await Token.getByAccessToken(otherSession.accessToken)).toBeDefined();
+        });
+    });
 });