@stamhoofd/backend 2.71.0 → 2.72.0

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@stamhoofd/backend",
-    "version": "2.71.0",
+    "version": "2.72.0",
     "main": "./dist/index.js",
     "exports": {
         ".": {
@@ -37,14 +37,14 @@
         "@simonbackx/simple-encoding": "2.19.0",
         "@simonbackx/simple-endpoints": "1.15.0",
         "@simonbackx/simple-logging": "^1.0.1",
-        "@stamhoofd/backend-i18n": "2.71.0",
-        "@stamhoofd/backend-middleware": "2.71.0",
-        "@stamhoofd/email": "2.71.0",
-        "@stamhoofd/models": "2.71.0",
-        "@stamhoofd/queues": "2.71.0",
-        "@stamhoofd/sql": "2.71.0",
-        "@stamhoofd/structures": "2.71.0",
-        "@stamhoofd/utility": "2.71.0",
+        "@stamhoofd/backend-i18n": "2.72.0",
+        "@stamhoofd/backend-middleware": "2.72.0",
+        "@stamhoofd/email": "2.72.0",
+        "@stamhoofd/models": "2.72.0",
+        "@stamhoofd/queues": "2.72.0",
+        "@stamhoofd/sql": "2.72.0",
+        "@stamhoofd/structures": "2.72.0",
+        "@stamhoofd/utility": "2.72.0",
         "archiver": "^7.0.1",
         "aws-sdk": "^2.885.0",
         "axios": "1.6.8",
@@ -64,5 +64,5 @@
     "publishConfig": {
         "access": "public"
     },
-    "gitHead": "8b35d36e694303905aa27cf9bff5539777d6ace1"
+    "gitHead": "9ca2f0fff00eafff2a398dbfdbfb032367473d1c"
 }

package/src/audit-logs/OrganizationLogger.ts

@@ -3,7 +3,7 @@ import { AuditLogType } from '@stamhoofd/structures';
 import { getDefaultGenerator, ModelLogger } from './ModelLogger';
 
 export const OrganizationLogger = new ModelLogger(Organization, {
-    skipKeys: ['searchIndex'],
+    skipKeys: ['searchIndex', 'serverMeta'],
     optionsGenerator: getDefaultGenerator({
         created: AuditLogType.OrganizationAdded,
         updated: AuditLogType.OrganizationEdited,

package/src/audit-logs/PlatformLogger.ts

@@ -3,6 +3,7 @@ import { getDefaultGenerator, ModelLogger } from './ModelLogger';
 import { AuditLogType } from '@stamhoofd/structures';
 
 export const PlatformLogger = new ModelLogger(Platform, {
+    skipKeys: ['serverConfig'],
     optionsGenerator: getDefaultGenerator({
         updated: AuditLogType.PlatformSettingsChanged,
     }),

package/src/endpoints/auth/CreateTokenEndpoint.ts

@@ -86,7 +86,8 @@ export class CreateTokenEndpoint extends Endpoint<Params, Query, Body, ResponseB
 
                 if (STAMHOOFD.userMode === 'platform') {
                     const platform = await Platform.getShared();
-                    if (!platform.config.loginMethods.includes(LoginMethod.Password)) {
+                    const config = platform.config.loginMethods.get(LoginMethod.Password);
+                    if (!config) {
                         throw new SimpleError({
                             code: 'not_supported',
                             message: 'This platform does not support password login',
@@ -94,6 +95,15 @@ export class CreateTokenEndpoint extends Endpoint<Params, Query, Body, ResponseB
                             statusCode: 400,
                         });
                     }
+
+                    if (!config.isEnabledForEmail(request.body.username)) {
+                        throw new SimpleError({
+                            code: 'not_supported',
+                            message: 'Login method not supported',
+                            human: 'Je kan op dit account niet inloggen met een wachtwoord. Gebruik een andere methode om in te loggen.',
+                            statusCode: 400,
+                        });
+                    }
                 }
 
                 const user = await User.login(organization?.id ?? null, request.body.username, request.body.password);

package/src/endpoints/auth/ForgotPasswordEndpoint.ts

@@ -1,8 +1,9 @@
 import { Decoder } from '@simonbackx/simple-encoding';
 import { DecodedRequest, Endpoint, Request, Response } from '@simonbackx/simple-endpoints';
-import { PasswordToken, sendEmailTemplate, User } from '@stamhoofd/models';
-import { EmailTemplateType, ForgotPasswordRequest, Recipient, Replacement } from '@stamhoofd/structures';
+import { PasswordToken, Platform, sendEmailTemplate, User } from '@stamhoofd/models';
+import { EmailTemplateType, ForgotPasswordRequest, LoginMethod, Recipient, Replacement } from '@stamhoofd/structures';
 
+import { SimpleError } from '@simonbackx/simple-errors';
 import { Context } from '../../helpers/Context';
 
 type Params = Record<string, never>;
@@ -28,6 +29,29 @@ export class ForgotPasswordEndpoint extends Endpoint<Params, Query, Body, Respon
 
     async handle(request: DecodedRequest<Params, Query, Body>) {
         const organization = await Context.setOptionalOrganizationScope();
+
+        if (STAMHOOFD.userMode === 'platform') {
+            const platform = await Platform.getShared();
+            const config = platform.config.loginMethods.get(LoginMethod.Password);
+            if (!config) {
+                throw new SimpleError({
+                    code: 'not_supported',
+                    message: 'This platform does not support password login',
+                    human: 'Dit platform ondersteunt geen wachtwoord login',
+                    statusCode: 400,
+                });
+            }
+
+            if (!config.isEnabledForEmail(request.body.email)) {
+                throw new SimpleError({
+                    code: 'not_supported',
+                    message: 'Login method not supported',
+                    human: 'Je kan op dit account geen wachtwoord gebruiken om in te loggen.',
+                    statusCode: 400,
+                });
+            }
+        }
+
         const user = await User.getForAuthentication(organization?.id ?? null, request.body.email, { allowWithoutAccount: true });
 
         if (!user) {

package/src/endpoints/auth/PatchUserEndpoint.ts

@@ -1,8 +1,8 @@
 import { AutoEncoderPatchType, Decoder, isPatch } from '@simonbackx/simple-encoding';
 import { DecodedRequest, Endpoint, Request, Response } from '@simonbackx/simple-endpoints';
 import { SimpleError } from '@simonbackx/simple-errors';
-import { EmailVerificationCode, Member, PasswordToken, Token, User } from '@stamhoofd/models';
-import { NewUser, PermissionLevel, SignupResponse, UserPermissions, UserWithMembers } from '@stamhoofd/structures';
+import { EmailVerificationCode, Member, PasswordToken, Platform, Token, User } from '@stamhoofd/models';
+import { LoginMethod, NewUser, PermissionLevel, SignupResponse, UserPermissions, UserWithMembers } from '@stamhoofd/structures';
 
 import { Context } from '../../helpers/Context';
 import { MemberUserSyncer } from '../../helpers/MemberUserSyncer';
@@ -135,6 +135,28 @@ export class PatchUserEndpoint extends Endpoint<Params, Query, Body, ResponseBod
         }
 
         if (editUser.id === user.id && request.body.password) {
+            if (STAMHOOFD.userMode === 'platform') {
+                const platform = await Platform.getShared();
+                const config = platform.config.loginMethods.get(LoginMethod.Password);
+                if (!config) {
+                    throw new SimpleError({
+                        code: 'not_supported',
+                        message: 'This platform does not support password login',
+                        human: 'Dit platform ondersteunt geen wachtwoord login',
+                        statusCode: 400,
+                    });
+                }
+
+                if (!config.isEnabledForEmail(editUser.email)) {
+                    throw new SimpleError({
+                        code: 'not_supported',
+                        message: 'Login method not supported',
+                        human: 'Je kan op dit account geen wachtwoord gebruiken om in te loggen.',
+                        statusCode: 400,
+                    });
+                }
+            }
+
             // password changes
             await editUser.changePassword(request.body.password);
             await PasswordToken.clearFor(editUser.id);

package/src/endpoints/auth/SignupEndpoint.ts

@@ -32,7 +32,7 @@ export class SignupEndpoint extends Endpoint<Params, Query, Body, ResponseBody>
 
         if (STAMHOOFD.userMode === 'platform') {
             const platform = await Platform.getShared();
-            if (!platform.config.loginMethods.includes(LoginMethod.Password)) {
+            if (!platform.config.loginMethods.has(LoginMethod.Password)) {
                 throw new SimpleError({
                     code: 'not_supported',
                     message: 'This platform does not support password login',

package/src/endpoints/global/members/GetMembersEndpoint.ts

@@ -3,15 +3,15 @@ import { DecodedRequest, Endpoint, Request, Response } from '@simonbackx/simple-
 import { SimpleError } from '@simonbackx/simple-errors';
 import { Member, Platform } from '@stamhoofd/models';
 import { SQL, compileToSQLFilter, compileToSQLSorter } from '@stamhoofd/sql';
-import { CountFilteredRequest, Country, LimitedFilteredRequest, MembersBlob, PaginatedResponse, PermissionLevel, StamhoofdFilter, assertSort, getSortFilter } from '@stamhoofd/structures';
+import { CountFilteredRequest, Country, CountryCode, LimitedFilteredRequest, MembersBlob, PaginatedResponse, PermissionLevel, StamhoofdFilter, assertSort, getSortFilter } from '@stamhoofd/structures';
 import { DataValidator } from '@stamhoofd/utility';
 
+import { SQLResultNamespacedRow } from '@simonbackx/simple-database';
 import parsePhoneNumber from 'libphonenumber-js/max';
 import { AuthenticatedStructures } from '../../../helpers/AuthenticatedStructures';
 import { Context } from '../../../helpers/Context';
 import { memberFilterCompilers } from '../../../sql-filters/members';
 import { memberSorters } from '../../../sql-sorters/members';
-import { SQLResultNamespacedRow } from '@simonbackx/simple-database';
 
 type Params = Record<string, never>;
 type Query = LimitedFilteredRequest;
@@ -141,7 +141,9 @@ export class GetMembersEndpoint extends Endpoint<Params, Query, Body, ResponseBo
             if (!searchFilter && q.search.match(/^\+?[0-9\s-]+$/)) {
                 // Try to format as phone so we have 1:1 space matches
                 try {
-                    const phoneNumber = parsePhoneNumber(q.search, (Context.i18n.country as Country) || Country.Belgium);
+                    const country = (Context.i18n.country as CountryCode) || Country.Belgium;
+
+                    const phoneNumber = parsePhoneNumber(q.search, country);
                     if (phoneNumber && phoneNumber.isValid()) {
                         const formatted = phoneNumber.formatInternational();
                         searchFilter = {

package/src/endpoints/global/sso/GetSSOEndpoint.ts

@@ -44,6 +44,13 @@ export class GetOrganizationSSOEndpoint extends Endpoint<Params, Query, Body, Re
             throw Context.auth.error();
         }
 
-        return new Response(service.configuration);
+        const configuration = service.configuration.clone();
+
+        // Remove secret by placeholder asterisks
+        if (configuration.clientSecret.length > 0) {
+            configuration.clientSecret = OpenIDClientConfiguration.placeholderClientSecret;
+        }
+
+        return new Response(configuration);
     }
 }

package/src/endpoints/global/sso/SetSSOEndpoint.ts

@@ -41,6 +41,10 @@ export class SetOrganizationSSOEndpoint extends Endpoint<Params, Query, Body, Re
             throw Context.auth.error();
         }
 
+        if (request.body.clientSecret === OpenIDClientConfiguration.placeholderClientSecret) {
+            delete request.body.clientSecret;
+        }
+
         const newConfig: OpenIDClientConfiguration = service.configuration.patch(request.body);
         await service.setConfiguration(newConfig);
 

package/src/helpers/AdminPermissionChecker.ts

@@ -538,6 +538,10 @@ export class AdminPermissionChecker {
     }
 
     async canEditUserName(user: User) {
+        if (user.hasAccount() && !user.hasPasswordBasedAccount()) {
+            return false;
+        }
+
         if (user.id === this.user.id) {
             return true;
         }
@@ -556,9 +560,6 @@ export class AdminPermissionChecker {
     }
 
     async canEditUserEmail(user: User) {
-        if (user.meta?.loginProviderIds?.size) {
-            return false;
-        }
         return this.canEditUserName(user);
     }
 

package/src/services/SSOService.ts

@@ -1,7 +1,7 @@
 import { DecodedRequest, Response } from '@simonbackx/simple-endpoints';
 import { isSimpleError, isSimpleErrors, SimpleError } from '@simonbackx/simple-errors';
 import { Organization, Platform, Token, User, Webshop } from '@stamhoofd/models';
-import { LoginProviderType, OpenIDClientConfiguration, StartOpenIDFlowStruct, Token as TokenStruct } from '@stamhoofd/structures';
+import { LoginMethod, LoginProviderType, OpenIDClientConfiguration, StartOpenIDFlowStruct, Token as TokenStruct } from '@stamhoofd/structures';
 import crypto from 'crypto';
 import { generators, Issuer } from 'openid-client';
 import { Context } from '../helpers/Context';
@@ -81,8 +81,8 @@ export class SSOService {
         const platform = await Platform.getShared();
 
         const service = new SSOService({ provider, platform, organization, user: Context.user });
-        // Validate configuration
-        const _ = service.configuration;
+        service.validate();
+
         return service;
     }
 
@@ -117,6 +117,51 @@ export class SSOService {
         return configuration;
     }
 
+    get loginConfiguration() {
+        if (this.organization) {
+            throw new SimpleError({
+                code: 'invalid_client',
+                message: 'Login configuration not yet supported for organization users',
+                statusCode: 400,
+            });
+        }
+
+        const loginConfiguration = this.platform.config.loginMethods.get(this.provider as unknown as LoginMethod);
+        if (!loginConfiguration) {
+            throw new SimpleError({
+                code: 'invalid_client',
+                message: 'SSO not configured (correctly)',
+                statusCode: 400,
+            });
+        }
+
+        return loginConfiguration;
+    }
+
+    validate() {
+        // Validate configuration exists
+        const _ = this.configuration;
+        const __ = this.loginConfiguration;
+
+        if (this.user) {
+            this.validateEmail(this.user.email);
+        }
+    }
+
+    validateEmail(email: string) {
+        // Validate configuration
+        const loginConfiguration = this.loginConfiguration;
+
+        if (!loginConfiguration.isEnabledForEmail(email)) {
+            throw new SimpleError({
+                code: 'invalid_user',
+                message: 'User not allowed to use this login method',
+                human: 'Je kan deze inlogmethode niet gebruiken',
+                statusCode: 400,
+            });
+        }
+    }
+
     async setConfiguration(configuration: OpenIDClientConfiguration) {
         if (this.provider === LoginProviderType.SSO) {
             if (this.organization) {
@@ -289,8 +334,15 @@ export class SSOService {
             const client = await this.getClient();
             await SSOService.storeSession(response, session);
 
+            const scopes = ['openid', 'email', 'profile'];
+
+            if (this.provider === LoginProviderType.SSO) {
+                // Google doesn't support this scope
+                scopes.push('offline_access');
+            }
+
             const redirect = client.authorizationUrl({
-                scope: 'openid email profile',
+                scope: scopes.join(' '),
                 code_challenge,
                 code_challenge_method: 'S256',
                 response_mode: 'form_post',
@@ -300,6 +352,9 @@ export class SSOService {
                 prompt: prompt ?? undefined,
                 login_hint: this.user?.email ?? undefined,
                 redirect_uri: this.externalRedirectUri,
+
+                // Google has this instead of the offline_access scope
+                access_type: this.provider === LoginProviderType.Google ? 'offline' : undefined,
             });
 
             response.headers['location'] = redirect;
@@ -387,6 +442,13 @@ export class SSOServiceWithSession {
                 }
             }
 
+            if (tokenSet.refresh_token) {
+                console.log('OK. Refresh token received!');
+            }
+            else {
+                console.log('No refresh token');
+            }
+
             if (!claims.email) {
                 throw new SimpleError({
                     code: 'invalid_user',
@@ -403,6 +465,8 @@ export class SSOServiceWithSession {
                 });
             }
 
+            this.service.validateEmail(claims.email);
+
             // Get user from database
             let user = await User.getForRegister(this.service.organization?.id ?? null, claims.email);
             if (!user) {