@actuate-media/cms-core 0.36.0 → 0.38.0

package/dist/__tests__/security/center.test.js

@@ -0,0 +1,226 @@
+import { describe, expect, it } from 'vitest';
+import { DEFAULT_SECURITY_SETTINGS, computeSecurityStatus, mfaEnableLockoutError, parseSecuritySettings, summarizeApiKeys, summarizeUsers, validateIpRange, validateSecuritySettings, } from '../../security/center/index.js';
+function baseInput(overrides = {}) {
+    return {
+        isProduction: true,
+        settings: {
+            mfa: { required: true, gracePeriodDays: 7 },
+            session: { maxConcurrentSessions: 5 },
+        },
+        users: {
+            totalUsers: 3,
+            totalAdmins: 2,
+            withMfa: 2,
+            withoutMfa: 1,
+            adminsWithoutMfa: 0,
+            inactive: 0,
+        },
+        apiKeys: { active: 1, withoutExpiration: 0, broadScope: 0, staleUnused90d: 0 },
+        secrets: {
+            cmsSecret: 'pass',
+            encryptionKey: 'pass',
+            rateLimitBackend: 'distributed',
+            apiKeysHashed: true,
+            webhookSecretsEncrypted: true,
+        },
+        ipAllowlist: {
+            enabled: false,
+            source: 'none',
+            ranges: [],
+            currentIp: '1.2.3.4',
+            currentIpAllowed: null,
+        },
+        failedLogins24h: 0,
+        activeSessions: 1,
+        csrfEnabled: true,
+        uploadValidation: true,
+        auditEnabled: true,
+        ...overrides,
+    };
+}
+describe('computeSecurityStatus', () => {
+    it('reports secure when all controls pass', () => {
+        const status = computeSecurityStatus(baseInput());
+        expect(status.status).toBe('secure');
+        expect(status.score).toBe(100);
+        expect(status.warnings).toHaveLength(0);
+        // Every advertised check is present.
+        const keys = status.checks.map((c) => c.key);
+        expect(keys).toEqual(expect.arrayContaining([
+            'mfa',
+            'sessions',
+            'api_keys',
+            'csrf',
+            'rate_limit',
+            'cms_secret',
+            'audit',
+        ]));
+    });
+    it('is at_risk when CSRF is disabled', () => {
+        const status = computeSecurityStatus(baseInput({ csrfEnabled: false }));
+        expect(status.status).toBe('at_risk');
+        expect(status.warnings.some((w) => w.id === 'csrf-disabled' && w.severity === 'critical')).toBe(true);
+        expect(status.score).toBeLessThan(100);
+    });
+    it('is at_risk when MFA is required but an admin has not enrolled', () => {
+        const status = computeSecurityStatus(baseInput({
+            users: {
+                totalUsers: 3,
+                totalAdmins: 2,
+                withMfa: 1,
+                withoutMfa: 1,
+                adminsWithoutMfa: 1,
+                inactive: 0,
+            },
+        }));
+        expect(status.status).toBe('at_risk');
+        expect(status.warnings.some((w) => w.id === 'mfa-required-gap')).toBe(true);
+        const mfaCheck = status.checks.find((c) => c.key === 'mfa');
+        expect(mfaCheck?.status).toBe('fail');
+    });
+    it('is at_risk in production when CMS_SECRET is missing', () => {
+        const status = computeSecurityStatus(baseInput({ secrets: { ...baseInput().secrets, cmsSecret: 'fail' } }));
+        expect(status.status).toBe('at_risk');
+        expect(status.warnings.some((w) => w.id === 'cms-secret-missing')).toBe(true);
+    });
+    it('needs_attention when MFA is not required in production', () => {
+        const status = computeSecurityStatus(baseInput({
+            settings: {
+                mfa: { required: false, gracePeriodDays: 7 },
+                session: { maxConcurrentSessions: 5 },
+            },
+        }));
+        expect(status.status).toBe('needs_attention');
+        expect(status.warnings.some((w) => w.id === 'mfa-not-required')).toBe(true);
+    });
+    it('warns (not critical) about in-memory rate limiting in production', () => {
+        const status = computeSecurityStatus(baseInput({ secrets: { ...baseInput().secrets, rateLimitBackend: 'in_memory' } }));
+        expect(status.status).toBe('needs_attention');
+        expect(status.warnings.some((w) => w.id === 'rate-limit-in-memory')).toBe(true);
+    });
+    it('is unknown when secret state cannot be determined', () => {
+        const status = computeSecurityStatus(baseInput({ secrets: { ...baseInput().secrets, cmsSecret: 'unknown' } }));
+        expect(status.status).toBe('unknown');
+    });
+    it('flags broad-scope API keys as a failing check', () => {
+        const status = computeSecurityStatus(baseInput({ apiKeys: { active: 2, withoutExpiration: 0, broadScope: 1, staleUnused90d: 0 } }));
+        expect(status.checks.find((c) => c.key === 'api_keys')?.status).toBe('fail');
+        expect(status.warnings.some((w) => w.id === 'api-keys-broad')).toBe(true);
+    });
+});
+describe('validateSecuritySettings', () => {
+    it('accepts valid settings', () => {
+        expect(validateSecuritySettings(DEFAULT_SECURITY_SETTINGS)).toEqual([]);
+    });
+    it('rejects an out-of-range grace period', () => {
+        const issues = validateSecuritySettings({
+            mfa: { required: true, gracePeriodDays: 999 },
+            session: { maxConcurrentSessions: 5 },
+        });
+        expect(issues.some((i) => i.field === 'mfaGracePeriodDays' && i.severity === 'error')).toBe(true);
+    });
+    it('rejects an out-of-range concurrent session cap', () => {
+        const issues = validateSecuritySettings({
+            mfa: { required: false, gracePeriodDays: 0 },
+            session: { maxConcurrentSessions: -1 },
+        });
+        expect(issues.some((i) => i.field === 'maxConcurrentSessions')).toBe(true);
+    });
+});
+describe('parseSecuritySettings', () => {
+    it('returns defaults for an empty blob', () => {
+        expect(parseSecuritySettings({})).toEqual(DEFAULT_SECURITY_SETTINGS);
+    });
+    it('coerces and clamps values', () => {
+        const parsed = parseSecuritySettings({
+            security: {
+                mfa: { required: 'yes', gracePeriodDays: 9999 },
+                session: { maxConcurrentSessions: -5 },
+            },
+        });
+        expect(parsed.mfa.required).toBe(true);
+        expect(parsed.mfa.gracePeriodDays).toBe(365);
+        expect(parsed.session.maxConcurrentSessions).toBe(0);
+    });
+    it('preserves requiredAt when present', () => {
+        const parsed = parseSecuritySettings({
+            security: {
+                mfa: { required: true, gracePeriodDays: 1, requiredAt: '2026-01-01T00:00:00.000Z' },
+            },
+        });
+        expect(parsed.mfa.requiredAt).toBe('2026-01-01T00:00:00.000Z');
+    });
+});
+describe('validateIpRange', () => {
+    it.each([
+        '192.168.1.1',
+        '10.0.0.0/8',
+        '172.16.0.0/12',
+        '0.0.0.0/0',
+        '2001:db8::1',
+        '2001:db8::/32',
+        '::1',
+    ])('accepts %s', (entry) => {
+        expect(validateIpRange(entry)).toBe(true);
+    });
+    it.each(['', 'not-an-ip', '999.1.1.1', '10.0.0.0/33', '1.2.3.4/abc', '2001:db8::/129', '1.2.3'])('rejects %s', (entry) => {
+        expect(validateIpRange(entry)).toBe(false);
+    });
+});
+describe('mfaEnableLockoutError', () => {
+    it('blocks enabling MFA when the acting admin has no MFA', () => {
+        expect(mfaEnableLockoutError({ enabling: true, viewerHasMfa: false, totalAdmins: 1 })).toMatch(/lock yourself out/i);
+    });
+    it('allows enabling when the acting admin has MFA', () => {
+        expect(mfaEnableLockoutError({ enabling: true, viewerHasMfa: true, totalAdmins: 1 })).toBeNull();
+    });
+    it('never blocks when not enabling', () => {
+        expect(mfaEnableLockoutError({ enabling: false, viewerHasMfa: false, totalAdmins: 3 })).toBeNull();
+    });
+});
+describe('summarizeUsers', () => {
+    it('counts admin MFA coverage and inactive accounts', () => {
+        const summary = summarizeUsers([
+            { role: 'ADMIN', isActive: true, totpEnabled: true },
+            { role: 'ADMIN', isActive: true, totpEnabled: false },
+            { role: 'EDITOR', isActive: true, totpEnabled: false },
+            { role: 'ADMIN', isActive: false, totpEnabled: false },
+        ]);
+        expect(summary.totalUsers).toBe(4);
+        expect(summary.totalAdmins).toBe(3);
+        expect(summary.withMfa).toBe(1);
+        expect(summary.adminsWithoutMfa).toBe(1); // inactive admin excluded
+        expect(summary.inactive).toBe(1);
+    });
+});
+describe('summarizeApiKeys', () => {
+    const now = Date.parse('2026-06-01T00:00:00.000Z');
+    it('classifies risk and excludes revoked/expired keys', () => {
+        const summary = summarizeApiKeys([
+            { scopes: { admin: true }, expiresAt: null, lastUsedAt: null, revokedAt: null },
+            {
+                scopes: { media: true },
+                expiresAt: '2026-12-01T00:00:00.000Z',
+                lastUsedAt: '2026-01-01T00:00:00.000Z',
+                revokedAt: null,
+            },
+            {
+                scopes: { media: true },
+                expiresAt: '2020-01-01T00:00:00.000Z',
+                lastUsedAt: null,
+                revokedAt: null,
+            }, // expired
+            {
+                scopes: { admin: true },
+                expiresAt: null,
+                lastUsedAt: null,
+                revokedAt: '2026-01-01T00:00:00.000Z',
+            }, // revoked
+        ], now);
+        expect(summary.active).toBe(2);
+        expect(summary.broadScope).toBe(1);
+        expect(summary.withoutExpiration).toBe(1);
+        expect(summary.staleUnused90d).toBe(1); // key 2 last used > 90d before `now`
+    });
+});
+//# sourceMappingURL=center.test.js.map

package/dist/__tests__/security/center.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"center.test.js","sourceRoot":"","sources":["../../../src/__tests__/security/center.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,wBAAwB,GAEzB,MAAM,gCAAgC,CAAA;AAEvC,SAAS,SAAS,CAAC,YAA0C,EAAE;IAC7D,OAAO;QACL,YAAY,EAAE,IAAI;QAClB,QAAQ,EAAE;YACR,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,EAAE;YAC3C,OAAO,EAAE,EAAE,qBAAqB,EAAE,CAAC,EAAE;SACtC;QACD,KAAK,EAAE;YACL,UAAU,EAAE,CAAC;YACb,WAAW,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;YACV,UAAU,EAAE,CAAC;YACb,gBAAgB,EAAE,CAAC;YACnB,QAAQ,EAAE,CAAC;SACZ;QACD,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE;QAC9E,OAAO,EAAE;YACP,SAAS,EAAE,MAAM;YACjB,aAAa,EAAE,MAAM;YACrB,gBAAgB,EAAE,aAAa;YAC/B,aAAa,EAAE,IAAI;YACnB,uBAAuB,EAAE,IAAI;SAC9B;QACD,WAAW,EAAE;YACX,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,EAAE;YACV,SAAS,EAAE,SAAS;YACpB,gBAAgB,EAAE,IAAI;SACvB;QACD,eAAe,EAAE,CAAC;QAClB,cAAc,EAAE,CAAC;QACjB,WAAW,EAAE,IAAI;QACjB,gBAAgB,EAAE,IAAI;QACtB,YAAY,EAAE,IAAI;QAClB,GAAG,SAAS;KACb,CAAA;AACH,CAAC;AAED,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,EAAE,CAAC,CAAA;QACjD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACpC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC9B,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QACvC,qCAAqC;QACrC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAC5C,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAClB,MAAM,CAAC,eAAe,CAAC;YACrB,KAAK;YACL,UAAU;YACV,UAAU;YACV,MAAM;YACN,YAAY;YACZ,YAAY;YACZ,OAAO;SACR,CAAC,CACH,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;QACvE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACrC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,eAAe,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAC7F,IAAI,CACL,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,MAAM,GAAG,qBAAqB,CAClC,SAAS,CAAC;YACR,KAAK,EAAE;gBACL,UAAU,EAAE,CAAC;gBACb,WAAW,EAAE,CAAC;gBACd,OAAO,EAAE,CAAC;gBACV,UAAU,EAAE,CAAC;gBACb,gBAAgB,EAAE,CAAC;gBACnB,QAAQ,EAAE,CAAC;aACZ;SACF,CAAC,CACH,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACrC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3E,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,CAAA;QAC3D,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,MAAM,GAAG,qBAAqB,CAClC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,SAAS,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CACtE,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACrC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC/E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,MAAM,GAAG,qBAAqB,CAClC,SAAS,CAAC;YACR,QAAQ,EAAE;gBACR,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,EAAE;gBAC5C,OAAO,EAAE,EAAE,qBAAqB,EAAE,CAAC,EAAE;aACtC;SACF,CAAC,CACH,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;QAC7C,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC7E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,MAAM,GAAG,qBAAqB,CAClC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,SAAS,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,EAAE,CAAC,CAClF,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;QAC7C,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACjF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,MAAM,GAAG,qBAAqB,CAClC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,SAAS,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,CACzE,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,MAAM,GAAG,qBAAqB,CAClC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,EAAE,CAAC,CAC9F,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC5E,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC3E,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,MAAM,CAAC,wBAAwB,CAAC,yBAAyB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACzE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,MAAM,GAAG,wBAAwB,CAAC;YACtC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE;YAC7C,OAAO,EAAE,EAAE,qBAAqB,EAAE,CAAC,EAAE;SACtC,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,oBAAoB,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CACzF,IAAI,CACL,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,MAAM,GAAG,wBAAwB,CAAC;YACtC,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,EAAE;YAC5C,OAAO,EAAE,EAAE,qBAAqB,EAAE,CAAC,CAAC,EAAE;SACvC,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC5E,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAA;IACtE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,MAAM,GAAG,qBAAqB,CAAC;YACnC,QAAQ,EAAE;gBACR,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE;gBAC/C,OAAO,EAAE,EAAE,qBAAqB,EAAE,CAAC,CAAC,EAAE;aACvC;SACF,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACtC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACtD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,MAAM,GAAG,qBAAqB,CAAC;YACnC,QAAQ,EAAE;gBACR,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,EAAE,UAAU,EAAE,0BAA0B,EAAE;aACpF;SACF,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,IAAI,CAAC;QACN,aAAa;QACb,YAAY;QACZ,eAAe;QACf,WAAW;QACX,aAAa;QACb,eAAe;QACf,KAAK;KACN,CAAC,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE;QACzB,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC3C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAC9F,YAAY,EACZ,CAAC,KAAK,EAAE,EAAE;QACR,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC5C,CAAC,CACF,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,CAAC,qBAAqB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAC5F,oBAAoB,CACrB,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,qBAAqB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;IAClG,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CACJ,qBAAqB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAChF,CAAC,QAAQ,EAAE,CAAA;IACd,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,OAAO,GAAG,cAAc,CAAC;YAC7B,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE;YACpD,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;YACrD,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;YACtD,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE;SACvD,CAAC,CAAA;QACF,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAClC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACnC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC/B,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA,CAAC,0BAA0B;QACnE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAA;IAElD,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,OAAO,GAAG,gBAAgB,CAC9B;YACE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;YAC/E;gBACE,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;gBACvB,SAAS,EAAE,0BAA0B;gBACrC,UAAU,EAAE,0BAA0B;gBACtC,SAAS,EAAE,IAAI;aAChB;YACD;gBACE,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;gBACvB,SAAS,EAAE,0BAA0B;gBACrC,UAAU,EAAE,IAAI;gBAChB,SAAS,EAAE,IAAI;aAChB,EAAE,UAAU;YACb;gBACE,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;gBACvB,SAAS,EAAE,IAAI;gBACf,UAAU,EAAE,IAAI;gBAChB,SAAS,EAAE,0BAA0B;aACtC,EAAE,UAAU;SACd,EACD,GAAG,CACJ,CAAA;QACD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC9B,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAClC,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACzC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA,CAAC,qCAAqC;IAC9E,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/api/handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/api/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AA+/B5C,iFAAiF;AACjF,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AA8JD,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAS9E;AAyRD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAwxUzD"}
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/api/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AA+/B5C,iFAAiF;AACjF,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AA8JD,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAS9E;AAiTD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAi/UzD"}

package/dist/api/handlers.js

@@ -33,7 +33,7 @@ import { sendFormNotifications } from '../forms/notify.js';
 import { checkForUpdates } from '../upgrade/version-check.js';
 import { createUpgradePR } from '../upgrade/upgrade-pr.js';
 import { encryptField, decryptField } from '../security/encrypted-fields.js';
-import { encryptSecret, decryptSecret, encryptStringArray, } from '../security/secret-storage.js';
+import { encryptSecret, decryptSecret, encryptStringArray, decryptStringArray, } from '../security/secret-storage.js';
 import { createRateLimiter } from '../security/rate-limit.js';
 import { generateOpenAPISpec } from './openapi.js';
 import { createSSEPresenceAdapter } from '../presence/index.js';
@@ -1133,10 +1133,34 @@ const MAX_CONCURRENT_SESSIONS = 5;
 async function enforceSessionLimitsForUser(d, userId) {
     if (!hasModel(d, 'session'))
         return;
+    // Precedence: explicitly-saved Security setting (database) ▸ auth config ▸
+    // default. We read the stored value directly (rather than the parsed
+    // defaults) so an unsaved policy doesn't shadow a config-provided override.
+    let storedMax;
+    try {
+        if (hasModel(d, 'document')) {
+            const row = await d.document.findFirst({
+                where: { collection: 'settings', deletedAt: null },
+                select: { data: true },
+            });
+            const stored = row?.data?.security;
+            const v = stored?.session?.maxConcurrentSessions;
+            if (typeof v === 'number' && Number.isInteger(v) && v >= 0)
+                storedMax = v;
+        }
+    }
+    catch {
+        /* fall back to config/default below */
+    }
     const auth = getActuateConfig()?.auth;
-    const max = typeof auth?.maxConcurrentSessions === 'number' && auth.maxConcurrentSessions > 0
-        ? auth.maxConcurrentSessions
-        : MAX_CONCURRENT_SESSIONS;
+    const max = storedMax !== undefined
+        ? storedMax
+        : typeof auth?.maxConcurrentSessions === 'number' && auth.maxConcurrentSessions > 0
+            ? auth.maxConcurrentSessions
+            : MAX_CONCURRENT_SESSIONS;
+    // 0 ⇒ unlimited: skip pruning entirely.
+    if (max <= 0)
+        return;
     const active = await d.session.findMany({
         where: { userId, revokedAt: null, expiresAt: { gt: new Date() } },
         select: { id: true, createdAt: true },
@@ -1445,10 +1469,29 @@ export function registerCMSRoutes(router) {
                     userAgent: userAgent ?? null,
                 },
             });
+            // Surface whether org-wide MFA is required but this account hasn't
+            // enrolled yet (past its grace window). The admin shell uses this to
+            // prompt enrollment. Computed best-effort; never blocks login (the
+            // account can still set up TOTP from inside the admin).
+            let mfaSetupRequired = false;
+            try {
+                const { getStoredSecuritySettings } = await import('../security/center/gather.js');
+                const sec = await getStoredSecuritySettings(d);
+                if (sec.mfa.required && !user.totpEnabled) {
+                    const graceMs = sec.mfa.gracePeriodDays * 24 * 60 * 60 * 1000;
+                    const requiredAt = sec.mfa.requiredAt ? Date.parse(sec.mfa.requiredAt) : 0;
+                    const createdAt = user.createdAt ? new Date(user.createdAt).getTime() : 0;
+                    mfaSetupRequired = Date.now() >= Math.max(requiredAt || 0, createdAt || 0) + graceMs;
+                }
+            }
+            catch {
+                /* policy unavailable — do not block login */
+            }
             const response = json({
                 data: {
                     token,
                     user: { id: user.id, email: user.email, name: user.name, role: user.role },
+                    mfaSetupRequired,
                 },
             });
             const isProduction = process.env.NODE_ENV === 'production';
@@ -1698,7 +1741,14 @@ export function registerCMSRoutes(router) {
                 return auth.error;
             const user = await db().user.findUnique({
                 where: { id: auth.session.userId },
-                select: { id: true, email: true, name: true, role: true, isActive: true },
+                select: {
+                    id: true,
+                    email: true,
+                    name: true,
+                    role: true,
+                    isActive: true,
+                    totpEnabled: true,
+                },
             });
             if (!user) {
                 return errorResponse('User not found', 404);
@@ -1872,6 +1922,7 @@ export function registerCMSRoutes(router) {
                     role: true,
                     totpSecret: true,
                     totpEnabled: true,
+                    backupCodes: true,
                     isActive: true,
                 },
             });
@@ -1879,7 +1930,34 @@ export function registerCMSRoutes(router) {
                 return errorResponse('Invalid request', 400);
             }
             const decryptedSecret = await decryptSecret(user.totpSecret);
-            const valid = verifyTOTP(body.code, decryptedSecret);
+            let valid = verifyTOTP(body.code, decryptedSecret);
+            let usedBackupCode = false;
+            // Backup-code fallback. A user who has lost their authenticator can sign
+            // in with one of the one-time recovery codes issued at enrollment. Each
+            // code is single-use: on a match we remove it and re-persist the
+            // remaining codes so it can never be replayed. We compare against every
+            // stored code in constant time to avoid leaking which/whether one matched.
+            const storedBackups = Array.isArray(user.backupCodes) ? user.backupCodes : [];
+            if (!valid && storedBackups.length > 0) {
+                try {
+                    const { findBackupCodeMatch } = await import('../auth/totp.js');
+                    const codes = await decryptStringArray(storedBackups);
+                    const matchIdx = findBackupCodeMatch(codes, body.code);
+                    if (matchIdx !== -1) {
+                        valid = true;
+                        usedBackupCode = true;
+                        const remaining = codes.filter((_, i) => i !== matchIdx);
+                        await db().user.update({
+                            where: { id: user.id },
+                            data: { backupCodes: await encryptStringArray(remaining) },
+                        });
+                    }
+                }
+                catch {
+                    // Decryption failure (e.g. the encryption key was rotated) — treat
+                    // as no match rather than throwing a 500 at the login screen.
+                }
+            }
             if (!valid) {
                 await logEvent({
                     event: 'login_failed',
@@ -1909,7 +1987,7 @@ export function registerCMSRoutes(router) {
                 userId: user.id,
                 ipAddress: isResolvedIp(ip) ? ip : undefined,
                 userAgent: userAgent ?? undefined,
-                details: { mfa: 'totp' },
+                details: { mfa: usedBackupCode ? 'backup_code' : 'totp' },
             });
             const isProduction = process.env.NODE_ENV === 'production';
             const sessionCookie = [
@@ -8949,6 +9027,160 @@ export function registerCMSRoutes(router) {
             return internalError(err, 'appearance GET');
         }
     });
+    // ---------------------------------------------------------------------------
+    // Security Center
+    //   GET  /security                       — computed posture + summaries
+    //   PUT  /security                        — persist enforced policy (lockout-safe)
+    //   POST /security/sessions/revoke-all    — revoke the caller's other sessions
+    // ---------------------------------------------------------------------------
+    router.get('/security', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const adminErr = requireAdminScope(auth.session);
+            if (adminErr)
+                return adminErr;
+            const { getSecurityCenterData } = await import('../security/center/gather.js');
+            const data = await getSecurityCenterData({
+                db: db(),
+                userId: auth.session.userId,
+                currentIp: getClientIp(request),
+            });
+            return json({ data });
+        }
+        catch (err) {
+            return internalError(err, 'security GET');
+        }
+    });
+    router.put('/security', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const adminErr = requireAdminScope(auth.session);
+            if (adminErr)
+                return adminErr;
+            const body = (await request.json());
+            const { parseSecuritySettings, validateSecuritySettings, mfaEnableLockoutError } = await import('../security/center/settings.js');
+            const { getStoredSecuritySettings, getSecurityCenterData } = await import('../security/center/gather.js');
+            const incoming = parseSecuritySettings({ security: body });
+            const issues = validateSecuritySettings(incoming);
+            const errors = issues.filter((i) => i.severity === 'error');
+            if (errors.length > 0) {
+                return json({ error: errors[0].message, issues }, 400);
+            }
+            const d = db();
+            const current = await getStoredSecuritySettings(d);
+            // Lockout-safe: enabling org-wide MFA requires the acting admin to have
+            // their own MFA configured. Enforced server-side — never trust the client.
+            const enabling = incoming.mfa.required && !current.mfa.required;
+            if (enabling) {
+                let viewerHasMfa = false;
+                let totalAdmins = 0;
+                if (hasModel(d, 'user')) {
+                    const viewer = await d.user
+                        .findUnique({ where: { id: auth.session.userId }, select: { totpEnabled: true } })
+                        .catch(() => null);
+                    viewerHasMfa = Boolean(viewer?.totpEnabled);
+                    totalAdmins = await d.user
+                        .count({ where: { role: 'ADMIN', isActive: true } })
+                        .catch(() => 0);
+                }
+                const lockErr = mfaEnableLockoutError({ enabling: true, viewerHasMfa, totalAdmins });
+                if (lockErr) {
+                    return json({ error: lockErr, code: 'MFA_LOCKOUT_RISK' }, 409);
+                }
+            }
+            // Stamp `requiredAt` when MFA requirement flips on (drives the grace
+            // window); preserve it across saves while it stays on; clear when off.
+            const requiredAt = incoming.mfa.required
+                ? current.mfa.required
+                    ? current.mfa.requiredAt
+                    : new Date().toISOString()
+                : undefined;
+            const securityBlob = {
+                mfa: {
+                    required: incoming.mfa.required,
+                    gracePeriodDays: incoming.mfa.gracePeriodDays,
+                    ...(requiredAt ? { requiredAt } : {}),
+                },
+                session: { maxConcurrentSessions: incoming.session.maxConcurrentSessions },
+                updatedAt: new Date().toISOString(),
+                updatedBy: auth.session.userId,
+            };
+            const ctx = buildActionContext(auth.session, d);
+            const prevGlobal = (await getGlobal('settings', ctx).catch(() => ({}))) ?? {};
+            await updateGlobal('settings', { ...prevGlobal, security: securityBlob }, ctx);
+            const changes = [];
+            if (current.mfa.required !== incoming.mfa.required)
+                changes.push({ key: 'mfa.required', from: current.mfa.required, to: incoming.mfa.required });
+            if (current.mfa.gracePeriodDays !== incoming.mfa.gracePeriodDays)
+                changes.push({
+                    key: 'mfa.gracePeriodDays',
+                    from: current.mfa.gracePeriodDays,
+                    to: incoming.mfa.gracePeriodDays,
+                });
+            if (current.session.maxConcurrentSessions !== incoming.session.maxConcurrentSessions)
+                changes.push({
+                    key: 'session.maxConcurrentSessions',
+                    from: current.session.maxConcurrentSessions,
+                    to: incoming.session.maxConcurrentSessions,
+                });
+            if (changes.length > 0) {
+                void logEvent({
+                    event: 'security_settings_changed',
+                    userId: auth.session.userId,
+                    ipAddress: getClientIp(request),
+                    details: {
+                        source: 'database',
+                        environment: process.env.VERCEL_ENV ?? process.env.NODE_ENV ?? null,
+                        changes,
+                    },
+                });
+            }
+            const data = await getSecurityCenterData({
+                db: d,
+                userId: auth.session.userId,
+                currentIp: getClientIp(request),
+            });
+            return json({ data });
+        }
+        catch (err) {
+            return internalError(err, 'security PUT');
+        }
+    });
+    router.post('/security/sessions/revoke-all', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const d = db();
+            if (!hasModel(d, 'session'))
+                return json({ data: { revoked: 0 } });
+            // Revoke every OTHER active session for the caller — their current
+            // session stays valid so they aren't logged out of the admin they're in.
+            const result = await d.session.updateMany({
+                where: {
+                    userId: auth.session.userId,
+                    id: { not: auth.session.sessionId },
+                    revokedAt: null,
+                },
+                data: { revokedAt: new Date() },
+            });
+            const revoked = typeof result?.count === 'number' ? result.count : 0;
+            void logEvent({
+                event: 'sessions_revoked_all',
+                userId: auth.session.userId,
+                ipAddress: getClientIp(request),
+                details: { count: revoked, scope: 'self_other' },
+            });
+            return json({ data: { revoked } });
+        }
+        catch (err) {
+            return internalError(err, 'security/sessions/revoke-all');
+        }
+    });
     router.get('/globals/:slug', async (request, params) => {
         try {
             const auth = await requireAuth(request);
@@ -9004,7 +9236,7 @@ export function registerCMSRoutes(router) {
             try {
                 const changes = diffScalarKeys(previous ?? {}, body);
                 const prev = (previous ?? {});
-                for (const key of ['appearance', 'brand']) {
+                for (const key of ['appearance', 'brand', 'security']) {
                     if (key in body && JSON.stringify(prev[key]) !== JSON.stringify(body[key])) {
                         changes.push({ key, from: '[changed]', to: '[changed]' });
                     }