@stamhoofd/backend 2.144.0 → 2.145.0

package/src/endpoints/organization/dashboard/users/CreateApiUserEndpoint.test.ts

@@ -1,5 +1,6 @@
 import { Request } from '@simonbackx/simple-endpoints';
 import { OrganizationFactory, Token, UserFactory } from '@stamhoofd/models';
+import { SessionService } from '../../../../services/SessionService.js';
 
 import { testServer } from '../../../../../tests/helpers/TestServer.js';
 import { PatchApiUserEndpoint } from './PatchApiUserEndpoint.js';
@@ -28,7 +29,7 @@ describe('Endpoint.CreateApiUserEndpoint', () => {
         }).create();
 
         // A token as produced by a refresh_token rotation (never authenticatedAt).
-        const token = await Token.createToken(user);
+        const token = await SessionService.createSession(user);
 
         const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
             permissions: UserPermissions.create({
@@ -51,7 +52,7 @@ describe('Endpoint.CreateApiUserEndpoint', () => {
                 level: PermissionLevel.Full,
             }),
         }).create();
-        const token = await Token.createToken(user, new Date());
+        const token = await SessionService.createSession(user, { authenticatedAt: new Date() });
 
         const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
             permissions: UserPermissions.create({
@@ -78,7 +79,7 @@ describe('Endpoint.CreateApiUserEndpoint', () => {
             }),
             organization,
         }).create();
-        const token = await Token.createToken(user, new Date());
+        const token = await SessionService.createSession(user, { authenticatedAt: new Date() });
 
         const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
             permissions: UserPermissions.create({
@@ -105,7 +106,7 @@ describe('Endpoint.CreateApiUserEndpoint', () => {
             }),
             organization,
         }).create();
-        const token = await Token.createToken(user, new Date());
+        const token = await SessionService.createSession(user, { authenticatedAt: new Date() });
 
         const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
             permissions: UserPermissions.create({

package/src/endpoints/organization/dashboard/users/CreateApiUserEndpoint.ts

@@ -6,6 +6,7 @@ import { Token, User } from '@stamhoofd/models';
 import { ApiUser, ApiUserWithToken, UserMeta, UserPermissions } from '@stamhoofd/structures';
 
 import { Context } from '../../../../helpers/Context.js';
+import { SessionService } from '../../../../services/SessionService.js';
 type Params = Record<string, never>;
 type Query = undefined;
 type Body = ApiUser;
@@ -79,7 +80,7 @@ export class CreateApiUserEndpoint extends Endpoint<Params, Query, Body, Respons
         admin.email = admin.id + '.api';
         await admin.save();
 
-        const createdToken = await Token.createApiToken(admin);
+        const createdToken = await SessionService.createApiSession(admin);
 
         return new Response(ApiUserWithToken.create({
             ...(await Token.getAPIUserWithToken(admin)),

package/src/endpoints/organization/dashboard/users/GetOrganizationAdminsEndpoint.test.ts

@@ -3,6 +3,7 @@ import type { Organization, User } from '@stamhoofd/models';
 import { MFATOTP, OrganizationFactory, Token, UserFactory, WebauthnCredential } from '@stamhoofd/models';
 import { OrganizationAdmins, PermissionLevel, Permissions } from '@stamhoofd/structures';
 import crypto from 'crypto';
+import { SessionService } from '../../../../services/SessionService.js';
 
 import { MFATestHelper } from '../../../../../tests/helpers/MFATestHelper.js';
 import { testServer } from '../../../../../tests/helpers/TestServer.js';
@@ -19,7 +20,7 @@ describe('Endpoint.GetOrganizationAdmins', () => {
     }
 
     async function getAdmins(organization: Organization, user: User) {
-        const token = await Token.createToken(user, new Date());
+        const token = await SessionService.createSession(user, { authenticatedAt: new Date() });
         const request = Request.buildJson('GET', '/organization/admins', organization.getApiHost());
         request.headers.authorization = 'Bearer ' + token.accessToken;
 
@@ -45,7 +46,7 @@ describe('Endpoint.GetOrganizationAdmins', () => {
         inactiveAdmin.lastActiveAt = lastActiveAt;
         await inactiveAdmin.save();
 
-        const token = await Token.createToken(user, new Date());
+        const token = await SessionService.createSession(user, { authenticatedAt: new Date() });
         const request = Request.buildJson('GET', '/organization/admins', organization.getApiHost());
         request.headers.authorization = 'Bearer ' + token.accessToken;
 

package/src/endpoints/organization/dashboard/users/PatchApiUserEndpoint.test.ts

@@ -1,5 +1,6 @@
 import { Request } from '@simonbackx/simple-endpoints';
 import { OrganizationFactory, Token, UserFactory } from '@stamhoofd/models';
+import { SessionService } from '../../../../services/SessionService.js';
 
 import { testServer } from '../../../../../tests/helpers/TestServer.js';
 import { PatchApiUserEndpoint } from './PatchApiUserEndpoint.js';
@@ -24,7 +25,7 @@ describe('Endpoint.PatchApiUserEndpoint', () => {
                 level: PermissionLevel.Full,
             }),
         }).create();
-        const token = await Token.createToken(user, new Date());
+        const token = await SessionService.createSession(user, { authenticatedAt: new Date() });
 
         const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
             permissions: UserPermissions.create({
@@ -60,7 +61,7 @@ describe('Endpoint.PatchApiUserEndpoint', () => {
             }),
             organization,
         }).create();
-        const token = await Token.createToken(user, new Date());
+        const token = await SessionService.createSession(user, { authenticatedAt: new Date() });
 
         const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
             permissions: UserPermissions.create({
@@ -95,7 +96,7 @@ describe('Endpoint.PatchApiUserEndpoint', () => {
             }),
             organization,
         }).create();
-        const token = await Token.createToken(user, new Date());
+        const token = await SessionService.createSession(user, { authenticatedAt: new Date() });
 
         const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
             permissions: UserPermissions.create({
@@ -143,7 +144,7 @@ describe('Endpoint.PatchApiUserEndpoint', () => {
             }),
             organization,
         }).create();
-        const token = await Token.createToken(user, new Date());
+        const token = await SessionService.createSession(user, { authenticatedAt: new Date() });
 
         const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
             permissions: UserPermissions.create({
@@ -190,7 +191,7 @@ describe('Endpoint.PatchApiUserEndpoint', () => {
             }),
             organization,
         }).create();
-        const token = await Token.createToken(user, new Date());
+        const token = await SessionService.createSession(user, { authenticatedAt: new Date() });
 
         const createRequest = Request.buildJson('POST', '/api-keys', organization.getApiHost(), ApiUser.create({
             permissions: UserPermissions.create({

package/src/endpoints/organization/dashboard/users/SignOutOrganizationAdminsEndpoint.test.ts

@@ -3,6 +3,7 @@ import type { Organization, User } from '@stamhoofd/models';
 import { OrganizationFactory, Token, UserFactory } from '@stamhoofd/models';
 import { PermissionLevel, Permissions, UserPermissions } from '@stamhoofd/structures';
 import { STExpect, TestUtils } from '@stamhoofd/test-utils';
+import { SessionService } from '../../../../services/SessionService.js';
 
 import { testServer } from '../../../../../tests/helpers/TestServer.js';
 import { AdminSessionService } from '../../../../services/AdminSessionService.js';
@@ -47,11 +48,11 @@ describe('Endpoint.SignOutOrganizationAdmins', () => {
         const otherOrganizationAdmin = await createAdmin(otherOrganization);
         const member = await new UserFactory({ organization }).create();
 
-        const currentToken = await Token.createToken(admin, new Date());
-        const secondDeviceOfAdmin = await Token.createToken(admin, new Date());
-        const otherAdminToken = await Token.createToken(otherAdmin, new Date());
-        const otherOrganizationAdminToken = await Token.createToken(otherOrganizationAdmin, new Date());
-        const memberToken = await Token.createToken(member, new Date());
+        const currentToken = await SessionService.createSession(admin, { authenticatedAt: new Date() });
+        const secondDeviceOfAdmin = await SessionService.createSession(admin, { authenticatedAt: new Date() });
+        const otherAdminToken = await SessionService.createSession(otherAdmin, { authenticatedAt: new Date() });
+        const otherOrganizationAdminToken = await SessionService.createSession(otherOrganizationAdmin, { authenticatedAt: new Date() });
+        const memberToken = await SessionService.createSession(member, { authenticatedAt: new Date() });
 
         const response = await signOut(organization, currentToken);
 
@@ -71,9 +72,9 @@ describe('Endpoint.SignOutOrganizationAdmins', () => {
 
         const admin = await createAdmin(organization, PermissionLevel.Write);
         const otherAdmin = await createAdmin(organization);
-        const otherAdminToken = await Token.createToken(otherAdmin, new Date());
+        const otherAdminToken = await SessionService.createSession(otherAdmin, { authenticatedAt: new Date() });
 
-        await expect(signOut(organization, await Token.createToken(admin, new Date()))).rejects.toThrow(STExpect.simpleError({
+        await expect(signOut(organization, await SessionService.createSession(admin, { authenticatedAt: new Date() }))).rejects.toThrow(STExpect.simpleError({
             code: 'permission_denied',
         }));
         expect(await tokenExists(otherAdminToken)).toBe(true);
@@ -89,9 +90,9 @@ describe('Endpoint.SignOutOrganizationAdmins', () => {
         await apiUser.save();
 
         const otherAdmin = await createAdmin(organization);
-        const otherAdminToken = await Token.createToken(otherAdmin, new Date());
+        const otherAdminToken = await SessionService.createSession(otherAdmin, { authenticatedAt: new Date() });
 
-        await expect(signOut(organization, await Token.createApiToken(apiUser))).rejects.toThrow(STExpect.simpleError({
+        await expect(signOut(organization, await SessionService.createApiSession(apiUser))).rejects.toThrow(STExpect.simpleError({
             code: 'permission_denied',
         }));
         expect(await tokenExists(otherAdminToken)).toBe(true);
@@ -100,7 +101,7 @@ describe('Endpoint.SignOutOrganizationAdmins', () => {
     test('an organization without admins is a no-op', async () => {
         const organization = await new OrganizationFactory({}).create();
         const member = await new UserFactory({ organization }).create();
-        const memberToken = await Token.createToken(member, new Date());
+        const memberToken = await SessionService.createSession(member, { authenticatedAt: new Date() });
 
         // Not reachable through the endpoint (the caller is an admin themselves), but the
         // empty list of users may not turn into a query that deletes everything.
@@ -126,10 +127,10 @@ describe('Endpoint.SignOutOrganizationAdmins', () => {
             }).create();
             const member = await new UserFactory({ organization }).create();
 
-            const otherAdminToken = await Token.createToken(otherAdmin, new Date());
-            const memberToken = await Token.createToken(member, new Date());
+            const otherAdminToken = await SessionService.createSession(otherAdmin, { authenticatedAt: new Date() });
+            const memberToken = await SessionService.createSession(member, { authenticatedAt: new Date() });
 
-            const response = await signOut(organization, await Token.createToken(admin, new Date()));
+            const response = await signOut(organization, await SessionService.createSession(admin, { authenticatedAt: new Date() }));
 
             expect(response.body.count).toBe(1);
             expect(await tokenExists(otherAdminToken)).toBe(false);
@@ -149,9 +150,9 @@ describe('Endpoint.SignOutOrganizationAdmins', () => {
                 organizationPermissions: new Map([[organization.id, Permissions.create({ level: PermissionLevel.Full })]]),
             });
             await apiUser.save();
-            const apiToken = await Token.createApiToken(apiUser);
+            const apiToken = await SessionService.createApiSession(apiUser);
 
-            const response = await signOut(organization, await Token.createToken(admin, new Date()));
+            const response = await signOut(organization, await SessionService.createSession(admin, { authenticatedAt: new Date() }));
 
             expect(response.body.count).toBe(0);
             expect(await tokenExists(apiToken)).toBe(true);

package/src/endpoints/organization/dashboard/webshops/GetWebshopOrdersEndpoint.test.ts

@@ -5,12 +5,13 @@ import type { PaginatedResponse, PrivateOrder, StamhoofdFilter } from '@stamhoof
 import { Cart, Customer, LimitedFilteredRequest, OrderData, PermissionLevel, Permissions, RecordDateAnswer, RecordSettings, RecordType } from '@stamhoofd/structures';
 import { testServer } from '../../../../../tests/helpers/TestServer.js';
 import { GetWebshopOrdersEndpoint } from './GetWebshopOrdersEndpoint.js';
+import { SessionService } from '../../../../services/SessionService.js';
 
 describe('Endpoint.GetWebshopOrdersEndpoint', () => {
     const endpoint = new GetWebshopOrdersEndpoint();
 
     const getOrders = async ({ filter, organization, user }: { filter: StamhoofdFilter | null; organization: Organization; user: User }) => {
-        const token = await Token.createToken(user);
+        const token = await SessionService.createSession(user);
 
         const request = Request.get({
             path: '/webshop/orders',

package/src/endpoints/organization/dashboard/webshops/PatchWebshopEndpoint.test.ts

@@ -3,6 +3,7 @@ import { OrganizationFactory, Token, UserFactory, Webshop, WebshopFactory } from
 import { PermissionLevel, Permissions, PrivateWebshop, WebshopMetaData } from '@stamhoofd/structures';
 import { Language } from '@stamhoofd/types/Language';
 import { TestUtils } from '@stamhoofd/test-utils';
+import { SessionService } from '../../../../services/SessionService.js';
 
 import { testServer } from '../../../../../tests/helpers/TestServer.js';
 import { PatchWebshopEndpoint } from './PatchWebshopEndpoint.js';
@@ -22,7 +23,7 @@ describe('Endpoint.PatchWebshop', () => {
                 level: PermissionLevel.Full,
             }),
         }).create();
-        const token = await Token.createToken(user);
+        const token = await SessionService.createSession(user);
 
         return { organization, token };
     }

package/src/endpoints/organization/dashboard/webshops/PatchWebshopOrdersEndpoint.test.ts

@@ -6,6 +6,7 @@ import { Cart, CartItem, Customer, OrderData, PaymentMethod, PermissionLevel, Pe
 import { TestUtils } from '@stamhoofd/test-utils';
 import { Language } from '@stamhoofd/types/Language';
 import { v4 as uuidv4 } from 'uuid';
+import { SessionService } from '../../../../services/SessionService.js';
 
 import { testServer } from '../../../../../tests/helpers/TestServer.js';
 import { PatchWebshopOrdersEndpoint } from './PatchWebshopOrdersEndpoint.js';
@@ -25,7 +26,7 @@ describe('Endpoint.PatchWebshopOrders', () => {
                 level: PermissionLevel.Full,
             }),
         }).create();
-        const token = await Token.createToken(user);
+        const token = await SessionService.createSession(user);
 
         const freeProductPrice = ProductPrice.create({ name: 'Free', price: 0, stock: 100 });
         const product = Product.create({ name: 'Product', stock: 100, prices: [freeProductPrice] });

package/src/endpoints/organization/dashboard/webshops/WebshopReservedPathSegments.test.ts

@@ -2,6 +2,7 @@ import { Request } from '@simonbackx/simple-endpoints';
 import { OrganizationFactory, Token, UserFactory, Webshop, WebshopFactory } from '@stamhoofd/models';
 import { Permissions, PermissionLevel, PrivateWebshop, WebshopMetaData } from '@stamhoofd/structures';
 import { STExpect, TestUtils } from '@stamhoofd/test-utils';
+import { SessionService } from '../../../../services/SessionService.js';
 
 import { testServer } from '../../../../../tests/helpers/TestServer.js';
 import { CreateWebshopEndpoint } from './CreateWebshopEndpoint.js';
@@ -25,7 +26,7 @@ describe('Endpoint.WebshopReservedPathSegments', () => {
                 level: PermissionLevel.Full,
             }),
         }).create();
-        const token = await Token.createToken(user);
+        const token = await SessionService.createSession(user);
 
         return { organization, token };
     }

package/src/endpoints/organization/shared/auth/GetOrganizationEndpoint.test.ts

@@ -1,6 +1,7 @@
 import { Request } from '@simonbackx/simple-endpoints';
 import { OrganizationFactory, Token, UserFactory } from '@stamhoofd/models';
 import { Organization, PermissionLevel, Permissions } from '@stamhoofd/structures';
+import { SessionService } from '../../../../services/SessionService.js';
 
 import { TestUtils } from '@stamhoofd/test-utils';
 import { testServer } from '../../../../../tests/helpers/TestServer.js';
@@ -17,7 +18,7 @@ describe('Endpoint.GetOrganization', () => {
     test('Get organization as signed in user', async () => {
         const organization = await new OrganizationFactory({}).create();
         const user = await new UserFactory({ organization }).create();
-        const token = await Token.createToken(user);
+        const token = await SessionService.createSession(user);
 
         const r = Request.buildJson('GET', '/v3/organization', organization.getApiHost());
         r.headers.authorization = 'Bearer ' + token.accessToken;
@@ -42,7 +43,7 @@ describe('Endpoint.GetOrganization', () => {
             }),
         }).create();
 
-        const token = await Token.createToken(user);
+        const token = await SessionService.createSession(user);
 
         const r = Request.buildJson('GET', '/v3/organization', organization.getApiHost());
         r.headers.authorization = 'Bearer ' + token.accessToken;
@@ -68,7 +69,7 @@ describe('Endpoint.GetOrganization', () => {
             }),
         }).create();
 
-        const token = await Token.createToken(user);
+        const token = await SessionService.createSession(user);
 
         const r = Request.buildJson('GET', '/v3/organization', organization.getApiHost());
         r.headers.authorization = 'Bearer ' + token.accessToken;

package/src/endpoints/organization/webshops/GetWebshopEndpoint.test.ts

@@ -2,6 +2,7 @@ import { Request } from '@simonbackx/simple-endpoints';
 import { OrganizationFactory, Token, UserFactory, WebshopFactory } from '@stamhoofd/models';
 import { PermissionLevel, Permissions, WebshopAuthType, WebshopMetaData } from '@stamhoofd/structures';
 import { Language } from '@stamhoofd/types/Language';
+import { SessionService } from '../../../services/SessionService.js';
 
 import { STExpect, TestUtils } from '@stamhoofd/test-utils';
 import { testServer } from '../../../../tests/helpers/TestServer.js';
@@ -18,7 +19,7 @@ describe('Endpoint.GetWebshop', () => {
     test('Get webshop as signed in user', async () => {
         const organization = await new OrganizationFactory({}).create();
         const user = await new UserFactory({ organization }).create();
-        const token = await Token.createToken(user);
+        const token = await SessionService.createSession(user);
         const webshop = await new WebshopFactory({ organizationId: organization.id }).create();
 
         const r = Request.buildJson('GET', '/v244/webshop/' + webshop.id, organization.getApiHost());
@@ -71,7 +72,7 @@ describe('Endpoint.GetWebshop', () => {
     test('Allow signed in user access for required-auth webshop', async () => {
         const organization = await new OrganizationFactory({}).create();
         const user = await new UserFactory({ organization }).create();
-        const token = await Token.createToken(user);
+        const token = await SessionService.createSession(user);
         const webshop = await new WebshopFactory({
             organizationId: organization.id,
             meta: WebshopMetaData.create({
@@ -94,7 +95,7 @@ describe('Endpoint.GetWebshop', () => {
                 level: PermissionLevel.Read,
             }),
         }).create();
-        const token = await Token.createToken(user);
+        const token = await SessionService.createSession(user);
 
         const webshop = await new WebshopFactory({ organizationId: organization.id }).create();
 
@@ -116,7 +117,7 @@ describe('Endpoint.GetWebshop', () => {
                 level: PermissionLevel.None,
             }),
         }).create();
-        const token = await Token.createToken(user);
+        const token = await SessionService.createSession(user);
 
         const webshop = await new WebshopFactory({ organizationId: organization.id }).create();
 
@@ -140,7 +141,7 @@ describe('Endpoint.GetWebshop', () => {
             }),
         }).create();
 
-        const token = await Token.createToken(user);
+        const token = await SessionService.createSession(user);
         const webshop = await new WebshopFactory({ organizationId: organization.id }).create();
 
         const r = Request.buildJson('GET', '/v244/webshop/' + webshop.id, organization.getApiHost());

package/src/endpoints/organization/webshops/PlaceOrderEndpoint.test.ts

@@ -2,17 +2,19 @@ import type { PatchableArrayAutoEncoder } from '@simonbackx/simple-encoding';
 import { PatchableArray } from '@simonbackx/simple-encoding';
 import type { Response } from '@simonbackx/simple-endpoints';
 import { Request } from '@simonbackx/simple-endpoints';
-import type { Organization, StripeAccount, User } from '@stamhoofd/models';
-import { Order, OrganizationFactory, Payment, Token, UserFactory, Webshop, WebshopFactory } from '@stamhoofd/models';
+import type { Organization, StripeAccount, User, Token } from '@stamhoofd/models';
+import { MolliePayment, Order, OrganizationFactory, Payment, UserFactory, Webshop, WebshopFactory } from '@stamhoofd/models';
 import type { OrderResponse } from '@stamhoofd/structures';
-import { Address, Cart, CartItem, CartItemOption, Customer, Option, OptionMenu, OrderData, PaymentConfiguration, PaymentMethod, PermissionLevel, Permissions, PrivateOrder, PrivatePaymentConfiguration, Product, ProductPrice, ProductType, SeatingPlan, SeatingPlanRow, SeatingPlanSeat, SeatingPlanSection, TransferSettings, WebshopAuthType, WebshopDeliveryMethod, WebshopMetaData, WebshopOnSiteMethod, WebshopPrivateMetaData, WebshopTakeoutMethod, WebshopTimeSlot } from '@stamhoofd/structures';
+import { Address, Cart, CartItem, CartItemOption, Customer, MollieOnboarding, MollieStatus, Option, OptionMenu, OrderData, PaymentConfiguration, PaymentMethod, PaymentProvider, PaymentStatus, PermissionLevel, Permissions, PrivateOrder, PrivatePaymentConfiguration, Product, ProductPrice, ProductType, SeatingPlan, SeatingPlanRow, SeatingPlanSeat, SeatingPlanSection, TransferSettings, WebshopAuthType, WebshopDeliveryMethod, WebshopMetaData, WebshopOnSiteMethod, WebshopPrivateMetaData, WebshopTakeoutMethod, WebshopTimeSlot } from '@stamhoofd/structures';
 import { I18n } from '@stamhoofd/backend-i18n';
 import { STExpect, TestUtils } from '@stamhoofd/test-utils';
 import { Country } from '@stamhoofd/types/Country';
 import { Language } from '@stamhoofd/types/Language';
 import sinon from 'sinon';
 import { v4 as uuidv4 } from 'uuid';
+import { SessionService } from '../../../services/SessionService.js';
 
+import { MollieMocker } from '../../../../tests/helpers/MollieMocker.js';
 import { StripeMocker } from '../../../../tests/helpers/StripeMocker.js';
 import { testServer } from '../../../../tests/helpers/TestServer.js';
 import { PatchWebshopOrdersEndpoint } from '../dashboard/webshops/PatchWebshopOrdersEndpoint.js';
@@ -67,6 +69,7 @@ describe('Endpoint.PlaceOrderEndpoint', () => {
     let radioOption1: Option;
     let radioOption2: Option;
     let stripeMocker: StripeMocker;
+    let mollieMocker: MollieMocker;
     let stripeAccount: StripeAccount;
     let token: Token;
 
@@ -108,6 +111,8 @@ describe('Endpoint.PlaceOrderEndpoint', () => {
     beforeAll(async () => {
         stripeMocker = new StripeMocker();
         stripeMocker.start();
+        mollieMocker = new MollieMocker();
+        mollieMocker.start();
         organization = await new OrganizationFactory({}).create();
         stripeAccount = await stripeMocker.createStripeAccount(organization.id);
 
@@ -117,11 +122,12 @@ describe('Endpoint.PlaceOrderEndpoint', () => {
                 level: PermissionLevel.Full,
             }),
         }).create();
-        token = await Token.createToken(user);
+        token = await SessionService.createSession(user);
     });
 
     afterAll(() => {
         stripeMocker.stop();
+        mollieMocker.stop();
     });
 
     afterEach(() => {
@@ -130,6 +136,7 @@ describe('Endpoint.PlaceOrderEndpoint', () => {
 
     beforeEach(async () => {
         stripeMocker.reset();
+        mollieMocker.reset();
         let meta = WebshopMetaData.patch({});
 
         productPrice1 = ProductPrice.create({
@@ -363,7 +370,7 @@ describe('Endpoint.PlaceOrderEndpoint', () => {
 
         test('Placing an order with a signed in user overrides the order customer', async () => {
             const user = await new UserFactory({ organization, firstName: 'User', lastName: 'Tester' }).create();
-            const token = await Token.createToken(user);
+            const token = await SessionService.createSession(user);
 
             const orderData = OrderData.create({
                 paymentMethod: PaymentMethod.Unknown,
@@ -408,9 +415,9 @@ describe('Endpoint.PlaceOrderEndpoint', () => {
             await webshop.save();
 
             const user = await new UserFactory({ organization, firstName: 'User', lastName: 'Tester' }).create();
-            const token = await Token.createToken(user);
+            const token = await SessionService.createSession(user);
             const otherUser = await new UserFactory({ organization }).create();
-            const otherToken = await Token.createToken(otherUser);
+            const otherToken = await SessionService.createSession(otherUser);
 
             const orderData = OrderData.create({
                 paymentMethod: PaymentMethod.Unknown,
@@ -499,7 +506,7 @@ describe('Endpoint.PlaceOrderEndpoint', () => {
             const pendingResponses: { promise: Promise<Response<OrderResponse>>; user: User }[] = [];
             for (let i = 0; i < 10; i++) {
                 const user = await new UserFactory({ organization, firstName: 'User', lastName: 'Tester' }).create();
-                const token = await Token.createToken(user);
+                const token = await SessionService.createSession(user);
 
                 const r = Request.buildJson('POST', `/webshop/${webshop.id}/order`, organization.getApiHost(), orderData);
                 r.headers.authorization = 'Bearer ' + token.accessToken;
@@ -640,4 +647,83 @@ describe('Endpoint.PlaceOrderEndpoint', () => {
             expect((global as any).$getLanguage()).toEqual(Language.Dutch);
         });
     });
+
+    describe('Mollie payments', () => {
+        beforeEach(async () => {
+            organization.privateMeta.mollieOnboarding = MollieOnboarding.create({
+                canReceivePayments: true,
+                canReceiveSettlements: true,
+                status: MollieStatus.Completed,
+            });
+            await organization.save();
+            await mollieMocker.setupToken(organization);
+
+            // Without a Stripe account on the webshop, Bancontact is routed to Mollie
+            webshop.privateMeta.paymentConfiguration.stripeAccountId = null;
+            await webshop.save();
+        });
+
+        function buildOrderData() {
+            return OrderData.create({
+                paymentMethod: PaymentMethod.Bancontact,
+                checkoutMethod: onSiteMethod,
+                timeSlot: slot4,
+                cart: Cart.create({
+                    items: [
+                        CartItem.create({
+                            product,
+                            productPrice: productPrice1,
+                            amount: 1,
+                        }),
+                    ],
+                }),
+                customer,
+            });
+        }
+
+        test('Placing an order via Mollie returns the checkout url and the order is validated once paid', async () => {
+            const r = Request.buildJson('POST', `/webshop/${webshop.id}/order`, organization.getApiHost(), buildOrderData());
+            const response: Response<OrderResponse> = await testServer.test(endpoint, r);
+
+            expect(response.body.paymentUrl).toEqual('https://molliecheckout/');
+            const orderStruct = response.body.order;
+            expect(orderStruct.payment).not.toBeNull();
+            expect(orderStruct.payment!.provider).toEqual(PaymentProvider.Mollie);
+            expect(orderStruct.payment!.method).toEqual(PaymentMethod.Bancontact);
+
+            // The payment was created at Mollie with the price and the internal payment id
+            const mockPayment = mollieMocker.getLastPayment();
+            expect(mockPayment.amount).toEqual({ currency: 'EUR', value: '0.01' });
+            expect(mockPayment.internalPaymentId).toEqual(orderStruct.payment!.id);
+
+            // The Mollie payment id is linked, so webhooks and crons can find the payment back
+            const molliePayment = await MolliePayment.select().where('paymentId', orderStruct.payment!.id).first(false);
+            expect(molliePayment).not.toBeNull();
+            expect(molliePayment!.mollieId).toEqual(mockPayment.id);
+
+            // Simulate the payment being paid at Mollie (checkout + webhook)
+            await mollieMocker.succeedPayment();
+
+            const payment = (await Payment.getByID(orderStruct.payment!.id))!;
+            expect(payment.status).toEqual(PaymentStatus.Succeeded);
+
+            const orderModel = (await Order.getByID(orderStruct.id))!;
+            expect(orderModel.validAt).not.toBeNull();
+            expect(orderModel.number).not.toBeNull();
+        });
+
+        test('A failed Mollie payment does not validate the order', async () => {
+            const r = Request.buildJson('POST', `/webshop/${webshop.id}/order`, organization.getApiHost(), buildOrderData());
+            const response: Response<OrderResponse> = await testServer.test(endpoint, r);
+            const orderStruct = response.body.order;
+
+            await mollieMocker.failPayment();
+
+            const payment = (await Payment.getByID(orderStruct.payment!.id))!;
+            expect(payment.status).toEqual(PaymentStatus.Failed);
+
+            const orderModel = (await Order.getByID(orderStruct.id))!;
+            expect(orderModel.validAt).toBeNull();
+        });
+    });
 });

package/src/endpoints/organization/webshops/PlaceOrderEndpoint.ts

@@ -1,4 +1,3 @@
-import { PaymentMethod as molliePaymentMethod } from '@mollie/api-client';
 import type { Decoder } from '@simonbackx/simple-encoding';
 import type { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { Endpoint, Response } from '@simonbackx/simple-endpoints';
@@ -307,26 +306,27 @@ export class PlaceOrderEndpoint extends Endpoint<Params, Query, Body, ResponseBo
                             });
                         }
                         const molliePayment = await mollieService.client.payments.create({
-                            amount: {
-                                currency: 'EUR',
-                                value: (totalPrice / 10000).toFixed(2), // from 4 decimals to 0 decimals
+                            paymentRequest: {
+                                amount: {
+                                    currency: 'EUR',
+                                    value: (totalPrice / 10000).toFixed(2), // from 4 decimals to 0 decimals
+                                },
+                                method: MollieService.paymentMethodToMollie(payment.method) ?? 'creditcard',
+                                profileId,
+                                description,
+                                redirectUrl,
+                                webhookUrl: exchangeUrl,
+                                metadata: {
+                                    order: order.id,
+                                    organization: organization.id,
+                                    webshop: webshop.id,
+                                    payment: payment.id,
+                                },
+                                locale: mollieService.locale,
                             },
-                            method: payment.method === PaymentMethod.Bancontact ? molliePaymentMethod.bancontact : (payment.method === PaymentMethod.iDEAL ? molliePaymentMethod.ideal : molliePaymentMethod.creditcard),
-                            testmode: organization.privateMeta.useTestPayments ?? STAMHOOFD.environment !== 'production',
-                            profileId,
-                            description,
-                            redirectUrl,
-                            webhookUrl: exchangeUrl,
-                            metadata: {
-                                order: order.id,
-                                organization: organization.id,
-                                webshop: webshop.id,
-                                payment: payment.id,
-                            },
-                            locale: mollieService.locale,
                         });
                         console.log(molliePayment);
-                        paymentUrl = molliePayment.getCheckoutUrl();
+                        paymentUrl = MollieService.getCheckoutUrl(molliePayment);
 
                         // Save payment
                         const dbPayment = new MolliePayment();

package/src/helpers/Context.ts

@@ -1,13 +1,11 @@
-import { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
+import { Request } from '@simonbackx/simple-endpoints';
 import { isSimpleError, SimpleError } from '@simonbackx/simple-errors';
 import { I18n } from '@stamhoofd/backend-i18n';
 import { MFAToken, Organization, Platform, RateLimiter, Token, User } from '@stamhoofd/models';
-import { AsyncLocalStorage } from 'async_hooks';
-
-import type { Decoder } from '@simonbackx/simple-encoding';
-import { AutoEncoder, field, StringDecoder } from '@simonbackx/simple-encoding';
 import { ApiUserRateLimits } from '@stamhoofd/structures';
+import { SessionService } from '../services/SessionService.js';
 import { AdminPermissionChecker } from './AdminPermissionChecker.js';
+import { contextStorage } from './ContextStorage.js';
 import { TwoFactorHelper } from './TwoFactorHelper.js';
 
 export const apiUserRateLimiter = new RateLimiter({
@@ -62,7 +60,7 @@ export class ContextInstance {
         this.request = request;
     }
 
-    static asyncLocalStorage = new AsyncLocalStorage<ContextInstance>();
+    static asyncLocalStorage = contextStorage;
 
     static get optional(): ContextInstance | null {
         const c = this.asyncLocalStorage.getStore();
@@ -297,6 +295,15 @@ export class ContextInstance {
             });
         }
 
+        if (!await SessionService.activateToken(token)) {
+            throw new SimpleError({
+                code: 'invalid_access_token',
+                message: 'The access token is invalid',
+                human: $t(`%Fi`),
+                statusCode: 401,
+            });
+        }
+
         if (!token.user.hasAccount() && !allowWithoutAccount) {
             if (token?.user) {
                 console.log(