@stamhoofd/backend 2.144.0 → 2.145.0

package/src/endpoints/auth/CreateTokenEndpoint.ts

@@ -3,13 +3,14 @@ import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { EmailVerificationCode, MFATOTP, MFAToken, PasswordToken, Platform, Token, User, WebauthnCredential } from '@stamhoofd/models';
 import type { ChallengeGrantStruct, MFAGrantStruct, PasswordGrantStruct, PasswordTokenGrantStruct, RefreshTokenGrantStruct, RequestChallengeGrantStruct } from '@stamhoofd/structures';
-import { CreateTokenStruct, LoginMethod, MFAMethodType, SignupResponse, Token as TokenStruct } from '@stamhoofd/structures';
+import { CreateTokenStruct, LoginMethod, MFAMethodType, SessionLoginMethod, SignupResponse, Token as TokenStruct } from '@stamhoofd/structures';
 
 import { Context } from '../../helpers/Context.js';
 import { RecoveryCodeHelper } from '../../helpers/RecoveryCodeHelper.js';
 import { TOTPHelper } from '../../helpers/TOTPHelper.js';
 import { mfaVerificationRateLimiter, TwoFactorHelper } from '../../helpers/TwoFactorHelper.js';
 import { WebauthnHelper } from '../../helpers/WebauthnHelper.js';
+import { SessionService } from '../../services/SessionService.js';
 import { VerificationCodeService } from '../../services/VerificationCodeService.js';
 
 type Params = Record<string, never>;
@@ -45,7 +46,7 @@ export class CreateTokenEndpoint extends Endpoint<Params, Query, Body, ResponseB
 
         switch (request.body.grantType) {
             case 'refresh_token': {
-                const oldToken = await Token.getByRefreshToken(request.body.refreshToken);
+                const oldToken = await SessionService.getByRefreshToken(request.body.refreshToken);
                 if (!oldToken) {
                     throw new SimpleError({
                         code: 'invalid_refresh_token',
@@ -63,19 +64,7 @@ export class CreateTokenEndpoint extends Endpoint<Params, Query, Body, ResponseB
                     });
                 }
 
-                // Important to create a new token before adjusting the old token
-                const token = await Token.createToken(oldToken.user);
-
-                // In the rare event our response doesn't reach the client anymore, we don't want the client to sign out...
-                // So we allow a small rotation overlap period
-                const leeway = 60 * 1000;
-                oldToken.refreshTokenValidUntil = new Date(Math.min(oldToken.refreshTokenValidUntil.getTime(), Date.now() + leeway));
-
-                // Invalidate the corresponding access token
-                oldToken.accessTokenValidUntil = new Date(Date.now() - 60 * 60 * 1000);
-
-                // Do not delete the old one, only expire it fast so it will get deleted in the future
-                await oldToken.save();
+                const token = await SessionService.rotateSession(oldToken);
 
                 if (!token) {
                     throw new SimpleError({
@@ -150,9 +139,9 @@ export class CreateTokenEndpoint extends Endpoint<Params, Query, Body, ResponseB
                 // Second factor / forced enrollment: block the session until the user
                 // completes (or first sets up) a second factor. Shared with every other
                 // grant that mints a session from a single primary credential.
-                await TwoFactorHelper.assertSecondFactorOrThrow(user, organization, request.request.getVersion(), { loginMethod: 'password', i18n: request.i18n });
+                await TwoFactorHelper.assertSecondFactorOrThrow(user, organization, request.request.getVersion(), { loginMethod: SessionLoginMethod.Password, i18n: request.i18n });
 
-                const token = await Token.createToken(user, new Date());
+                const token = await SessionService.createSession(user, { loginMethod: SessionLoginMethod.Password, authenticatedAt: new Date() });
 
                 if (!token) {
                     throw new SimpleError({
@@ -264,7 +253,7 @@ export class CreateTokenEndpoint extends Endpoint<Params, Query, Body, ResponseB
                     });
                 }
 
-                const token = await Token.createToken(user, new Date());
+                const token = await SessionService.createSession(user, { loginMethod: mfaToken.loginMethod, authenticatedAt: new Date() });
                 await user.markActive();
 
                 const st = new TokenStruct(token);
@@ -314,10 +303,10 @@ export class CreateTokenEndpoint extends Endpoint<Params, Query, Body, ResponseB
                 //
                 // The link was emailed to the account, so this is also how a long-inactive
                 // admin confirms their email address and gets to enroll after all.
-                await TwoFactorHelper.assertSecondFactorOrThrow(passwordToken.user, organization, request.request.getVersion(), { loginMethod: 'email', i18n: request.i18n, allowTemporarySession: true });
+                await TwoFactorHelper.assertSecondFactorOrThrow(passwordToken.user, organization, request.request.getVersion(), { loginMethod: SessionLoginMethod.Email, i18n: request.i18n, allowTemporarySession: true });
 
                 // Important to create a new token before adjusting the old token
-                const token = await Token.createToken(passwordToken.user, new Date());
+                const token = await SessionService.createSession(passwordToken.user, { loginMethod: SessionLoginMethod.Email, authenticatedAt: new Date() });
 
                 // TODO: make token short lived until renewal
 

package/src/endpoints/auth/DeleteTokenEndpoint.test.ts

@@ -0,0 +1,29 @@
+import { Request } from '@simonbackx/simple-endpoints';
+import { OrganizationFactory, Token, UserFactory, UserSession } from '@stamhoofd/models';
+
+import { testServer } from '../../../tests/helpers/TestServer.js';
+import { SessionService } from '../../services/SessionService.js';
+import { DeleteTokenEndpoint } from './DeleteTokenEndpoint.js';
+
+describe('Endpoint.DeleteToken', () => {
+    const endpoint = new DeleteTokenEndpoint();
+
+    test('ends the session and deletes every token in it', async () => {
+        const organization = await new OrganizationFactory({}).create();
+        const user = await new UserFactory({ organization }).create();
+        const original = await SessionService.createSession(user);
+        const renewed = await SessionService.rotateSession(original);
+        const otherSession = await SessionService.createSession(user);
+
+        const request = Request.buildJson('DELETE', '/oauth/token', organization.getApiHost());
+        request.headers.authorization = 'Bearer ' + original.accessToken;
+        await testServer.test(endpoint, request);
+
+        expect(await UserSession.getByID(original.sessionId)).toBeUndefined();
+        expect(await Token.getByAccessToken(original.accessToken, true)).toBeUndefined();
+        expect(await Token.getByAccessToken(renewed.accessToken, true)).toBeUndefined();
+        expect(await UserSession.getByID(otherSession.sessionId)).toBeDefined();
+        expect(await Token.getByAccessToken(otherSession.accessToken, true)).toBeDefined();
+    });
+
+});

package/src/endpoints/auth/DeleteTokenEndpoint.ts

@@ -2,6 +2,7 @@ import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 
 import { Context } from '../../helpers/Context.js';
+import { SessionService } from '../../services/SessionService.js';
 
 type Params = Record<string, never>;
 type Query = undefined;
@@ -25,7 +26,7 @@ export class DeleteTokenEndpoint extends Endpoint<Params, Query, Body, ResponseB
     async handle(_: DecodedRequest<Params, Query, Body>) {
         await Context.setOptionalOrganizationScope();
         const { token } = await Context.authenticate({ allowWithoutAccount: true });
-        await token.delete();
+        await SessionService.endSession(token);
 
         return new Response(undefined);
     }

package/src/endpoints/auth/GetUserEndpoint.test.ts

@@ -3,6 +3,7 @@ import { MemberFactory, OrganizationFactory, Token, UserFactory } from '@stamhoo
 
 import { MFATestHelper } from '../../../tests/helpers/MFATestHelper.js';
 import { testServer } from '../../../tests/helpers/TestServer.js';
+import { SessionService } from '../../services/SessionService.js';
 import { GetUserEndpoint } from './GetUserEndpoint.js';
 import { STExpect } from '@stamhoofd/test-utils';
 
@@ -13,7 +14,7 @@ describe('Endpoint.GetUser', () => {
     test('Request user details when signed in', async () => {
         const organization = await new OrganizationFactory({}).create();
         const user = await new UserFactory({ organization }).create();
-        const token = await Token.createToken(user);
+        const token = await SessionService.createSession(user);
 
         const r = Request.buildJson('GET', '/v1/user', organization.getApiHost());
         r.headers.authorization = 'Bearer ' + token.accessToken;
@@ -23,13 +24,32 @@ describe('Endpoint.GetUser', () => {
         expect(response.body.id).toEqual(user.id);
     });
 
+    test('using a renewed token retires the previous active token', async () => {
+        const organization = await new OrganizationFactory({}).create();
+        const user = await new UserFactory({ organization }).create();
+        const original = await SessionService.createSession(user);
+        const replacement = await SessionService.rotateSession(original);
+
+        const originalRequest = Request.buildJson('GET', '/v1/user', organization.getApiHost());
+        originalRequest.headers.authorization = 'Bearer ' + original.accessToken;
+        await testServer.test(endpoint, originalRequest);
+
+        const replacementRequest = Request.buildJson('GET', '/v1/user', organization.getApiHost());
+        replacementRequest.headers.authorization = 'Bearer ' + replacement.accessToken;
+        await testServer.test(endpoint, replacementRequest);
+
+        await expect(testServer.test(endpoint, originalRequest)).rejects.toThrow(STExpect.simpleError({
+            code: 'invalid_access_token',
+        }));
+    });
+
     test('Two-factor authentication is reported on the user and on the accounts of a member', async () => {
         const organization = await new OrganizationFactory({}).create();
         const user = await new UserFactory({ organization }).create();
         await new MemberFactory({ organization, user }).create();
         await MFATestHelper.addConfirmedTOTP(user);
 
-        const token = await Token.createToken(user);
+        const token = await SessionService.createSession(user);
         const r = Request.buildJson('GET', '/v1/user', organization.getApiHost());
         r.headers.authorization = 'Bearer ' + token.accessToken;
 
@@ -44,7 +64,7 @@ describe('Endpoint.GetUser', () => {
     test('A user without a second factor is not reported as having two-factor authentication', async () => {
         const organization = await new OrganizationFactory({}).create();
         const user = await new UserFactory({ organization }).create();
-        const token = await Token.createToken(user);
+        const token = await SessionService.createSession(user);
 
         const r = Request.buildJson('GET', '/v1/user', organization.getApiHost());
         r.headers.authorization = 'Bearer ' + token.accessToken;
@@ -62,7 +82,7 @@ describe('Endpoint.GetUser', () => {
     test('Request user details with invalid token is not working', async () => {
         const organization = await new OrganizationFactory({}).create();
         const user = await new UserFactory({ organization }).create();
-        const token = await Token.createToken(user);
+        const token = await SessionService.createSession(user);
 
         const r = Request.buildJson('GET', '/v1/user', organization.getApiHost());
         r.headers.authorization = 'Bearer ' + token.accessToken + 'd';
@@ -73,7 +93,9 @@ describe('Endpoint.GetUser', () => {
     test('Request user details with expired token is not working', async () => {
         const organization = await new OrganizationFactory({}).create();
         const user = await new UserFactory({ organization }).create();
-        const token = await Token.createExpiredToken(user);
+        const token = await SessionService.createSession(user);
+        token.accessTokenValidUntil = new Date(Date.now() - 1000);
+        await token.save();
 
         const r = Request.buildJson('GET', '/v1/user', organization.getApiHost());
         r.headers.authorization = 'Bearer ' + token.accessToken;
@@ -84,7 +106,7 @@ describe('Endpoint.GetUser', () => {
     test('Can request details of an API user by token without knowing the organization scope', async () => {
         const organization = await new OrganizationFactory({}).create();
         const user = await new UserFactory({ organization, apiUser: true }).create();
-        const token = await Token.createToken(user);
+        const token = await SessionService.createSession(user);
 
         const r = Request.buildJson('GET', '/v1/user');
         r.headers.authorization = 'Bearer ' + token.accessToken;
@@ -98,13 +120,13 @@ describe('Endpoint.GetUser', () => {
     test('Cannot request details of an normal user by token without knowing the organization scope', async () => {
         const organization = await new OrganizationFactory({}).create();
         const user = await new UserFactory({ organization }).create();
-        const token = await Token.createToken(user);
+        const token = await SessionService.createSession(user);
 
         const r = Request.buildJson('GET', '/v1/user');
         r.headers.authorization = 'Bearer ' + token.accessToken;
 
         await expect(testServer.test(endpoint, r)).rejects.toThrow(STExpect.simpleError({
-            code: 'invalid_access_token'
+            code: 'invalid_access_token',
         }));
     });
 
@@ -112,14 +134,13 @@ describe('Endpoint.GetUser', () => {
         const wrongOrganization = await new OrganizationFactory({}).create();
         const organization = await new OrganizationFactory({}).create();
         const user = await new UserFactory({ organization, apiUser: true }).create();
-        const token = await Token.createToken(user);
+        const token = await SessionService.createSession(user);
 
         const r = Request.buildJson('GET', '/v1/user', wrongOrganization.getApiHost());
         r.headers.authorization = 'Bearer ' + token.accessToken;
 
         await expect(testServer.test(endpoint, r)).rejects.toThrow(STExpect.simpleError({
-            code: 'invalid_access_token'
+            code: 'invalid_access_token',
         }));
     });
-
 });

package/src/endpoints/auth/MFA.security.test.ts

@@ -1,10 +1,13 @@
 import { Request } from '@simonbackx/simple-endpoints';
-import { isSimpleError, isSimpleErrors, SimpleError } from '@simonbackx/simple-errors';
-import { EmailVerificationCode, MFARecoveryCode, MFATOTP, MFAToken, Organization, OrganizationFactory, PasswordToken, Token, User, UserFactory, WebauthnCredential } from '@stamhoofd/models';
+import type { SimpleError } from '@simonbackx/simple-errors';
+import { isSimpleError, isSimpleErrors } from '@simonbackx/simple-errors';
+import type { Organization } from '@stamhoofd/models';
+import { EmailVerificationCode, MFARecoveryCode, MFATOTP, MFAToken, OrganizationFactory, PasswordToken, Token, User, UserFactory, WebauthnCredential } from '@stamhoofd/models';
 import { NewUser, PermissionLevel, Permissions, Token as TokenStruct } from '@stamhoofd/structures';
 import { TestUtils } from '@stamhoofd/test-utils';
 import crypto from 'crypto';
 import { authenticator } from 'otplib';
+import { SessionService } from '../../services/SessionService.js';
 
 import { MFATestHelper } from '../../../tests/helpers/MFATestHelper.js';
 import { testServer } from '../../../tests/helpers/TestServer.js';
@@ -49,8 +52,7 @@ function firstError(e: unknown): SimpleError {
 async function captureError(promise: Promise<unknown>): Promise<SimpleError> {
     try {
         await promise;
-    }
-    catch (e) {
+    } catch (e) {
         return firstError(e);
     }
     throw new Error('Expected the request to be rejected, but it succeeded');
@@ -79,7 +81,7 @@ function withSetup(request: Request, setupToken: string) {
 }
 
 async function freshToken(user: User): Promise<Token> {
-    return await Token.createToken(user, new Date());
+    return await SessionService.createSession(user, { authenticatedAt: new Date() });
 }
 
 async function addConfirmedTOTP(user: User): Promise<{ id: string; secret: string }> {
@@ -649,9 +651,9 @@ describe('MFA security', () => {
             // separately and are not browser sessions.
             const organization = await new OrganizationFactory({}).create();
             const apiUser = await new UserFactory({ organization, apiUser: true }).create();
-            const apiToken = await Token.createToken(apiUser);
+            const apiToken = await SessionService.createSession(apiUser);
 
-            expect(await Token.deleteOtherSessions(apiUser.id, null)).toBe(0);
+            expect(await SessionService.deleteOtherSessions({ userId: apiUser.id, keepAccessToken: null })).toBe(0);
             expect(await Token.getByAccessToken(apiToken.accessToken, true)).toBeDefined();
         });
     });

package/src/endpoints/auth/MFA.test.ts

@@ -1,10 +1,14 @@
-import { Endpoint, Request } from '@simonbackx/simple-endpoints';
-import { isSimpleError, isSimpleErrors, SimpleError } from '@simonbackx/simple-errors';
+import type { Endpoint } from '@simonbackx/simple-endpoints';
+import { Request } from '@simonbackx/simple-endpoints';
+import type { SimpleError } from '@simonbackx/simple-errors';
+import { isSimpleError, isSimpleErrors } from '@simonbackx/simple-errors';
 import { EmailMocker } from '@stamhoofd/email';
-import { AuditLog, EmailTemplateFactory, EmailVerificationCode, MFARecoveryCode, MFATOTP, MFAToken, Organization, PasswordToken, Platform, Token, User, UserFactory, OrganizationFactory, WebauthnChallenge, WebauthnCredential } from '@stamhoofd/models';
-import { AuditLogReplacementType, AuditLogType, EmailTemplateType, MFAMethodType, PermissionLevel, Permissions, Token as TokenStruct } from '@stamhoofd/structures';
+import type { Organization } from '@stamhoofd/models';
+import { AuditLog, EmailTemplateFactory, EmailVerificationCode, MFARecoveryCode, MFATOTP, MFAToken, PasswordToken, Platform, Token, User, UserFactory, OrganizationFactory, UserSession, WebauthnChallenge, WebauthnCredential } from '@stamhoofd/models';
+import { AuditLogReplacementType, AuditLogType, EmailTemplateType, MFAMethodType, PermissionLevel, Permissions, SessionLoginMethod, Token as TokenStruct } from '@stamhoofd/structures';
 import { authenticator } from 'otplib';
 import crypto from 'crypto';
+import { SessionService } from '../../services/SessionService.js';
 
 import { MFATestHelper } from '../../../tests/helpers/MFATestHelper.js';
 import { testServer } from '../../../tests/helpers/TestServer.js';
@@ -43,8 +47,7 @@ function firstError(e: unknown): SimpleError {
 async function captureError(promise: Promise<unknown>): Promise<SimpleError> {
     try {
         await promise;
-    }
-    catch (e) {
+    } catch (e) {
         return firstError(e);
     }
     throw new Error('Expected the request to throw');
@@ -106,12 +109,12 @@ function bearer(request: Request, token: Token) {
 }
 
 async function freshToken(user: User): Promise<Token> {
-    return await Token.createToken(user, new Date());
+    return await SessionService.createSession(user, { authenticatedAt: new Date() });
 }
 
 async function staleToken(user: User): Promise<Token> {
     // A token as produced by a refresh_token rotation (never authenticatedAt).
-    return await Token.createToken(user);
+    return await SessionService.createSession(user);
 }
 
 async function requireMfa(organization: Organization | null, email: string, password: string): Promise<{ token: string; methods: string[]; webauthnAuthenticationOptions: unknown }> {
@@ -668,8 +671,7 @@ describe('MFA', () => {
                 const err = await captureError(testServer.test(tokenEndpoint, passwordLogin(organization, user.email, password)));
                 expect(err.code).toBe('require_email_confirmation');
                 expect(send).toHaveBeenCalledOnce();
-            }
-            finally {
+            } finally {
                 send.mockRestore();
             }
         });
@@ -690,7 +692,7 @@ describe('MFA', () => {
             // The identity provider authenticated the user, so there is nothing to confirm.
             const { organization, user } = await inactiveAdmin();
 
-            const requirement = await TwoFactorHelper.getSecondFactorRequirement(user, organization, { loginMethod: 'sso' });
+            const requirement = await TwoFactorHelper.getSecondFactorRequirement(user, organization, { loginMethod: SessionLoginMethod.SSO });
             expect(requirement.type).toBe('setup');
         });
     });
@@ -1414,14 +1416,14 @@ describe('MFA', () => {
             const { organization, user } = await adminOfOrgRequiringTwoFactor({ withPassword: false });
             await addConfirmedTOTP(user);
 
-            const requirement = await TwoFactorHelper.getSecondFactorRequirement(user, organization, { loginMethod: 'sso' });
+            const requirement = await TwoFactorHelper.getSecondFactorRequirement(user, organization, { loginMethod: SessionLoginMethod.SSO });
             expect(requirement.type).toBe('challenge');
         });
 
         test('an SSO-only account is not forced to enroll: the provider is the second factor', async () => {
             const { organization, user } = await adminOfOrgRequiringTwoFactor({ withPassword: false });
 
-            const requirement = await TwoFactorHelper.getSecondFactorRequirement(user, organization, { loginMethod: 'sso' });
+            const requirement = await TwoFactorHelper.getSecondFactorRequirement(user, organization, { loginMethod: SessionLoginMethod.SSO });
             expect(requirement.type).toBe('none');
         });
 
@@ -1430,16 +1432,41 @@ describe('MFA', () => {
             // requirement is not satisfied by signing in through SSO.
             const { organization, user } = await adminOfOrgRequiringTwoFactor({ withPassword: true });
 
-            const requirement = await TwoFactorHelper.getSecondFactorRequirement(user, organization, { loginMethod: 'sso' });
+            const requirement = await TwoFactorHelper.getSecondFactorRequirement(user, organization, { loginMethod: SessionLoginMethod.SSO });
             expect(requirement.type).toBe('setup');
         });
 
         test('a password login is always forced to enroll', async () => {
             const { organization, user } = await adminOfOrgRequiringTwoFactor({ withPassword: true });
 
-            const requirement = await TwoFactorHelper.getSecondFactorRequirement(user, organization, { loginMethod: 'password' });
+            const requirement = await TwoFactorHelper.getSecondFactorRequirement(user, organization, { loginMethod: SessionLoginMethod.Password });
             expect(requirement.type).toBe('setup');
         });
+
+        test('the session of an SSO login that passed a second factor is an SSO session', async () => {
+            // The session is only created after the second factor, so the challenge has to
+            // remember how the user got there: it decides how long the session may live.
+            const { organization, user } = await adminOfOrgRequiringTwoFactor({ withPassword: false });
+            const { secret } = await addConfirmedTOTP(user);
+
+            const requirement = await TwoFactorHelper.getSecondFactorRequirement(user, organization, { loginMethod: SessionLoginMethod.SSO });
+            if (requirement.type !== 'challenge') {
+                throw new Error('Expected a challenge');
+            }
+
+            const response = await testServer.test(tokenEndpoint, mfaGrant(organization, {
+                mfa_token: requirement.challenge.token,
+                method: 'TOTP',
+                code: authenticator.generate(secret),
+            }));
+            if (!(response.body instanceof TokenStruct)) {
+                throw new Error('Expected TokenStruct');
+            }
+
+            const token = await Token.getByAccessToken(response.body.accessToken);
+            expect((await UserSession.getByID(token!.sessionId))!.loginMethod).toBe(SessionLoginMethod.SSO);
+            expect(token!.refreshTokenValidUntil.getTime()).toBeLessThanOrEqual(Date.now() + 3 * 60 * 60 * 1000);
+        });
     });
 
     // -----------------------------------------------------------------------

package/src/endpoints/auth/PatchUserEndpoint.ts

@@ -10,6 +10,7 @@ import { LoginMethod, NewUser, PermissionLevel, SignupResponse, UserPermissions
 import { Context } from '../../helpers/Context.js';
 import { MemberUserSyncer } from '../../helpers/MemberUserSyncer.js';
 import { AuthenticatedStructures } from '../../helpers/AuthenticatedStructures.js';
+import { SessionService } from '../../services/SessionService.js';
 import { VerificationCodeService } from '../../services/VerificationCodeService.js';
 
 type Params = { id: string };
@@ -163,7 +164,7 @@ export class PatchUserEndpoint extends Endpoint<Params, Query, Body, ResponseBod
             // password changes
             await editUser.changePassword(request.body.password);
             await PasswordToken.clearFor(editUser.id);
-            await Token.clearFor(editUser.id, token.accessToken);
+            await SessionService.clearFor({ userId: editUser.id, keepAccessToken: token.accessToken });
         }
 
         if (request.body.hasPassword === false) {
@@ -179,7 +180,7 @@ export class PatchUserEndpoint extends Endpoint<Params, Query, Body, ResponseBod
                 }
                 editUser.password = null;
                 await PasswordToken.clearFor(editUser.id);
-                await Token.clearFor(editUser.id, token.accessToken);
+                await SessionService.clearFor({ userId: editUser.id, keepAccessToken: token.accessToken });
             }
         }
 

package/src/endpoints/auth/VerifyEmailEndpoint.ts

@@ -2,12 +2,13 @@ import type { Decoder } from '@simonbackx/simple-encoding';
 import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
-import { EmailVerificationCode, Token, User } from '@stamhoofd/models';
-import { Token as TokenStruct, VerifyEmailRequest } from '@stamhoofd/structures';
+import { EmailVerificationCode, User } from '@stamhoofd/models';
+import { SessionLoginMethod, Token as TokenStruct, VerifyEmailRequest } from '@stamhoofd/structures';
 
 import { Context } from '../../helpers/Context.js';
 import { TwoFactorHelper } from '../../helpers/TwoFactorHelper.js';
 import { BalanceItemService } from '../../services/BalanceItemService.js';
+import { SessionService } from '../../services/SessionService.js';
 
 type Params = Record<string, never>;
 type Query = undefined;
@@ -130,10 +131,10 @@ export class VerifyEmailEndpoint extends Endpoint<Params, Query, Body, ResponseB
         // the request already comes from a session of that same user (changing your email
         // address while signed in): the second factor was checked when it was created.
         if (authenticatedUser?.id !== user.id) {
-            await TwoFactorHelper.assertSecondFactorOrThrow(user, organization, request.request.getVersion(), { loginMethod: 'email', i18n: request.i18n });
+            await TwoFactorHelper.assertSecondFactorOrThrow(user, organization, request.request.getVersion(), { loginMethod: SessionLoginMethod.Email, i18n: request.i18n });
         }
 
-        const token = await Token.createToken(user);
+        const token = await SessionService.createSession(user, { loginMethod: SessionLoginMethod.Email });
         await user.markActive();
 
         const st = new TokenStruct(token);

package/src/endpoints/global/email/GetAdminEmailsEndpoint.test.ts

@@ -1,11 +1,12 @@
 import { Request } from '@simonbackx/simple-endpoints';
-import type { Organization, RegistrationPeriod, User } from '@stamhoofd/models';
-import { Email, EmailRecipient, MemberFactory, OrganizationFactory, RegistrationPeriodFactory, Token, UserFactory } from '@stamhoofd/models';
+import type { Organization, RegistrationPeriod, User, Token } from '@stamhoofd/models';
+import { Email, EmailRecipient, MemberFactory, OrganizationFactory, RegistrationPeriodFactory, UserFactory } from '@stamhoofd/models';
 import { EmailStatus, LimitedFilteredRequest, PermissionLevel, Permissions, Replacement } from '@stamhoofd/structures';
 import { TestUtils } from '@stamhoofd/test-utils';
 import { testServer } from '../../../../tests/helpers/TestServer.js';
 import { GetAdminEmailsEndpoint } from './GetAdminEmailsEndpoint.js';
 import { Formatter } from '@stamhoofd/utility';
+import { SessionService } from '../../../services/SessionService.js';
 
 const baseUrl = `/email`;
 
@@ -39,7 +40,7 @@ describe('Endpoint.getAdminEmails', () => {
             user,
         }).create();
 
-        userToken = await Token.createToken(user);
+        userToken = await SessionService.createSession(user);
     });
 
     const getAdminEmails = async (query: LimitedFilteredRequest = new LimitedFilteredRequest({ limit: 10 }), token: Token = userToken, testOrganization: Organization = organization) => {

package/src/endpoints/global/email/GetUserEmailsEndpoint.test.ts

@@ -1,12 +1,13 @@
 import { Request } from '@simonbackx/simple-endpoints';
-import type { Organization, RegistrationPeriod, User } from '@stamhoofd/models';
-import { Email, EmailRecipient, MemberFactory, OrganizationFactory, RegistrationPeriodFactory, Token, UserFactory } from '@stamhoofd/models';
+import type { Organization, RegistrationPeriod, User, Token } from '@stamhoofd/models';
+import { Email, EmailRecipient, MemberFactory, OrganizationFactory, RegistrationPeriodFactory, UserFactory } from '@stamhoofd/models';
 import { EmailContent, EmailStatus, LimitedFilteredRequest, Replacement } from '@stamhoofd/structures';
 import { Language } from '@stamhoofd/types/Language';
 import { TestUtils } from '@stamhoofd/test-utils';
 import { testServer } from '../../../../tests/helpers/TestServer.js';
 import { GetUserEmailsEndpoint } from './GetUserEmailsEndpoint.js';
 import { Formatter } from '@stamhoofd/utility';
+import { SessionService } from '../../../services/SessionService.js';
 
 const baseUrl = `/user/email`;
 
@@ -39,7 +40,7 @@ describe('Endpoint.GetUserEmails', () => {
             user,
         }).create();
 
-        userToken = await Token.createToken(user);
+        userToken = await SessionService.createSession(user);
     });
 
     afterEach(async () => {
@@ -726,7 +727,7 @@ describe('Endpoint.GetUserEmails', () => {
         expect(response.body.results.find(e => e.id === email.id)).toBeUndefined();
 
         // Test that is IS included if we request the same data via the 'otherUser' token
-        const otherUserToken = await Token.createToken(otherUser);
+        const otherUserToken = await SessionService.createSession(otherUser);
         const responseForOtherUser = await getUserEmails(new LimitedFilteredRequest({ limit: 10 }), otherUserToken);
         expect(responseForOtherUser.body.results.find(e => e.id === email.id)).toBeDefined();
     });
@@ -805,7 +806,7 @@ describe('Endpoint.GetUserEmails', () => {
                 host: organization.getApiHost(),
                 query: new LimitedFilteredRequest({ limit: 10 }),
                 headers: {
-                    'authorization': 'Bearer ' + userToken.accessToken,
+                    authorization: 'Bearer ' + userToken.accessToken,
                     ...(language ? { 'accept-language': language } : {}),
                 },
             });

package/src/endpoints/global/email/PatchEmailEndpoint.test.ts

@@ -1,14 +1,15 @@
 import type { AutoEncoderPatchType } from '@simonbackx/simple-encoding';
 import { PatchMap } from '@simonbackx/simple-encoding';
 import { Request } from '@simonbackx/simple-endpoints';
-import type { Organization, RegistrationPeriod, User } from '@stamhoofd/models';
-import { Email, EmailRecipient, GroupFactory, MemberFactory, OrganizationFactory, RegistrationFactory, RegistrationPeriodFactory, Token, UserFactory } from '@stamhoofd/models';
+import type { Organization, RegistrationPeriod, User, Token } from '@stamhoofd/models';
+import { Email, EmailRecipient, GroupFactory, MemberFactory, OrganizationFactory, RegistrationFactory, RegistrationPeriodFactory, UserFactory } from '@stamhoofd/models';
 import { AccessRight, EmailContent, EmailRecipientFilter, EmailRecipientSubfilter, EmailStatus, Email as EmailStruct, OrganizationEmail, Parent, PermissionLevel, Permissions, PermissionsResourceType, ResourcePermissions, UserPermissions, Version } from '@stamhoofd/structures';
 import { Language } from '@stamhoofd/types/Language';
 import { STExpect, TestUtils } from '@stamhoofd/test-utils';
 import { testServer } from '../../../../tests/helpers/TestServer.js';
 import { PatchEmailEndpoint } from './PatchEmailEndpoint.js';
 import { EmailRecipientFilterType } from '@stamhoofd/structures/email/EmailRecipientFilterType.js';
+import { SessionService } from '../../../services/SessionService.js';
 
 // Import recipient loaders to initialize them
 import { Formatter } from '@stamhoofd/utility';
@@ -82,7 +83,7 @@ describe('Endpoint.PatchEmailEndpoint', () => {
         })
             .create();
 
-        token = await Token.createToken(user);
+        token = await SessionService.createSession(user);
 
         user2 = await new UserFactory({
             organization,
@@ -99,7 +100,7 @@ describe('Endpoint.PatchEmailEndpoint', () => {
         })
             .create();
 
-        token2 = await Token.createToken(user2);
+        token2 = await SessionService.createSession(user2);
     });
 
     test('Should throw for invalid senderId', async () => {

package/src/endpoints/global/email-recipients/GetEmailRecipientsEndpoint.test.ts

@@ -1,10 +1,11 @@
 import { STExpect, TestUtils } from '@stamhoofd/test-utils';
 import { GetEmailRecipientsEndpoint } from './GetEmailRecipientsEndpoint.js';
 import { AccessRight, EmailStatus, LimitedFilteredRequest, OrganizationEmail, PermissionLevel, Permissions, PermissionsResourceType, ResourcePermissions } from '@stamhoofd/structures';
-import type { Organization, RegistrationPeriod, User } from '@stamhoofd/models';
-import { Email, EmailRecipient, OrganizationFactory, RegistrationPeriodFactory, Token, UserFactory } from '@stamhoofd/models';
+import type { Organization, RegistrationPeriod, User, Token } from '@stamhoofd/models';
+import { Email, EmailRecipient, OrganizationFactory, RegistrationPeriodFactory, UserFactory } from '@stamhoofd/models';
 import { Request } from '@simonbackx/simple-endpoints';
 import { testServer } from '../../../../tests/helpers/TestServer.js';
+import { SessionService } from '../../../services/SessionService.js';
 
 const baseUrl = `/email-recipients`;
 
@@ -57,7 +58,7 @@ describe('Endpoint.GetEmailRecipients', () => {
         })
             .create();
 
-        token = await Token.createToken(user);
+        token = await SessionService.createSession(user);
 
         user2 = await new UserFactory({
             organization,
@@ -73,7 +74,7 @@ describe('Endpoint.GetEmailRecipients', () => {
         })
             .create();
 
-        token2 = await Token.createToken(user2);
+        token2 = await SessionService.createSession(user2);
     });
 
     test('It can request all email recipients if read permission for all senders', async () => {

package/src/endpoints/global/events/PatchEventNotificationsEndpoint.test.ts

@@ -10,6 +10,7 @@ import { testServer } from '../../../../tests/helpers/TestServer.js';
 import '../../../audit-logs/init.js';
 import { AuditLogService } from '../../../services/AuditLogService.js';
 import { PatchEventNotificationsEndpoint } from './PatchEventNotificationsEndpoint.js';
+import { SessionService } from '../../../services/SessionService.js';
 
 const baseUrl = `/event-notifications`;
 const endpoint = new PatchEventNotificationsEndpoint();
@@ -34,7 +35,7 @@ const TestRequest = {
     }) {
         const request = Request.buildJson('PATCH', baseUrl, options.organization?.getApiHost(), options.body);
         if (options.user) {
-            const token = await Token.createToken(options.user);
+            const token = await SessionService.createSession(options.user);
             request.headers.authorization = 'Bearer ' + token.accessToken;
         }
         return await testServer.test(endpoint, request);