@stamhoofd/backend 2.70.0 → 2.71.0

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@stamhoofd/backend",
-    "version": "2.70.0",
+    "version": "2.71.0",
     "main": "./dist/index.js",
     "exports": {
         ".": {
@@ -37,14 +37,14 @@
         "@simonbackx/simple-encoding": "2.19.0",
         "@simonbackx/simple-endpoints": "1.15.0",
         "@simonbackx/simple-logging": "^1.0.1",
-        "@stamhoofd/backend-i18n": "2.70.0",
-        "@stamhoofd/backend-middleware": "2.70.0",
-        "@stamhoofd/email": "2.70.0",
-        "@stamhoofd/models": "2.70.0",
-        "@stamhoofd/queues": "2.70.0",
-        "@stamhoofd/sql": "2.70.0",
-        "@stamhoofd/structures": "2.70.0",
-        "@stamhoofd/utility": "2.70.0",
+        "@stamhoofd/backend-i18n": "2.71.0",
+        "@stamhoofd/backend-middleware": "2.71.0",
+        "@stamhoofd/email": "2.71.0",
+        "@stamhoofd/models": "2.71.0",
+        "@stamhoofd/queues": "2.71.0",
+        "@stamhoofd/sql": "2.71.0",
+        "@stamhoofd/structures": "2.71.0",
+        "@stamhoofd/utility": "2.71.0",
         "archiver": "^7.0.1",
         "aws-sdk": "^2.885.0",
         "axios": "1.6.8",
@@ -64,5 +64,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "5c6f4bbab24bf118b45da350bdaf3c62756909ad"
+    "gitHead": "8b35d36e694303905aa27cf9bff5539777d6ace1"
 }

package/src/endpoints/auth/OpenIDConnectCallbackEndpoint.ts

@@ -1,11 +1,8 @@
 import { AnyDecoder, Decoder } from '@simonbackx/simple-encoding';
 import { DecodedRequest, Endpoint, Request } from '@simonbackx/simple-endpoints';
-import { SimpleError } from '@simonbackx/simple-errors';
 
 import { Context } from '../../helpers/Context';
-import { OpenIDConnectHelper } from '../../helpers/OpenIDConnectHelper';
-import { OpenIDClientConfiguration } from '@stamhoofd/structures';
-import { Platform } from '@stamhoofd/models';
+import { SSOServiceWithSession } from '../../services/SSOService';
 
 type Params = Record<string, never>;
 type Query = undefined;
@@ -29,26 +26,8 @@ export class OpenIDConnectCallbackEndpoint extends Endpoint<Params, Query, Body,
     }
 
     async handle(request: DecodedRequest<Params, Query, Body>) {
-        const organization = await Context.setOptionalOrganizationScope();
-        let configuration: OpenIDClientConfiguration | null;
-        const platform = await Platform.getShared();
-
-        if (organization) {
-            configuration = organization.serverMeta.ssoConfiguration;
-        }
-        else {
-            configuration = platform.serverConfig.ssoConfiguration;
-        }
-
-        if (!configuration) {
-            throw new SimpleError({
-                code: 'invalid_client',
-                message: 'SSO not configured',
-                statusCode: 400,
-            });
-        }
-
-        const helper = new OpenIDConnectHelper(organization, configuration);
-        return await helper.callback(request);
+        await Context.setUserOrganizationScope();
+        const ssoService = await SSOServiceWithSession.fromSession(request);
+        return await ssoService.callback();
     }
 }

package/src/endpoints/auth/OpenIDConnectStartEndpoint.ts

@@ -1,11 +1,9 @@
 import { Decoder } from '@simonbackx/simple-encoding';
 import { DecodedRequest, Endpoint, Request } from '@simonbackx/simple-endpoints';
-import { SimpleError } from '@simonbackx/simple-errors';
-import { Platform, Webshop } from '@stamhoofd/models';
-import { OpenIDClientConfiguration, StartOpenIDFlowStruct } from '@stamhoofd/structures';
+import { StartOpenIDFlowStruct } from '@stamhoofd/structures';
 
 import { Context } from '../../helpers/Context';
-import { OpenIDConnectHelper } from '../../helpers/OpenIDConnectHelper';
+import { SSOService } from '../../services/SSOService';
 
 type Params = Record<string, never>;
 type Query = undefined;
@@ -30,78 +28,14 @@ export class OpenIDConnectStartEndpoint extends Endpoint<Params, Query, Body, Re
 
     async handle(request: DecodedRequest<Params, Query, Body>) {
         // Check webshop and/or organization
-        const organization = await Context.setOptionalOrganizationScope();
-        const webshopId = request.body.webshopId;
-        const platform = await Platform.getShared();
+        await Context.setUserOrganizationScope();
+        await Context.optionalAuthenticate({ allowWithoutAccount: false });
+        console.log('Full start connect body;', await request.request.body);
 
-        // Host should match correctly
-        let redirectUri = 'https://' + STAMHOOFD.domains.dashboard;
-
-        if (organization) {
-            redirectUri = 'https://' + organization.getHost();
-        }
-
-        // todo: also support the app as redirect uri using app schemes (could be required for mobile apps)
-
-        if (webshopId) {
-            if (!organization) {
-                throw new SimpleError({
-                    code: 'invalid_organization',
-                    message: 'Organization required when specifying webshopId',
-                    statusCode: 400,
-                });
-            }
-
-            const webshop = await Webshop.getByID(webshopId);
-            if (!webshop || webshop.organizationId !== organization.id) {
-                throw new SimpleError({
-                    code: 'invalid_webshop',
-                    message: 'Invalid webshop',
-                    statusCode: 400,
-                });
-            }
-            redirectUri = 'https://' + webshop.setRelation(Webshop.organization, organization).getHost();
-        }
-
-        if (request.body.redirectUri) {
-            try {
-                const allowedHost = new URL(redirectUri);
-                const givenUrl = new URL(request.body.redirectUri);
-
-                if (allowedHost.host === givenUrl.host && givenUrl.protocol === 'https:') {
-                    redirectUri = givenUrl.href;
-                }
-            }
-            catch (e) {
-                console.error('Invalid redirect uri', request.body.redirectUri);
-            }
-        }
-
-        if (request.body.spaState.length < 10) {
-            throw new SimpleError({
-                code: 'invalid_state',
-                message: 'Invalid state',
-                statusCode: 400,
-            });
-        }
-
-        let configuration: OpenIDClientConfiguration | null;
-
-        if (organization) {
-            configuration = organization.serverMeta.ssoConfiguration;
-        }
-        else {
-            configuration = platform.serverConfig.ssoConfiguration;
-        }
-
-        if (!configuration) {
-            throw new SimpleError({
-                code: 'invalid_client',
-                message: 'SSO not configured',
-                statusCode: 400,
-            });
+        if (Context.user) {
+            console.log('User:', Context.user);
         }
-        const helper = new OpenIDConnectHelper(organization, configuration);
-        return await helper.startAuthCodeFlow(redirectUri, request.body.provider, request.body.spaState, request.body.prompt);
+        const service = await SSOService.fromContext(request.body.provider);
+        return await service.validateAndStartAuthCodeFlow(request.body);
     }
 }

package/src/endpoints/auth/PatchUserEndpoint.ts

@@ -1,4 +1,4 @@
-import { AutoEncoderPatchType, Decoder } from '@simonbackx/simple-encoding';
+import { AutoEncoderPatchType, Decoder, isPatch } from '@simonbackx/simple-encoding';
 import { DecodedRequest, Endpoint, Request, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { EmailVerificationCode, Member, PasswordToken, Token, User } from '@stamhoofd/models';
@@ -109,6 +109,31 @@ export class PatchUserEndpoint extends Endpoint<Params, Query, Body, ResponseBod
             }
         }
 
+        if (request.body.meta) {
+            if (request.body.meta.loginProviderIds && isPatch(request.body.meta.loginProviderIds)) {
+                // Delete deleted login providers
+                for (const [key, value] of request.body.meta.loginProviderIds) {
+                    if (value !== null) {
+                        // Not allowed
+                        throw Context.auth.error('You are not allowed to change the login provider ids');
+                    }
+
+                    if (editUser.meta?.loginProviderIds.has(key)) {
+                        // Check has remaining method
+                        if (editUser.meta.loginProviderIds.size <= 1 && !editUser.hasPasswordBasedAccount()) {
+                            throw new SimpleError({
+                                code: 'invalid_request',
+                                message: 'You cannot remove the last login provider',
+                                human: 'Stel eerst een wachtwoord in voor jouw account voor je deze loginmethode uitschakelt.',
+                                statusCode: 400,
+                            });
+                        }
+                        editUser.meta.loginProviderIds.delete(key);
+                    }
+                }
+            }
+        }
+
         if (editUser.id === user.id && request.body.password) {
             // password changes
             await editUser.changePassword(request.body.password);
@@ -116,6 +141,23 @@ export class PatchUserEndpoint extends Endpoint<Params, Query, Body, ResponseBod
             await Token.clearFor(editUser.id, token.accessToken);
         }
 
+        if (request.body.hasPassword === false) {
+            if (editUser.hasPasswordBasedAccount()) {
+                // Check other login methods available
+                if (!editUser.meta?.loginProviderIds?.size) {
+                    throw new SimpleError({
+                        code: 'invalid_request',
+                        message: 'You cannot remove the last login provider',
+                        human: 'Je kan jouw wachtwoord niet verwijderen als je geen andere loginmethode hebt.',
+                        statusCode: 400,
+                    });
+                }
+                editUser.password = null;
+                await PasswordToken.clearFor(editUser.id);
+                await Token.clearFor(editUser.id, token.accessToken);
+            }
+        }
+
         await editUser.save();
 
         if (await Context.auth.canEditUserEmail(editUser)) {

package/src/endpoints/global/sso/GetSSOEndpoint.ts

@@ -1,11 +1,17 @@
 import { DecodedRequest, Endpoint, Request, Response } from '@simonbackx/simple-endpoints';
-import { OpenIDClientConfiguration } from '@stamhoofd/structures';
+import { LoginProviderType, OpenIDClientConfiguration } from '@stamhoofd/structures';
 
 import { Context } from '../../../helpers/Context';
 import { Platform } from '@stamhoofd/models';
+import { AutoEncoder, Decoder, EnumDecoder, field } from '@simonbackx/simple-encoding';
+import { SSOService } from '../../../services/SSOService';
 
 type Params = Record<string, never>;
-type Query = undefined;
+export class SSOQuery extends AutoEncoder {
+    @field({ decoder: new EnumDecoder(LoginProviderType) })
+    provider: LoginProviderType;
+}
+type Query = SSOQuery;
 type Body = undefined;
 type ResponseBody = OpenIDClientConfiguration;
 
@@ -14,6 +20,8 @@ type ResponseBody = OpenIDClientConfiguration;
  */
 
 export class GetOrganizationSSOEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
+    queryDecoder = SSOQuery as Decoder<Query>;
+
     protected doesMatch(request: Request): [true, Params] | [false] {
         if (request.method !== 'GET') {
             return [false];
@@ -27,19 +35,15 @@ export class GetOrganizationSSOEndpoint extends Endpoint<Params, Query, Body, Re
         return [false];
     }
 
-    async handle(_: DecodedRequest<Params, Query, Body>) {
+    async handle(request: DecodedRequest<Params, Query, Body>) {
         const organization = await Context.setOptionalOrganizationScope();
         await Context.authenticate();
+        const service = await SSOService.fromContext(request.query.provider);
 
         if (!await Context.auth.canManageSSOSettings(organization?.id ?? null)) {
             throw Context.auth.error();
         }
 
-        if (organization) {
-            return new Response(organization.serverMeta.ssoConfiguration ?? OpenIDClientConfiguration.create({}));
-        }
-
-        const platform = await Platform.getShared();
-        return new Response(platform.serverConfig.ssoConfiguration ?? OpenIDClientConfiguration.create({}));
+        return new Response(service.configuration);
     }
 }

package/src/endpoints/global/sso/SetSSOEndpoint.ts

@@ -3,11 +3,11 @@ import { DecodedRequest, Endpoint, Request, Response } from '@simonbackx/simple-
 import { OpenIDClientConfiguration } from '@stamhoofd/structures';
 
 import { Context } from '../../../helpers/Context';
-import { OpenIDConnectHelper } from '../../../helpers/OpenIDConnectHelper';
-import { Platform } from '@stamhoofd/models';
+import { SSOService } from '../../../services/SSOService';
+import { SSOQuery } from './GetSSOEndpoint';
 
 type Params = Record<string, never>;
-type Query = undefined;
+type Query = SSOQuery;
 type Body = AutoEncoderPatchType<OpenIDClientConfiguration>;
 type ResponseBody = OpenIDClientConfiguration;
 
@@ -17,6 +17,7 @@ type ResponseBody = OpenIDClientConfiguration;
 
 export class SetOrganizationSSOEndpoint extends Endpoint<Params, Query, Body, ResponseBody> {
     bodyDecoder = OpenIDClientConfiguration.patchType() as Decoder<AutoEncoderPatchType<OpenIDClientConfiguration>>;
+    queryDecoder = SSOQuery as Decoder<Query>;
 
     protected doesMatch(request: Request): [true, Params] | [false] {
         if (request.method !== 'POST') {
@@ -34,34 +35,14 @@ export class SetOrganizationSSOEndpoint extends Endpoint<Params, Query, Body, Re
     async handle(request: DecodedRequest<Params, Query, Body>) {
         const organization = await Context.setOptionalOrganizationScope();
         await Context.authenticate();
+        const service = await SSOService.fromContext(request.query.provider);
 
         if (!await Context.auth.canManageSSOSettings(organization?.id ?? null)) {
             throw Context.auth.error();
         }
 
-        let newConfig: OpenIDClientConfiguration;
-
-        if (organization) {
-            newConfig = (organization.serverMeta.ssoConfiguration ?? OpenIDClientConfiguration.create({})).patch(request.body);
-
-            // Validate configuration
-            const helper = new OpenIDConnectHelper(organization, newConfig);
-            await helper.getClient();
-
-            organization.serverMeta.ssoConfiguration = newConfig;
-            await organization.save();
-        }
-        else {
-            const platform = await Platform.getShared();
-            newConfig = (platform.serverConfig.ssoConfiguration ?? OpenIDClientConfiguration.create({})).patch(request.body);
-
-            // Validate configuration
-            const helper = new OpenIDConnectHelper(null, newConfig);
-            await helper.getClient();
-
-            platform.serverConfig.ssoConfiguration = newConfig;
-            await platform.save();
-        }
+        const newConfig: OpenIDClientConfiguration = service.configuration.patch(request.body);
+        await service.setConfiguration(newConfig);
 
         return new Response(newConfig);
     }

package/src/helpers/AuthenticatedStructures.ts

@@ -287,6 +287,7 @@ export class AuthenticatedStructures {
         return UserWithMembers.create({
             ...user,
             hasAccount: user.hasAccount(),
+            hasPassword: user.hasPasswordBasedAccount(),
 
             // Always include the current context organization - because it is possible we switch organization and we don't want to refetch every time
             members: await this.membersBlob(members, true, user),
@@ -306,6 +307,7 @@ export class AuthenticatedStructures {
             structs.push(UserWithMembers.create({
                 ...user,
                 hasAccount: user.hasAccount(),
+                hasPassword: user.hasPasswordBasedAccount(),
                 members: await this.membersBlob(filteredMembers, false),
             }));
         }

package/src/helpers/Context.ts

@@ -1,10 +1,11 @@
-import { Request } from '@simonbackx/simple-endpoints';
+import { DecodedRequest, Request } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
 import { I18n } from '@stamhoofd/backend-i18n';
 import { Organization, Platform, RateLimiter, Token, User } from '@stamhoofd/models';
 import { AsyncLocalStorage } from 'async_hooks';
 
 import { AdminPermissionChecker } from './AdminPermissionChecker';
+import { AutoEncoder, field, Decoder, StringDecoder } from '@simonbackx/simple-encoding';
 
 export const apiUserRateLimiter = new RateLimiter({
     limits: [
@@ -31,6 +32,11 @@ export const apiUserRateLimiter = new RateLimiter({
     ],
 });
 
+export class AuthorizationPostBody extends AutoEncoder {
+    @field({ decoder: StringDecoder })
+    header_authorization: string;
+}
+
 export class ContextInstance {
     request: Request;
 
@@ -150,15 +156,27 @@ export class ContextInstance {
     }
 
     async optionalAuthenticate({ allowWithoutAccount = false }: { allowWithoutAccount?: boolean } = {}): Promise<{ user?: User }> {
-        const header = this.request.headers.authorization;
-        if (!header) {
+        try {
+            return await this.authenticate({ allowWithoutAccount });
+        }
+        catch (e) {
             return {};
         }
-        return this.authenticate({ allowWithoutAccount });
     }
 
     async authenticate({ allowWithoutAccount = false }: { allowWithoutAccount?: boolean } = {}): Promise<{ user: User; token: Token }> {
-        const header = this.request.headers.authorization;
+        let header = this.request.headers.authorization;
+
+        if (!header && this.request.method === 'POST') {
+            try {
+                const decoded = await DecodedRequest.fromRequest(this.request, undefined, undefined, AuthorizationPostBody as Decoder<AuthorizationPostBody>);
+                header = decoded.body.header_authorization;
+            }
+            catch (e) {
+                // Ignore: failed to read from body
+            }
+        }
+
         if (!header) {
             throw new SimpleError({
                 code: 'not_authenticated',

package/src/helpers/CookieHelper.ts

@@ -1,10 +1,15 @@
-import { DecodedRequest, Response } from '@simonbackx/simple-endpoints';
+import { Response } from '@simonbackx/simple-endpoints';
 import cookie from 'cookie';
+import http from 'http';
 
-type DecodedRequestWithCookies = DecodedRequest<any, any, any> & { cookies?: Record<string, string> };
+export type ObjectWithHeaders = {
+    headers: http.IncomingHttpHeaders;
+};
+
+type DecodedRequestWithCookies = ObjectWithHeaders & { cookies?: Record<string, string> };
 
 export class CookieHelper {
-    static getCookies(request: DecodedRequest<any, any, any>): Record<string, string> {
+    static getCookies(request: ObjectWithHeaders): Record<string, string> {
         const r = request as DecodedRequestWithCookies;
         if (r.cookies) {
             return r.cookies;
@@ -21,7 +26,7 @@ export class CookieHelper {
         return r.cookies;
     }
 
-    static getCookie(request: DecodedRequest<any, any, any>, name: string): string | undefined {
+    static getCookie(request: ObjectWithHeaders, name: string): string | undefined {
         const cookies = this.getCookies(request);
         return cookies[name];
     }

package/src/services/SSOService.ts

@@ -0,0 +1,505 @@
+import { DecodedRequest, Response } from '@simonbackx/simple-endpoints';
+import { isSimpleError, isSimpleErrors, SimpleError } from '@simonbackx/simple-errors';
+import { Organization, Platform, Token, User, Webshop } from '@stamhoofd/models';
+import { LoginProviderType, OpenIDClientConfiguration, StartOpenIDFlowStruct, Token as TokenStruct } from '@stamhoofd/structures';
+import crypto from 'crypto';
+import { generators, Issuer } from 'openid-client';
+import { Context } from '../helpers/Context';
+
+import { CookieHelper, ObjectWithHeaders } from '../helpers/CookieHelper';
+
+async function randomBytes(size: number): Promise<Buffer> {
+    return new Promise((resolve, reject) => {
+        crypto.randomBytes(size, (err: Error | null, buf: Buffer) => {
+            if (err) {
+                reject(err);
+                return;
+            }
+            resolve(buf);
+        });
+    });
+}
+
+type SSOSessionContext = {
+    expires: Date;
+    code_verifier: string;
+    state: string;
+    nonce: string;
+    redirectUri: string;
+    spaState: string;
+    providerType: LoginProviderType;
+
+    /**
+     * Link this method to this existing user and don't create a new token
+     */
+    userId?: string | null;
+};
+
+export class SSOService {
+    provider: LoginProviderType;
+    platform: Platform;
+    organization: Organization | null;
+    user: User | null = null;
+
+    static sessionStorage = new Map<string, SSOSessionContext>();
+
+    constructor(data: { provider: LoginProviderType; platform: Platform; organization?: Organization | null; user?: User | null }) {
+        this.provider = data.provider;
+        this.platform = data.platform;
+        this.organization = data.organization ?? null;
+        this.user = data.user ?? null;
+    }
+
+    /**
+     * This is the redirectUri we'll use towards the provider - but we store a different internal redirectUri in the session to allow more flexibility
+     * with the multiple domains we can redirect to.
+     */
+    get externalRedirectUri() {
+        if (this.configuration.redirectUri) {
+            return this.configuration.redirectUri;
+        }
+        // todo: we might need a special url for the app here
+
+        if (!this.organization) {
+            return 'https://' + STAMHOOFD.domains.api + '/openid/callback';
+        }
+        return 'https://' + this.organization.id + '.' + STAMHOOFD.domains.api + '/openid/callback';
+    }
+
+    get defaultRedirectUri() {
+        // Host should match correctly
+        let redirectUri = 'https://' + STAMHOOFD.domains.dashboard;
+
+        if (this.organization) {
+            redirectUri = 'https://' + this.organization.getHost();
+        }
+        return redirectUri;
+    }
+
+    static async fromContext(provider: LoginProviderType) {
+        const organization = Context.organization;
+        const platform = await Platform.getShared();
+
+        const service = new SSOService({ provider, platform, organization, user: Context.user });
+        // Validate configuration
+        const _ = service.configuration;
+        return service;
+    }
+
+    get configuration() {
+        let configuration: OpenIDClientConfiguration | null = null;
+
+        if (this.provider === LoginProviderType.SSO) {
+            if (this.organization) {
+                configuration = this.organization.serverMeta.ssoConfiguration ?? OpenIDClientConfiguration.create({});
+            }
+            else {
+                configuration = this.platform.serverConfig.ssoConfiguration ?? OpenIDClientConfiguration.create({});
+            }
+        }
+        else if (this.provider === LoginProviderType.Google) {
+            if (this.organization) {
+                // Not supported yet
+                configuration = null;
+            }
+            else {
+                configuration = this.platform.serverConfig.googleConfiguration ?? OpenIDClientConfiguration.create({});
+            }
+        }
+
+        if (!configuration) {
+            throw new SimpleError({
+                code: 'invalid_client',
+                message: 'SSO not configured',
+                statusCode: 400,
+            });
+        }
+        return configuration;
+    }
+
+    async setConfiguration(configuration: OpenIDClientConfiguration) {
+        if (this.provider === LoginProviderType.SSO) {
+            if (this.organization) {
+                this.organization.serverMeta.ssoConfiguration = configuration;
+                await this.getClient();
+                await this.organization.save();
+                return;
+            }
+            else {
+                this.platform.serverConfig.ssoConfiguration = configuration;
+                await this.getClient();
+                await this.platform.save();
+                return;
+            }
+        }
+        else if (this.provider === LoginProviderType.Google) {
+            if (!this.organization) {
+                this.platform.serverConfig.googleConfiguration = configuration;
+                await this.getClient();
+                await this.platform.save();
+                return;
+            }
+        }
+
+        throw new SimpleError({
+            code: 'invalid_client',
+            message: 'SSO not supported here',
+            statusCode: 400,
+        });
+    }
+
+    async getClient() {
+        const issuer = await Issuer.discover(this.configuration.issuer);
+        const client = new issuer.Client({
+            client_id: this.configuration.clientId,
+            client_secret: this.configuration.clientSecret,
+            redirect_uris: [this.externalRedirectUri],
+            response_types: ['code'],
+        });
+
+        // Todo: in the future we can add a cache here
+
+        return client;
+    }
+
+    static async storeSession(response: Response<any>, data: SSOSessionContext) {
+        const sessionId = (await randomBytes(192)).toString('base64');
+
+        // Delete expired sessions
+        for (const [key, value] of this.sessionStorage) {
+            if (value.expires < new Date()) {
+                this.sessionStorage.delete(key);
+            }
+        }
+
+        this.sessionStorage.set(sessionId, data);
+
+        // Store
+        CookieHelper.setCookie(response, 'oid_session_id', sessionId, {
+            httpOnly: true,
+            secure: STAMHOOFD.environment !== 'development',
+            expires: data.expires,
+        });
+    }
+
+    static getSession(request: ObjectWithHeaders): SSOSessionContext | null {
+        const sessionId = CookieHelper.getCookie(request, 'oid_session_id');
+        if (!sessionId) {
+            return null;
+        }
+
+        const session = this.sessionStorage.get(sessionId);
+        if (!session) {
+            return null;
+        }
+
+        if (session.expires < new Date()) {
+            return null;
+        }
+
+        return session;
+    }
+
+    async validateAndStartAuthCodeFlow(data: StartOpenIDFlowStruct) {
+        // Host should match correctly
+        let redirectUri = this.defaultRedirectUri;
+
+        // todo: also support the app as redirect uri using app schemes (could be required for mobile apps)
+        const webshopId = data.webshopId;
+
+        if (webshopId) {
+            if (!this.organization) {
+                throw new SimpleError({
+                    code: 'invalid_organization',
+                    message: 'Organization required when specifying webshopId',
+                    statusCode: 400,
+                });
+            }
+
+            const webshop = await Webshop.getByID(webshopId);
+            if (!webshop || webshop.organizationId !== this.organization.id) {
+                throw new SimpleError({
+                    code: 'invalid_webshop',
+                    message: 'Invalid webshop',
+                    statusCode: 400,
+                });
+            }
+            redirectUri = 'https://' + webshop.setRelation(Webshop.organization, this.organization).getHost();
+        }
+
+        if (data.redirectUri) {
+            try {
+                const allowedHost = new URL(redirectUri);
+                const givenUrl = new URL(data.redirectUri);
+
+                if (allowedHost.host === givenUrl.host && givenUrl.protocol === 'https:') {
+                    redirectUri = givenUrl.href;
+                }
+                else {
+                    throw new SimpleError({
+                        code: 'redirect_uri_not_allowed',
+                        message: 'Redirect uri not allowed',
+                        field: 'redirectUri',
+                        statusCode: 400,
+                    });
+                }
+            }
+            catch (e) {
+                throw new SimpleError({
+                    code: 'invalid_redirect_uri',
+                    message: 'Invalid redirect uri',
+                    field: 'redirectUri',
+                    statusCode: 400,
+                });
+            }
+        }
+
+        if (data.spaState.length < 10) {
+            throw new SimpleError({
+                code: 'invalid_state',
+                message: 'Invalid state',
+                statusCode: 400,
+            });
+        }
+
+        return await this.startAuthCodeFlow(redirectUri, data.spaState, data.prompt);
+    }
+
+    async startAuthCodeFlow(redirectUri: string, spaState: string, prompt: string | null = null): Promise<Response<undefined>> {
+        const code_verifier = generators.codeVerifier();
+        const state = generators.state();
+        const nonce = generators.nonce();
+        const code_challenge = generators.codeChallenge(code_verifier);
+        const expires = new Date(Date.now() + 1000 * 60 * 15);
+
+        const session: SSOSessionContext = {
+            expires,
+            code_verifier,
+            state,
+            nonce,
+            redirectUri,
+            spaState,
+            providerType: this.provider,
+            userId: Context.user?.id ?? null,
+        };
+
+        try {
+            const response = new Response(undefined);
+
+            const client = await this.getClient();
+            await SSOService.storeSession(response, session);
+
+            const redirect = client.authorizationUrl({
+                scope: 'openid email profile',
+                code_challenge,
+                code_challenge_method: 'S256',
+                response_mode: 'form_post',
+                response_type: 'code',
+                state,
+                nonce,
+                prompt: prompt ?? undefined,
+                login_hint: this.user?.email ?? undefined,
+                redirect_uri: this.externalRedirectUri,
+            });
+
+            response.headers['location'] = redirect;
+            response.status = 302;
+
+            return response;
+        }
+        catch (e) {
+            const message = (isSimpleError(e) || isSimpleErrors(e) ? e.getHuman() : 'Er ging iets mis.');
+            console.error('Error in openID callback', e);
+            return SSOServiceWithSession.getErrorRedirectResponse(session, message);
+        }
+    }
+}
+
+export class SSOServiceWithSession {
+    session: SSOSessionContext;
+    service: SSOService;
+    request: DecodedRequest<any, any, any>;
+
+    constructor(session: SSOSessionContext, service: SSOService, request: DecodedRequest<any, any, any>) {
+        this.session = session;
+        this.service = service;
+        this.request = request;
+    }
+
+    static async fromSession(request: DecodedRequest<any, any, any>): Promise<SSOServiceWithSession> {
+        const session = SSOService.getSession(request);
+
+        if (!session) {
+            throw new Error('Missing session');
+        }
+
+        const service = await SSOService.fromContext(session.providerType);
+
+        return new SSOServiceWithSession(session, service, request);
+    }
+
+    async callback(): Promise<Response<undefined>> {
+        const session = SSOService.getSession(Context.request);
+
+        if (!session) {
+            throw new Error('Missing session');
+        }
+
+        try {
+            const response = new Response(undefined);
+            const client = await this.service.getClient();
+
+            const tokenSet = await client.callback(this.service.externalRedirectUri, this.request.body as Record<string, unknown>, {
+                code_verifier: session.code_verifier,
+                state: session.state,
+                nonce: session.nonce,
+            });
+
+            console.log('received and validated tokens %j', tokenSet);
+
+            const claims = tokenSet.claims();
+            console.log('validated ID Token claims %j', claims);
+
+            if (!claims.name) {
+                throw new SimpleError({
+                    code: 'invalid_user',
+                    message: 'Missing name',
+                    statusCode: 400,
+                });
+            }
+
+            let firstName = claims.name.split(' ')[0];
+            let lastName = claims.name.split(' ').slice(1).join(' ');
+
+            // Get from API
+            if (tokenSet.access_token) {
+                const userinfo = await client.userinfo(tokenSet.access_token);
+                console.log('userinfo', userinfo);
+
+                if (userinfo.given_name) {
+                    console.log('userinfo given_name', userinfo.given_name);
+                    firstName = userinfo.given_name;
+                }
+
+                if (userinfo.family_name) {
+                    console.log('userinfo family_name', userinfo.family_name);
+                    lastName = userinfo.family_name;
+                }
+            }
+
+            if (!claims.email) {
+                throw new SimpleError({
+                    code: 'invalid_user',
+                    message: 'Missing email address',
+                    statusCode: 400,
+                });
+            }
+
+            if (!claims.sub) {
+                throw new SimpleError({
+                    code: 'invalid_user',
+                    message: 'Missing sub',
+                    statusCode: 400,
+                });
+            }
+
+            // Get user from database
+            let user = await User.getForRegister(this.service.organization?.id ?? null, claims.email);
+            if (!user) {
+                if (this.session.userId) {
+                    throw new SimpleError({
+                        code: 'invalid_user',
+                        message: 'User not found: please log in with the same email address as the user you are trying to link',
+                        human: 'Je moet inloggen met hetzelfde e-mailadres als het account dat je probeert te koppelen',
+                        statusCode: 404,
+                    });
+                }
+
+                // Create a new user
+                user = await User.registerSSO(this.service.organization, {
+                    id: undefined,
+                    email: claims.email,
+                    firstName,
+                    lastName,
+                    type: session.providerType,
+                    sub: claims.sub,
+                });
+
+                if (!user) {
+                    throw new SimpleError({
+                        code: 'invalid_user',
+                        message: 'Failed to create user',
+                        statusCode: 500,
+                    });
+                }
+            }
+            else {
+                if (this.session.userId && user.id !== this.session.userId) {
+                    throw new SimpleError({
+                        code: 'invalid_user',
+                        message: 'User or email mismatch',
+                        statusCode: 400,
+                    });
+                }
+
+                // Update name
+                if (!user.firstName || !user.hasPasswordBasedAccount()) {
+                    user.firstName = firstName;
+                }
+                if (!user.lastName || !user.hasPasswordBasedAccount()) {
+                    user.lastName = lastName;
+                }
+                user.linkLoginProvider(this.service.provider, claims.sub, !!this.session.userId);
+                await user.save();
+            }
+
+            // Redirect back
+            const redirectUri = new URL(session.redirectUri);
+
+            if (!this.session.userId) {
+                const token = await Token.createExpiredToken(user);
+
+                if (!token) {
+                    throw new SimpleError({
+                        code: 'error',
+                        message: 'Could not generate token',
+                        human: 'Er ging iets mis bij het aanmelden',
+                        statusCode: 500,
+                    });
+                }
+
+                const st = new TokenStruct(token);
+                redirectUri.searchParams.set('oid_rt', st.refreshToken);
+                redirectUri.searchParams.set('s', session.spaState);
+            }
+            else {
+                redirectUri.searchParams.set('s', session.spaState);
+                redirectUri.searchParams.set('msg', 'Je account is succesvol gekoppeld');
+            }
+
+            response.headers['location'] = redirectUri.toString();
+            response.status = 302;
+
+            return response;
+        }
+        catch (e) {
+            const message = (isSimpleError(e) || isSimpleErrors(e) ? e.getHuman() : 'Er ging iets mis.');
+            console.error('Error in openID callback', e);
+            return SSOServiceWithSession.getErrorRedirectResponse(session, message);
+        }
+    }
+
+    static getErrorRedirectResponse(session: SSOSessionContext, errorMessage: string) {
+        const response = new Response(undefined);
+
+        // Redirect back to webshop
+        const redirectUri = new URL(session.redirectUri);
+        redirectUri.searchParams.set('s', session.spaState);
+        redirectUri.searchParams.set('error', errorMessage);
+
+        response.headers['location'] = redirectUri.toString();
+        response.status = 302;
+
+        return response;
+    }
+}

package/src/helpers/OpenIDConnectHelper.ts

@@ -1,295 +0,0 @@
-import { DecodedRequest, Response } from '@simonbackx/simple-endpoints';
-import { isSimpleError, isSimpleErrors, SimpleError } from '@simonbackx/simple-errors';
-import { Organization, Token, User } from '@stamhoofd/models';
-import { LoginProviderType, OpenIDClientConfiguration, Token as TokenStruct } from '@stamhoofd/structures';
-import crypto from 'crypto';
-import { generators, Issuer } from 'openid-client';
-
-import { CookieHelper } from './CookieHelper';
-
-async function randomBytes(size: number): Promise<Buffer> {
-    return new Promise((resolve, reject) => {
-        crypto.randomBytes(size, (err: Error | null, buf: Buffer) => {
-            if (err) {
-                reject(err);
-                return;
-            }
-            resolve(buf);
-        });
-    });
-}
-
-type SessionContext = {
-    expires: Date;
-    code_verifier: string;
-    state: string;
-    nonce: string;
-    redirectUri: string;
-    spaState: string;
-    providerType: LoginProviderType;
-};
-
-export class OpenIDConnectHelper {
-    organization: Organization | null;
-    configuration: OpenIDClientConfiguration;
-
-    static sessionStorage = new Map<string, SessionContext>();
-
-    constructor(organization: Organization | null, configuration: OpenIDClientConfiguration) {
-        this.organization = organization;
-        this.configuration = configuration;
-    }
-
-    get redirectUri() {
-        if (this.configuration.redirectUri) {
-            return this.configuration.redirectUri;
-        }
-        // todo: we might need a special url for the app here
-
-        if (!this.organization) {
-            return 'https://' + STAMHOOFD.domains.api + '/openid/callback';
-        }
-        return 'https://' + this.organization.id + '.' + STAMHOOFD.domains.api + '/openid/callback';
-    }
-
-    async getClient() {
-        const issuer = await Issuer.discover(this.configuration.issuer);
-        const client = new issuer.Client({
-            client_id: this.configuration.clientId,
-            client_secret: this.configuration.clientSecret,
-            redirect_uris: [this.redirectUri],
-            response_types: ['code'],
-        });
-
-        // Todo: in the future we can add a cache here
-
-        return client;
-    }
-
-    static async storeSession(response: Response<any>, data: SessionContext) {
-        const sessionId = (await randomBytes(192)).toString('base64');
-
-        // Delete expired sessions
-        for (const [key, value] of this.sessionStorage) {
-            if (value.expires < new Date()) {
-                this.sessionStorage.delete(key);
-            }
-        }
-
-        this.sessionStorage.set(sessionId, data);
-
-        // Store
-        CookieHelper.setCookie(response, 'oid_session_id', sessionId, {
-            httpOnly: true,
-            secure: STAMHOOFD.environment !== 'development',
-            expires: data.expires,
-        });
-    }
-
-    static getSession(request: DecodedRequest<any, any, any>): SessionContext | null {
-        const sessionId = CookieHelper.getCookie(request, 'oid_session_id');
-        if (!sessionId) {
-            return null;
-        }
-
-        const session = this.sessionStorage.get(sessionId);
-        if (!session) {
-            return null;
-        }
-
-        if (session.expires < new Date()) {
-            return null;
-        }
-
-        return session;
-    }
-
-    async startAuthCodeFlow(redirectUri: string, providerType: LoginProviderType, spaState: string, prompt: string | null = null): Promise<Response<undefined>> {
-        const code_verifier = generators.codeVerifier();
-        const state = generators.state();
-        const nonce = generators.nonce();
-        const code_challenge = generators.codeChallenge(code_verifier);
-        const expires = new Date(Date.now() + 1000 * 60 * 15);
-
-        const session: SessionContext = {
-            expires,
-            code_verifier,
-            state,
-            nonce,
-            redirectUri,
-            spaState,
-            providerType,
-        };
-
-        try {
-            const response = new Response(undefined);
-
-            const client = await this.getClient();
-            await OpenIDConnectHelper.storeSession(response, session);
-
-            const redirect = client.authorizationUrl({
-                scope: 'openid email profile',
-                code_challenge,
-                code_challenge_method: 'S256',
-                response_mode: 'form_post',
-                response_type: 'code',
-                state,
-                nonce,
-                prompt: prompt ?? undefined,
-            });
-
-            response.headers['location'] = redirect;
-            response.status = 302;
-
-            return response;
-        }
-        catch (e) {
-            const message = (isSimpleError(e) || isSimpleErrors(e) ? e.getHuman() : 'Er ging iets mis.');
-            console.error('Error in openID callback', e);
-            return OpenIDConnectHelper.getErrorRedirectResponse(session, message);
-        }
-    }
-
-    async callback(request: DecodedRequest<any, any, any>): Promise<Response<undefined>> {
-        const session = OpenIDConnectHelper.getSession(request);
-
-        if (!session) {
-            throw new Error('Missing session');
-        }
-
-        try {
-            const response = new Response(undefined);
-            const client = await this.getClient();
-
-            // eslint-disable-next-line @typescript-eslint/no-unsafe-argument
-            const tokenSet = await client.callback(this.redirectUri, request.body, {
-                code_verifier: session.code_verifier,
-                state: session.state,
-                nonce: session.nonce,
-            });
-
-            console.log('received and validated tokens %j', tokenSet);
-
-            const claims = tokenSet.claims();
-            console.log('validated ID Token claims %j', claims);
-
-            if (!claims.name) {
-                throw new SimpleError({
-                    code: 'invalid_user',
-                    message: 'Missing name',
-                    statusCode: 400,
-                });
-            }
-
-            let firstName = claims.name.split(' ')[0];
-            let lastName = claims.name.split(' ').slice(1).join(' ');
-
-            // Get from API
-            if (tokenSet.access_token) {
-                const userinfo = await client.userinfo(tokenSet.access_token);
-                console.log('userinfo', userinfo);
-
-                if (userinfo.given_name) {
-                    console.log('userinfo given_name', userinfo.given_name);
-                    firstName = userinfo.given_name;
-                }
-
-                if (userinfo.family_name) {
-                    console.log('userinfo family_name', userinfo.family_name);
-                    lastName = userinfo.family_name;
-                }
-            }
-
-            if (!claims.email) {
-                throw new SimpleError({
-                    code: 'invalid_user',
-                    message: 'Missing email address',
-                    statusCode: 400,
-                });
-            }
-
-            if (!claims.sub) {
-                throw new SimpleError({
-                    code: 'invalid_user',
-                    message: 'Missing sub',
-                    statusCode: 400,
-                });
-            }
-
-            // Get user from database
-            let user = await User.getForRegister(this.organization?.id ?? null, claims.email);
-            if (!user) {
-                // Create a new user
-                user = await User.registerSSO(this.organization, {
-                    id: undefined,
-                    email: claims.email,
-                    firstName,
-                    lastName,
-                    type: session.providerType,
-                    sub: claims.sub,
-                });
-
-                if (!user) {
-                    throw new SimpleError({
-                        code: 'invalid_user',
-                        message: 'Failed to create user',
-                        statusCode: 500,
-                    });
-                }
-            }
-            else {
-                // Update name
-                if (!user.firstName || !user.hasPasswordBasedAccount()) {
-                    user.firstName = firstName;
-                }
-                if (!user.lastName || !user.hasPasswordBasedAccount()) {
-                    user.lastName = lastName;
-                }
-                user.linkLoginProvider(session.providerType, claims.sub);
-                await user.save();
-            }
-
-            const token = await Token.createExpiredToken(user);
-
-            if (!token) {
-                throw new SimpleError({
-                    code: 'error',
-                    message: 'Could not generate token',
-                    human: 'Er ging iets mis bij het aanmelden',
-                    statusCode: 500,
-                });
-            }
-
-            const st = new TokenStruct(token);
-
-            // Redirect back to webshop
-            const redirectUri = new URL(session.redirectUri);
-            redirectUri.searchParams.set('oid_rt', st.refreshToken);
-            redirectUri.searchParams.set('s', session.spaState);
-
-            response.headers['location'] = redirectUri.toString();
-            response.status = 302;
-
-            return response;
-        }
-        catch (e) {
-            const message = (isSimpleError(e) || isSimpleErrors(e) ? e.getHuman() : 'Er ging iets mis.');
-            console.error('Error in openID callback', e);
-            return OpenIDConnectHelper.getErrorRedirectResponse(session, message);
-        }
-    }
-
-    static getErrorRedirectResponse(session: SessionContext, errorMessage: string) {
-        const response = new Response(undefined);
-
-        // Redirect back to webshop
-        const redirectUri = new URL(session.redirectUri);
-        redirectUri.searchParams.set('s', session.spaState);
-        redirectUri.searchParams.set('error', errorMessage);
-
-        response.headers['location'] = redirectUri.toString();
-        response.status = 302;
-
-        return response;
-    }
-}