@stamhoofd/backend 2.144.0 → 2.145.0

package/src/helpers/ContextStorage.ts

@@ -0,0 +1,5 @@
+import { AsyncLocalStorage } from 'async_hooks';
+
+import type { ContextInstance } from './Context.js';
+
+export const contextStorage = new AsyncLocalStorage<ContextInstance>();

package/src/helpers/StripeSettlementSync.ts

@@ -512,7 +512,7 @@ export class StripeSettlementSync {
             case 'payment': {
                 const payment = await this.#resolvePayment(transaction);
 
-                if (payment.organizationId !== settlement.organizationId) {
+                if (!payment || payment.organizationId !== settlement.organizationId) {
                     // Destination charge via the platform
                     await this.#storePaidFeesForTransaction(transaction, settlement, { paymentId: null });
                     return;
@@ -692,7 +692,7 @@ export class StripeSettlementSync {
                 continue;
             }
 
-            const charge = await SettlementService.upsertCharge({
+            await SettlementService.upsertCharge({
                 type: getFeeDetailType(detail, transaction),
                 externalId: transaction.id + ':fee:' + index,
                 amount: -detail.amount * 100,
@@ -826,7 +826,7 @@ export class StripeSettlementSync {
         await payment.save();
     }
 
-    async #resolvePayment(transaction: Stripe.BalanceTransaction): Promise<Payment> {
+    async #resolvePayment(transaction: Stripe.BalanceTransaction): Promise<Payment | null> {
         const source = transaction.source;
         if (!source || typeof source === 'string' || source.object !== 'charge') {
             throw new SimpleError({
@@ -848,10 +848,13 @@ export class StripeSettlementSync {
 
         const payment = await Payment.getByID(paymentId);
         if (!payment) {
-            throw new SimpleError({
-                code: 'payment_not_found',
-                message: 'Payment ' + paymentId + ' referenced by charge ' + source.id + ' does not exist',
-            });
+            // Probably deleted
+
+            return null;
+            // throw new SimpleError({
+            //     code: 'payment_not_found',
+            //     message: 'Payment ' + paymentId + ' referenced by charge ' + source.id + ' does not exist',
+            // });
         }
 
         this.#assertPaymentScope(payment, source.id);

package/src/helpers/TwoFactorHelper.ts

@@ -1,13 +1,14 @@
 import { SimpleError } from '@simonbackx/simple-errors';
 import type { I18n } from '@stamhoofd/backend-i18n/I18n';
-import type { User } from '@stamhoofd/models';
-import { MFARecoveryCode, MFATOTP, MFAToken, Organization, Platform, RateLimiter, Token, WebauthnCredential } from '@stamhoofd/models';
+import type { User, Token } from '@stamhoofd/models';
+import { MFARecoveryCode, MFATOTP, MFAToken, Organization, Platform, RateLimiter, WebauthnCredential } from '@stamhoofd/models';
 import type { User as UserStruct } from '@stamhoofd/structures';
-import { MFAChallengeResponse, MFAEnrollmentResult, MFAMethodType, MFASetupResponse, MFAStatus, PasskeyCredential, RecoveryCodes, TOTPCredential, Token as TokenStruct } from '@stamhoofd/structures';
+import { MFAChallengeResponse, MFAEnrollmentResult, MFAMethodType, MFASetupResponse, MFAStatus, PasskeyCredential, RecoveryCodes, SessionLoginMethod, TOTPCredential, Token as TokenStruct } from '@stamhoofd/structures';
 
 import type { PublicKeyCredentialRequestOptionsJSON } from '@simplewebauthn/server';
 
 import { PasswordForgotService } from '../services/PasswordForgotService.js';
+import { SessionService } from '../services/SessionService.js';
 import { RecoveryCodeHelper } from './RecoveryCodeHelper.js';
 import { WebauthnHelper } from './WebauthnHelper.js';
 import { Formatter, Sorter } from '@stamhoofd/utility';
@@ -133,33 +134,33 @@ export class TwoFactorHelper {
      * credential was accepted.
      *
      * `loginMethod` describes the credential that was just verified:
-     *  - 'password': the account password. A single credential that says nothing about
+     *  - Password: the account password. A single credential that says nothing about
      *    whether the user still reads the email address on the account, so a required
      *    second factor must be set up here if the user does not have one yet — and a
      *    long-inactive admin has to confirm their email address before they may.
-     *  - 'email': a password token or email verification code. Also a single credential,
+     *  - Email: a password token or email verification code. Also a single credential,
      *    but one that only reaches someone who reads the account's email, so it is the way
      *    out of that email confirmation.
-     *  - 'sso': an external identity provider already authenticated the user, and is
+     *  - SSO: an external identity provider already authenticated the user, and is
      *    trusted to apply its own second factor. An enrolled factor is still verified
      *    (the user asked us to protect their account), but we do not force enrollment —
      *    unless the account ALSO has a password, because then the password remains a way
      *    in that bypasses whatever the provider enforces.
      */
-    static async getSecondFactorRequirement(user: User, organization: Organization | null, { loginMethod }: { loginMethod: 'password' | 'email' | 'sso' }): Promise<SecondFactorRequirement> {
+    static async getSecondFactorRequirement(user: User, organization: Organization | null, { loginMethod }: { loginMethod: SessionLoginMethod }): Promise<SecondFactorRequirement> {
         if (await TwoFactorHelper.userHasFactors(user.id)) {
-            return { type: 'challenge', challenge: await TwoFactorHelper.createLoginChallenge(user) };
+            return { type: 'challenge', challenge: await TwoFactorHelper.createLoginChallenge(user, { loginMethod }) };
         }
 
-        if (loginMethod === 'sso' && !user.hasPasswordBasedAccount()) {
+        if (loginMethod === SessionLoginMethod.SSO && !user.hasPasswordBasedAccount()) {
             return { type: 'none' };
         }
 
         if (await TwoFactorHelper.isTwoFactorRequired(user, organization)) {
-            if (loginMethod === 'password' && TwoFactorHelper.isInactiveForEnrollment(user)) {
+            if (loginMethod === SessionLoginMethod.Password && TwoFactorHelper.isInactiveForEnrollment(user)) {
                 return { type: 'confirm-email' };
             }
-            return { type: 'setup', setupToken: await MFAToken.createFor(user.id, 'setup') };
+            return { type: 'setup', setupToken: await MFAToken.createFor(user.id, 'setup', { loginMethod }) };
         }
 
         return { type: 'none' };
@@ -173,16 +174,14 @@ export class TwoFactorHelper {
     static async sendEnrollmentConfirmationEmail(user: User, organization: Organization | null, i18n: I18n): Promise<void> {
         try {
             enrollmentConfirmationRateLimiter.track(user.id);
-        }
-        catch {
+        } catch {
             // Sent often enough already.
             return;
         }
 
         try {
             await PasswordForgotService.sendPasswordRecoveryEmail(user, organization, i18n);
-        }
-        catch (e) {
+        } catch (e) {
             console.error('Could not send the two-factor enrollment confirmation email', e);
         }
     }
@@ -203,7 +202,7 @@ export class TwoFactorHelper {
      * whoever holds the link could enroll one and get a session anyway, and the client
      * needs a session to let the user choose a password before enrolling.
      */
-    static async assertSecondFactorOrThrow(user: User, organization: Organization | null, version: number, { loginMethod, i18n, allowTemporarySession = false }: { loginMethod: 'password' | 'email'; i18n: I18n; allowTemporarySession?: boolean }): Promise<void> {
+    static async assertSecondFactorOrThrow(user: User, organization: Organization | null, version: number, { loginMethod, i18n, allowTemporarySession = false }: { loginMethod: SessionLoginMethod.Password | SessionLoginMethod.Email; i18n: I18n; allowTemporarySession?: boolean }): Promise<void> {
         const requirement = await TwoFactorHelper.getSecondFactorRequirement(user, organization, { loginMethod });
 
         if (requirement.type === 'confirm-email') {
@@ -228,7 +227,7 @@ export class TwoFactorHelper {
         }
 
         if (requirement.type === 'setup') {
-            const temporaryToken = allowTemporarySession ? new TokenStruct(await Token.createToken(user, new Date())) : null;
+            const temporaryToken = allowTemporarySession ? new TokenStruct(await SessionService.createSession(user, { loginMethod, authenticatedAt: new Date() })) : null;
 
             throw new SimpleError({
                 code: 'require_mfa_setup',
@@ -313,7 +312,7 @@ export class TwoFactorHelper {
     /**
      * Create a login MFA session token and the challenge payload returned to the client.
      */
-    static async createLoginChallenge(user: User): Promise<MFAChallengeResponse> {
+    static async createLoginChallenge(user: User, { loginMethod }: { loginMethod: SessionLoginMethod }): Promise<MFAChallengeResponse> {
         const { methods, passkeys } = await TwoFactorHelper.getEnrolledMethods(user.id);
 
         let webauthnOptions: PublicKeyCredentialRequestOptionsJSON | null = null;
@@ -323,7 +322,7 @@ export class TwoFactorHelper {
             challenge = webauthnOptions.challenge;
         }
 
-        const mfaToken = await MFAToken.createFor(user.id, 'login', challenge);
+        const mfaToken = await MFAToken.createFor(user.id, 'login', { webauthnChallenge: challenge, loginMethod });
 
         return MFAChallengeResponse.create({
             token: mfaToken.token,
@@ -376,12 +375,12 @@ export class TwoFactorHelper {
         }
 
         // Before minting the new session, so it is never signed out by its own enrollment.
-        await Token.deleteOtherSessions(user.id, currentToken?.accessToken ?? null);
+        await SessionService.deleteOtherSessions({ userId: user.id, keepAccessToken: currentToken?.accessToken ?? null });
 
         let token: TokenStruct | null = null;
         if (setupToken) {
             await setupToken.consume();
-            const t = await Token.createToken(user, new Date());
+            const t = await SessionService.createSession(user, { loginMethod: setupToken.loginMethod, authenticatedAt: new Date() });
             await user.markActive();
             token = new TokenStruct(t);
         }
@@ -403,7 +402,7 @@ export class TwoFactorHelper {
             await MFARecoveryCode.deleteForUser(user.id);
         }
 
-        await Token.deleteOtherSessions(user.id, currentToken?.accessToken ?? null);
+        await SessionService.deleteOtherSessions({ userId: user.id, keepAccessToken: currentToken?.accessToken ?? null });
 
         return await TwoFactorHelper.buildStatus(user);
     }

package/src/services/AdminSessionService.ts

@@ -1,4 +1,6 @@
-import { Token, User } from '@stamhoofd/models';
+import { User } from '@stamhoofd/models';
+
+import { SessionService } from './SessionService.js';
 
 /**
  * Signs out administrators in bulk.
@@ -25,7 +27,7 @@ export class AdminSessionService {
      */
     static async signOutOrganizationAdmins(organizationId: string, keepAccessToken: string | null): Promise<number> {
         const admins = await User.getAdmins(organizationId);
-        return await Token.deleteForUsers(admins.map(a => a.id), keepAccessToken);
+        return await SessionService.deleteForUsers({ userIds: admins.map(a => a.id), keepAccessToken });
     }
 
     /**
@@ -36,6 +38,6 @@ export class AdminSessionService {
      */
     static async signOutPlatformAdmins(keepAccessToken: string | null): Promise<number> {
         const admins = await User.getPlatformAdmins();
-        return await Token.deleteForUsers(admins.map(a => a.id), keepAccessToken);
+        return await SessionService.deleteForUsers({ userIds: admins.map(a => a.id), keepAccessToken });
     }
 }

package/src/services/InvoiceService.ts

@@ -6,7 +6,7 @@ import { InvoiceCounter } from '@stamhoofd/models/helpers/InvoiceCounter.js';
 import type { Invoice as InvoiceStruct } from '@stamhoofd/structures';
 import { EmailTemplateType, PaymentStatus, Recipient, Replacement } from '@stamhoofd/structures';
 import { Formatter } from '@stamhoofd/utility';
-import { ViesHelper } from '../helpers/ViesHelper.js';
+import { ViesService } from '@stamhoofd/vies';
 import { WebmasterReport } from '../helpers/WebmasterReport.js';
 import { ApplicationFeeService } from './ApplicationFeeService.js';
 import { BalanceItemService } from './BalanceItemService.js';
@@ -35,7 +35,7 @@ export class InvoiceService {
         model.customer = struct.customer;
 
         if (model.customer.company) {
-            await ViesHelper.checkCompany(model.customer.company, model.customer.company);
+            await ViesService.checkCompany(model.customer.company, null, { forceValidation: true });
         }
 
         struct.updatePrices();