@actuate-media/cms-core 0.35.1 → 0.37.0

package/dist/api/handlers.js

@@ -1133,10 +1133,34 @@ const MAX_CONCURRENT_SESSIONS = 5;
 async function enforceSessionLimitsForUser(d, userId) {
     if (!hasModel(d, 'session'))
         return;
+    // Precedence: explicitly-saved Security setting (database) ▸ auth config ▸
+    // default. We read the stored value directly (rather than the parsed
+    // defaults) so an unsaved policy doesn't shadow a config-provided override.
+    let storedMax;
+    try {
+        if (hasModel(d, 'document')) {
+            const row = await d.document.findFirst({
+                where: { collection: 'settings', deletedAt: null },
+                select: { data: true },
+            });
+            const stored = row?.data?.security;
+            const v = stored?.session?.maxConcurrentSessions;
+            if (typeof v === 'number' && Number.isInteger(v) && v >= 0)
+                storedMax = v;
+        }
+    }
+    catch {
+        /* fall back to config/default below */
+    }
     const auth = getActuateConfig()?.auth;
-    const max = typeof auth?.maxConcurrentSessions === 'number' && auth.maxConcurrentSessions > 0
-        ? auth.maxConcurrentSessions
-        : MAX_CONCURRENT_SESSIONS;
+    const max = storedMax !== undefined
+        ? storedMax
+        : typeof auth?.maxConcurrentSessions === 'number' && auth.maxConcurrentSessions > 0
+            ? auth.maxConcurrentSessions
+            : MAX_CONCURRENT_SESSIONS;
+    // 0 ⇒ unlimited: skip pruning entirely.
+    if (max <= 0)
+        return;
     const active = await d.session.findMany({
         where: { userId, revokedAt: null, expiresAt: { gt: new Date() } },
         select: { id: true, createdAt: true },
@@ -1445,10 +1469,29 @@ export function registerCMSRoutes(router) {
                     userAgent: userAgent ?? null,
                 },
             });
+            // Surface whether org-wide MFA is required but this account hasn't
+            // enrolled yet (past its grace window). The admin shell uses this to
+            // prompt enrollment. Computed best-effort; never blocks login (the
+            // account can still set up TOTP from inside the admin).
+            let mfaSetupRequired = false;
+            try {
+                const { getStoredSecuritySettings } = await import('../security/center/gather.js');
+                const sec = await getStoredSecuritySettings(d);
+                if (sec.mfa.required && !user.totpEnabled) {
+                    const graceMs = sec.mfa.gracePeriodDays * 24 * 60 * 60 * 1000;
+                    const requiredAt = sec.mfa.requiredAt ? Date.parse(sec.mfa.requiredAt) : 0;
+                    const createdAt = user.createdAt ? new Date(user.createdAt).getTime() : 0;
+                    mfaSetupRequired = Date.now() >= Math.max(requiredAt || 0, createdAt || 0) + graceMs;
+                }
+            }
+            catch {
+                /* policy unavailable — do not block login */
+            }
             const response = json({
                 data: {
                     token,
                     user: { id: user.id, email: user.email, name: user.name, role: user.role },
+                    mfaSetupRequired,
                 },
             });
             const isProduction = process.env.NODE_ENV === 'production';
@@ -8897,6 +8940,212 @@ export function registerCMSRoutes(router) {
             return internalError(err);
         }
     });
+    // Public brand: resolved logos + favicon for the public frontend. No auth —
+    // brand assets are public site data. Only the PUBLIC brand view + favicon are
+    // exposed here (never the admin-only brand) so a white-labeled admin doesn't
+    // leak through the public API.
+    router.get('/public/brand', async (request) => {
+        try {
+            const { resolveBrand } = await import('../appearance/index.js');
+            const resolved = await resolveBrand(db(), null);
+            return cachedRead(request, {
+                cache: getActuateConfig()?.cache,
+                tags: [ACTUATE_TAG_ROOT, actuateTag('global', 'settings')],
+                wrap: jsonWithCache,
+                build: async () => ({
+                    data: { public: resolved.public, favicon: resolved.favicon },
+                }),
+            });
+        }
+        catch (err) {
+            return internalError(err, 'public/brand GET');
+        }
+    });
+    // Authenticated appearance read: stored appearance + brand settings plus the
+    // fully resolved admin/public/favicon views (with asset URLs) so the admin
+    // Appearance tab can render live previews. View-only auth — writes go through
+    // PUT /globals/settings (ADMIN_ROLES), so editors can view but not save.
+    router.get('/appearance', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const { getAppearanceSettings, getBrandSettings, resolveBrand } = await import('../appearance/index.js');
+            const [appearance, brand, resolved] = await Promise.all([
+                getAppearanceSettings(db()),
+                getBrandSettings(db()),
+                resolveBrand(db(), null),
+            ]);
+            return json({
+                data: {
+                    appearance,
+                    brand,
+                    resolved: { admin: resolved.admin, public: resolved.public, favicon: resolved.favicon },
+                    // Direct per-asset URLs so the editor shows each field's actual
+                    // asset (not the resolved fallback chain).
+                    assets: resolved.assets,
+                    siteTitle: resolved.siteTitle,
+                },
+            });
+        }
+        catch (err) {
+            return internalError(err, 'appearance GET');
+        }
+    });
+    // ---------------------------------------------------------------------------
+    // Security Center
+    //   GET  /security                       — computed posture + summaries
+    //   PUT  /security                        — persist enforced policy (lockout-safe)
+    //   POST /security/sessions/revoke-all    — revoke the caller's other sessions
+    // ---------------------------------------------------------------------------
+    router.get('/security', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const adminErr = requireAdminScope(auth.session);
+            if (adminErr)
+                return adminErr;
+            const { getSecurityCenterData } = await import('../security/center/gather.js');
+            const data = await getSecurityCenterData({
+                db: db(),
+                userId: auth.session.userId,
+                currentIp: getClientIp(request),
+            });
+            return json({ data });
+        }
+        catch (err) {
+            return internalError(err, 'security GET');
+        }
+    });
+    router.put('/security', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const adminErr = requireAdminScope(auth.session);
+            if (adminErr)
+                return adminErr;
+            const body = (await request.json());
+            const { parseSecuritySettings, validateSecuritySettings, mfaEnableLockoutError } = await import('../security/center/settings.js');
+            const { getStoredSecuritySettings, getSecurityCenterData } = await import('../security/center/gather.js');
+            const incoming = parseSecuritySettings({ security: body });
+            const issues = validateSecuritySettings(incoming);
+            const errors = issues.filter((i) => i.severity === 'error');
+            if (errors.length > 0) {
+                return json({ error: errors[0].message, issues }, 400);
+            }
+            const d = db();
+            const current = await getStoredSecuritySettings(d);
+            // Lockout-safe: enabling org-wide MFA requires the acting admin to have
+            // their own MFA configured. Enforced server-side — never trust the client.
+            const enabling = incoming.mfa.required && !current.mfa.required;
+            if (enabling) {
+                let viewerHasMfa = false;
+                let totalAdmins = 0;
+                if (hasModel(d, 'user')) {
+                    const viewer = await d.user
+                        .findUnique({ where: { id: auth.session.userId }, select: { totpEnabled: true } })
+                        .catch(() => null);
+                    viewerHasMfa = Boolean(viewer?.totpEnabled);
+                    totalAdmins = await d.user
+                        .count({ where: { role: 'ADMIN', isActive: true } })
+                        .catch(() => 0);
+                }
+                const lockErr = mfaEnableLockoutError({ enabling: true, viewerHasMfa, totalAdmins });
+                if (lockErr) {
+                    return json({ error: lockErr, code: 'MFA_LOCKOUT_RISK' }, 409);
+                }
+            }
+            // Stamp `requiredAt` when MFA requirement flips on (drives the grace
+            // window); preserve it across saves while it stays on; clear when off.
+            const requiredAt = incoming.mfa.required
+                ? current.mfa.required
+                    ? current.mfa.requiredAt
+                    : new Date().toISOString()
+                : undefined;
+            const securityBlob = {
+                mfa: {
+                    required: incoming.mfa.required,
+                    gracePeriodDays: incoming.mfa.gracePeriodDays,
+                    ...(requiredAt ? { requiredAt } : {}),
+                },
+                session: { maxConcurrentSessions: incoming.session.maxConcurrentSessions },
+                updatedAt: new Date().toISOString(),
+                updatedBy: auth.session.userId,
+            };
+            const ctx = buildActionContext(auth.session, d);
+            const prevGlobal = (await getGlobal('settings', ctx).catch(() => ({}))) ?? {};
+            await updateGlobal('settings', { ...prevGlobal, security: securityBlob }, ctx);
+            const changes = [];
+            if (current.mfa.required !== incoming.mfa.required)
+                changes.push({ key: 'mfa.required', from: current.mfa.required, to: incoming.mfa.required });
+            if (current.mfa.gracePeriodDays !== incoming.mfa.gracePeriodDays)
+                changes.push({
+                    key: 'mfa.gracePeriodDays',
+                    from: current.mfa.gracePeriodDays,
+                    to: incoming.mfa.gracePeriodDays,
+                });
+            if (current.session.maxConcurrentSessions !== incoming.session.maxConcurrentSessions)
+                changes.push({
+                    key: 'session.maxConcurrentSessions',
+                    from: current.session.maxConcurrentSessions,
+                    to: incoming.session.maxConcurrentSessions,
+                });
+            if (changes.length > 0) {
+                void logEvent({
+                    event: 'security_settings_changed',
+                    userId: auth.session.userId,
+                    ipAddress: getClientIp(request),
+                    details: {
+                        source: 'database',
+                        environment: process.env.VERCEL_ENV ?? process.env.NODE_ENV ?? null,
+                        changes,
+                    },
+                });
+            }
+            const data = await getSecurityCenterData({
+                db: d,
+                userId: auth.session.userId,
+                currentIp: getClientIp(request),
+            });
+            return json({ data });
+        }
+        catch (err) {
+            return internalError(err, 'security PUT');
+        }
+    });
+    router.post('/security/sessions/revoke-all', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const d = db();
+            if (!hasModel(d, 'session'))
+                return json({ data: { revoked: 0 } });
+            // Revoke every OTHER active session for the caller — their current
+            // session stays valid so they aren't logged out of the admin they're in.
+            const result = await d.session.updateMany({
+                where: {
+                    userId: auth.session.userId,
+                    id: { not: auth.session.sessionId },
+                    revokedAt: null,
+                },
+                data: { revokedAt: new Date() },
+            });
+            const revoked = typeof result?.count === 'number' ? result.count : 0;
+            void logEvent({
+                event: 'sessions_revoked_all',
+                userId: auth.session.userId,
+                ipAddress: getClientIp(request),
+                details: { count: revoked, scope: 'self_other' },
+            });
+            return json({ data: { revoked } });
+        }
+        catch (err) {
+            return internalError(err, 'security/sessions/revoke-all');
+        }
+    });
     router.get('/globals/:slug', async (request, params) => {
         try {
             const auth = await requireAuth(request);
@@ -8946,8 +9195,17 @@ export function registerCMSRoutes(router) {
             // Audit settings changes (title/tagline/URL/locale/timezone/etc.) with a
             // per-key before/after diff so the audit trail records what changed and
             // who changed it. Scalar values only — we never log nested secret blobs.
+            // Nested config blobs (`appearance`, `brand`) are logged as a changed
+            // key (not their contents) so appearance/branding edits are auditable
+            // without dumping asset IDs or theme objects into the log.
             try {
                 const changes = diffScalarKeys(previous ?? {}, body);
+                const prev = (previous ?? {});
+                for (const key of ['appearance', 'brand', 'security']) {
+                    if (key in body && JSON.stringify(prev[key]) !== JSON.stringify(body[key])) {
+                        changes.push({ key, from: '[changed]', to: '[changed]' });
+                    }
+                }
                 if (changes.length > 0) {
                     void logEvent({
                         event: 'settings_changed',