@endora-commerce/mod-admin-users 0.100.0

package/dist/backend/routes.impersonation.js

@@ -0,0 +1,108 @@
+import { ADMIN_SESSION_COOKIE_NAME, ERROR_CODES, SESSION_COOKIE_NAME, impersonationRequestSchema, } from '@endora-commerce/contracts';
+import { HttpError } from '@endora-commerce/platform/http';
+/**
+ * Admin impersonation routes (T191).
+ *
+ * - POST /admin/organizations/:id/impersonate — admin starts impersonation of
+ *   a customer in the target Organization. Audit row written BEFORE the
+ *   cookie is set (T179). Two cookies are issued: the new b2b_session for
+ *   the impersonation, and admin_shadow_session preserving the original
+ *   admin session value so end can restore it.
+ * - POST /admin/impersonation/end — destroys the impersonation session,
+ *   restores the admin session from admin_shadow_session, writes the
+ *   impersonation.end audit row.
+ */
+const ADMIN_SHADOW_COOKIE = 'admin_shadow_session';
+export async function registerImpersonationRoutes(app, deps) {
+    const { impersonationService, requireAdmin, resolveAdminUserId } = deps;
+    app.post('/api/v1/admin/organizations/:id/impersonate', {
+        preHandler: requireAdmin('customers:impersonate'),
+        schema: { body: impersonationRequestSchema },
+    }, async (request, reply) => {
+        const body = impersonationRequestSchema.parse(request.body);
+        const adminId = resolveAdminUserId(request);
+        const cookies = request.cookies;
+        // The admin's own session lives in the dedicated admin cookie; fall back to
+        // the legacy customer-cookie name so older sessions / test stubs still work.
+        const adminCookie = cookies?.[ADMIN_SESSION_COOKIE_NAME] ?? cookies?.[SESSION_COOKIE_NAME] ?? '';
+        // For tests, the stub-admin-session cookie isn't a real session value —
+        // we treat the entire raw cookie as the shadow regardless. End() will
+        // refuse to restore a stub cookie that no longer resolves.
+        const result = await impersonationService.start({
+            adminUserId: adminId,
+            adminSessionCookieValue: adminCookie,
+            customerAccountId: body.customerAccountId,
+            organizationId: request.params.id,
+            ...(body.reason !== undefined ? { reason: body.reason } : {}),
+            ...(request.ip ? { ip: request.ip } : {}),
+            ...(typeof request.headers['user-agent'] === 'string'
+                ? { userAgent: request.headers['user-agent'] }
+                : {}),
+            requestId: request.id,
+        });
+        setSessionCookie(reply, result.impersonationCookieValue, result.impersonationExpiresAt);
+        reply.setCookie(ADMIN_SHADOW_COOKIE, result.adminShadowSessionCookieValue, {
+            path: '/',
+            httpOnly: true,
+            sameSite: 'lax',
+            secure: process.env['NODE_ENV'] === 'production',
+            expires: result.impersonationExpiresAt,
+            signed: false,
+        });
+        return {
+            data: {
+                impersonationSessionId: result.impersonationSessionId,
+                impersonatedCustomerAccount: {
+                    id: result.impersonatedCustomerAccount.id,
+                    email: result.impersonatedCustomerAccount.email,
+                    firstName: result.impersonatedCustomerAccount.firstName,
+                    lastName: result.impersonatedCustomerAccount.lastName,
+                    role: result.impersonatedCustomerAccount.role,
+                },
+            },
+        };
+    });
+    app.post('/api/v1/admin/impersonation/end', async (request, reply) => {
+        const cookies = request.cookies;
+        const impersonationCookie = cookies?.[SESSION_COOKIE_NAME];
+        const shadow = cookies?.[ADMIN_SHADOW_COOKIE];
+        if (!impersonationCookie || !shadow) {
+            throw new HttpError(401, ERROR_CODES.UNAUTHORIZED, 'No impersonation session active.');
+        }
+        const result = await impersonationService.end({
+            impersonationSessionCookieValue: impersonationCookie,
+            adminShadowCookieValue: shadow,
+            ...(request.ip ? { ip: request.ip } : {}),
+            ...(typeof request.headers['user-agent'] === 'string'
+                ? { userAgent: request.headers['user-agent'] }
+                : {}),
+            requestId: request.id,
+        });
+        // Restore the admin session into the admin cookie and drop the impersonation
+        // session from the customer cookie, so ending impersonation leaves the admin
+        // signed in to the Admin UI but no longer acting as the customer.
+        setAdminSessionCookie(reply, result.adminSessionCookieValue, result.adminSessionExpiresAt);
+        reply.clearCookie(SESSION_COOKIE_NAME, { path: '/' });
+        reply.clearCookie(ADMIN_SHADOW_COOKIE, { path: '/' });
+        return { data: { restored: true } };
+    });
+}
+/** Set the impersonation (customer-scoped) session in the customer cookie. */
+function setSessionCookie(reply, value, expiresAt) {
+    setCookie(reply, SESSION_COOKIE_NAME, value, expiresAt);
+}
+/** Set the admin session in the dedicated admin cookie. */
+function setAdminSessionCookie(reply, value, expiresAt) {
+    setCookie(reply, ADMIN_SESSION_COOKIE_NAME, value, expiresAt);
+}
+function setCookie(reply, name, value, expiresAt) {
+    reply.setCookie(name, value, {
+        path: '/',
+        httpOnly: true,
+        sameSite: 'lax',
+        secure: process.env['NODE_ENV'] === 'production',
+        expires: expiresAt,
+        signed: false,
+    });
+}
+//# sourceMappingURL=routes.impersonation.js.map

package/dist/backend/routes.impersonation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.impersonation.js","sourceRoot":"","sources":["../../src/backend/routes.impersonation.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,yBAAyB,EACzB,WAAW,EACX,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAI3D;;;;;;;;;;;GAWG;AAEH,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AAuBnD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,GAAoB,EACpB,IAAuB;IAEvB,MAAM,EAAE,oBAAoB,EAAE,YAAY,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC;IAExE,GAAG,CAAC,IAAI,CACN,6CAA6C,EAC7C;QACE,UAAU,EAAE,YAAY,CAAC,uBAAuB,CAAC;QACjD,MAAM,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE;KAC7C,EACD,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,0BAA0B,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAE5C,MAAM,OAAO,GAAI,OAA4D,CAAC,OAAO,CAAC;QACtF,4EAA4E;QAC5E,6EAA6E;QAC7E,MAAM,WAAW,GACf,OAAO,EAAE,CAAC,yBAAyB,CAAC,IAAI,OAAO,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC;QAC/E,wEAAwE;QACxE,sEAAsE;QACtE,2DAA2D;QAE3D,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC;YAC9C,WAAW,EAAE,OAAO;YACpB,uBAAuB,EAAE,WAAW;YACpC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE;YACjC,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,OAAO,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,QAAQ;gBACnD,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE;gBAC9C,CAAC,CAAC,EAAE,CAAC;YACP,SAAS,EAAE,OAAO,CAAC,EAAE;SACtB,CAAC,CAAC;QAEH,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAAC,sBAAsB,CAAC,CAAC;QACxF,KAAK,CAAC,SAAS,CAAC,mBAAmB,EAAE,MAAM,CAAC,6BAA6B,EAAE;YACzE,IAAI,EAAE,GAAG;YACT,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY;YAChD,OAAO,EAAE,MAAM,CAAC,sBAAsB;YACtC,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QAEH,OAAO;YACL,IAAI,EAAE;gBACJ,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;gBACrD,2BAA2B,EAAE;oBAC3B,EAAE,EAAE,MAAM,CAAC,2BAA2B,CAAC,EAAE;oBACzC,KAAK,EAAE,MAAM,CAAC,2BAA2B,CAAC,KAAK;oBAC/C,SAAS,EAAE,MAAM,CAAC,2BAA2B,CAAC,SAAS;oBACvD,QAAQ,EAAE,MAAM,CAAC,2BAA2B,CAAC,QAAQ;oBACrD,IAAI,EAAE,MAAM,CAAC,2BAA2B,CAAC,IAAI;iBAC9C;aACF;SACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CAAC,iCAAiC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACnE,MAAM,OAAO,GAAI,OAA4D,CAAC,OAAO,CAAC;QACtF,MAAM,mBAAmB,GAAG,OAAO,EAAE,CAAC,mBAAmB,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC,mBAAmB,CAAC,CAAC;QAC9C,IAAI,CAAC,mBAAmB,IAAI,CAAC,MAAM,EAAE,CAAC;YACpC,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,YAAY,EAAE,kCAAkC,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC;YAC5C,+BAA+B,EAAE,mBAAmB;YACpD,sBAAsB,EAAE,MAAM;YAC9B,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,OAAO,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,QAAQ;gBACnD,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE;gBAC9C,CAAC,CAAC,EAAE,CAAC;YACP,SAAS,EAAE,OAAO,CAAC,EAAE;SACtB,CAAC,CAAC;QAEH,6EAA6E;QAC7E,6EAA6E;QAC7E,kEAAkE;QAClE,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC,qBAAqB,CAAC,CAAC;QAC3F,KAAK,CAAC,WAAW,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QACtD,KAAK,CAAC,WAAW,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QACtD,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,SAAS,gBAAgB,CAAC,KAAmB,EAAE,KAAa,EAAE,SAAe;IAC3E,SAAS,CAAC,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;AAC1D,CAAC;AAED,2DAA2D;AAC3D,SAAS,qBAAqB,CAAC,KAAmB,EAAE,KAAa,EAAE,SAAe;IAChF,SAAS,CAAC,KAAK,EAAE,yBAAyB,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,SAAS,CAAC,KAAmB,EAAE,IAAY,EAAE,KAAa,EAAE,SAAe;IAClF,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE;QAC3B,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY;QAChD,OAAO,EAAE,SAAS;QAClB,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;AACL,CAAC"}

package/dist/backend/routes.public.d.ts

@@ -0,0 +1,20 @@
+import type { FastifyInstance } from 'fastify';
+import type { AdminAuthService } from './services/admin-auth-service.js';
+import type { TwoFactorEnrolmentReader } from './services/two-factor-enrolments.js';
+/**
+ * Anonymous admin endpoints — login + logout. The admin surface is otherwise
+ * gated by `requireAdmin` in each module's admin routes.
+ */
+export interface AdminPublicDeps {
+    adminAuthService: AdminAuthService;
+    /**
+     * `mfa`'s answer to "does this admin hold a second factor". The login
+     * response carries `twoFactorEnabled`, and it used to carry
+     * `!!a.twoFactorConfirmedAt` — a column nothing writes — so the Admin UI's
+     * auth context has always seen `false` for an admin who had just satisfied a
+     * TOTP challenge two steps earlier.
+     */
+    twoFactorEnrolments: TwoFactorEnrolmentReader;
+}
+export declare function registerAdminPublicRoutes(app: FastifyInstance, deps: AdminPublicDeps): Promise<void>;
+//# sourceMappingURL=routes.public.d.ts.map

package/dist/backend/routes.public.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.public.d.ts","sourceRoot":"","sources":["../../src/backend/routes.public.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,eAAe,EAAgB,MAAM,SAAS,CAAC;AAE7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAEzE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAEpF;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,gBAAgB,EAAE,gBAAgB,CAAC;IACnC;;;;;;OAMG;IACH,mBAAmB,EAAE,wBAAwB,CAAC;CAC/C;AAED,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,IAAI,CAAC,CAmDf"}

package/dist/backend/routes.public.js

@@ -0,0 +1,75 @@
+import { ADMIN_SESSION_COOKIE_NAME, adminLoginRequestSchema } from '@endora-commerce/contracts';
+export async function registerAdminPublicRoutes(app, deps) {
+    const { adminAuthService, twoFactorEnrolments } = deps;
+    async function serializeOneAdminUser(user) {
+        const enrolled = await twoFactorEnrolments([user.id]);
+        return serializeAdminUser(user, enrolled.has(user.id));
+    }
+    app.post('/api/v1/auth/admin/login', { schema: { body: adminLoginRequestSchema } }, async (request, reply) => {
+        const body = adminLoginRequestSchema.parse(request.body);
+        const result = await adminAuthService.login({
+            email: body.email,
+            password: body.password,
+            ...(request.ip ? { ip: request.ip } : {}),
+            ...(typeof request.headers['user-agent'] === 'string'
+                ? { userAgent: request.headers['user-agent'] }
+                : {}),
+        });
+        // Feature 042 — two-step login (no session cookie until the second step).
+        if (result.status === 'mfaRequired') {
+            return { data: { status: 'mfaRequired', challengeId: result.challengeId } };
+        }
+        if (result.status === 'mfaSetupRequired') {
+            return { data: { status: 'mfaSetupRequired', setupTicket: result.setupTicket } };
+        }
+        setSessionCookie(reply, result.sessionCookieValue, result.sessionExpiresAt);
+        return {
+            data: {
+                status: 'authenticated',
+                adminUser: await serializeOneAdminUser(result.adminUser),
+            },
+        };
+    });
+    app.post('/api/v1/auth/admin/logout', async (request, reply) => {
+        const cookies = request.cookies;
+        const raw = cookies?.[ADMIN_SESSION_COOKIE_NAME];
+        if (raw) {
+            const dot = raw.indexOf('.');
+            if (dot !== -1) {
+                const sessionId = raw.slice(0, dot);
+                if (sessionId)
+                    await adminAuthService.logout(sessionId);
+            }
+        }
+        reply.clearCookie(ADMIN_SESSION_COOKIE_NAME, { path: '/' });
+        return reply.status(204).send();
+    });
+}
+function setSessionCookie(reply, value, expiresAt) {
+    reply.setCookie(ADMIN_SESSION_COOKIE_NAME, value, {
+        path: '/',
+        httpOnly: true,
+        sameSite: 'lax',
+        secure: process.env['NODE_ENV'] === 'production',
+        expires: expiresAt,
+        signed: false,
+    });
+}
+function serializeAdminUser(a, twoFactorEnabled) {
+    return {
+        id: a.id,
+        email: a.email,
+        firstName: a.firstName,
+        lastName: a.lastName,
+        adminRoleId: a.adminRoleId ?? null,
+        twoFactorEnabled,
+        status: a.status,
+        // Feature 019: surface the per-user Admin UI language preference so the
+        // SPA's TranslationProvider can seed itself without a separate fetch.
+        preferredLanguage: a.preferredLanguage ?? null,
+        lastLoginAt: a.lastLoginAt?.toISOString() ?? null,
+        createdAt: a.createdAt.toISOString(),
+        updatedAt: a.updatedAt.toISOString(),
+    };
+}
+//# sourceMappingURL=routes.public.js.map

package/dist/backend/routes.public.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.public.js","sourceRoot":"","sources":["../../src/backend/routes.public.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAqBhG,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,GAAoB,EACpB,IAAqB;IAErB,MAAM,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,GAAG,IAAI,CAAC;IAEvD,KAAK,UAAU,qBAAqB,CAAC,IAAe;QAClD,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACtD,OAAO,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,GAAG,CAAC,IAAI,CACN,0BAA0B,EAC1B,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,EAAE,EAC7C,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC;YAC1C,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,OAAO,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,QAAQ;gBACnD,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE;gBAC9C,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,0EAA0E;QAC1E,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YACpC,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;QAC9E,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;YACzC,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;QACnF,CAAC;QACD,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC5E,OAAO;YACL,IAAI,EAAE;gBACJ,MAAM,EAAE,eAAe;gBACvB,SAAS,EAAE,MAAM,qBAAqB,CAAC,MAAM,CAAC,SAAS,CAAC;aACzD;SACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC7D,MAAM,OAAO,GAAI,OAA4D,CAAC,OAAO,CAAC;QACtF,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC,yBAAyB,CAAC,CAAC;QACjD,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;gBACf,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBACpC,IAAI,SAAS;oBAAE,MAAM,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,yBAAyB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5D,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAmB,EAAE,KAAa,EAAE,SAAe;IAC3E,KAAK,CAAC,SAAS,CAAC,yBAAyB,EAAE,KAAK,EAAE;QAChD,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY;QAChD,OAAO,EAAE,SAAS;QAClB,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAY,EAAE,gBAAyB;IACjE,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;QAClC,gBAAgB;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,wEAAwE;QACxE,sEAAsE;QACtE,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,IAAI,IAAI;QAC9C,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,IAAI;QACjD,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;QACpC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;KACrC,CAAC;AACJ,CAAC"}

package/dist/backend/services/admin-auth-service.d.ts

@@ -0,0 +1,47 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import { type AuthSessionPort, type MfaLoginPort } from '@endora-commerce/contracts';
+import { AdminUser } from '../entities/admin-user.entity.js';
+import type { AuditPort } from '@endora-commerce/platform/kernel';
+/**
+ * AdminAuthService (T186; two-step login added in feature 042). login →
+ * first factor; when an `MfaLoginPort` is injected and the admin has active
+ * 2FA (or 2FA is enforced) it returns `mfaRequired` / `mfaSetupRequired`
+ * without a session. Absent port ⇒ password-only (FR-033).
+ */
+export interface AdminLoginResult {
+    adminUser: AdminUser;
+    sessionCookieValue: string;
+    sessionExpiresAt: Date;
+}
+/** Discriminated outcome of the first admin login step (feature 042). */
+export type AdminLoginOutcome = ({
+    status: 'authenticated';
+} & AdminLoginResult) | {
+    status: 'mfaRequired';
+    challengeId: string;
+} | {
+    status: 'mfaSetupRequired';
+    setupTicket: string;
+};
+export declare class AdminAuthService {
+    private readonly emFactory;
+    /** `auth`'s published session surface (feature 075, Phase C). */
+    private readonly sessionPort;
+    /** Lazily resolved so composition can late-bind the MFA module. */
+    private readonly getMfaLoginPort?;
+    private readonly auditLog?;
+    constructor(emFactory: () => EntityManager, 
+    /** `auth`'s published session surface (feature 075, Phase C). */
+    sessionPort: AuthSessionPort, 
+    /** Lazily resolved so composition can late-bind the MFA module. */
+    getMfaLoginPort?: (() => MfaLoginPort | undefined) | undefined, auditLog?: AuditPort | undefined);
+    login(input: {
+        email: string;
+        password: string;
+        ip?: string;
+        userAgent?: string;
+    }): Promise<AdminLoginOutcome>;
+    changePassword(adminUserId: string, currentPassword: string, newPassword: string): Promise<void>;
+    logout(sessionId: string): Promise<void>;
+}
+//# sourceMappingURL=admin-auth-service.d.ts.map

package/dist/backend/services/admin-auth-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-auth-service.d.ts","sourceRoot":"","sources":["../../../src/backend/services/admin-auth-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,YAAY,EAClB,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAE7D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAElE;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,SAAS,CAAC;IACrB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,IAAI,CAAC;CACxB;AAED,yEAAyE;AACzE,MAAM,MAAM,iBAAiB,GACzB,CAAC;IAAE,MAAM,EAAE,eAAe,CAAA;CAAE,GAAG,gBAAgB,CAAC,GAChD;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,MAAM,EAAE,kBAAkB,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAExD,qBAAa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,iEAAiE;IACjE,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBALT,SAAS,EAAE,MAAM,aAAa;IAC/C,iEAAiE;IAChD,WAAW,EAAE,eAAe;IAC7C,mEAAmE;IAClD,eAAe,CAAC,GAAE,MAAM,YAAY,GAAG,SAAS,aAAA,EAChD,QAAQ,CAAC,EAAE,SAAS,YAAA;IAGjC,KAAK,CAAC,KAAK,EAAE;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAoDxB,cAAc,CAClB,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,MAAM,EACvB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC;IA2BV,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAG/C"}

package/dist/backend/services/admin-auth-service.js

@@ -0,0 +1,93 @@
+import { ERROR_CODES, normalizeEmailAddress, } from '@endora-commerce/contracts';
+import { HttpError } from '@endora-commerce/platform/http';
+import { hashPassword, verifyPassword } from '@endora-commerce/platform/kernel';
+import { AdminUser } from '../entities/admin-user.entity.js';
+import { recordAuditFromContext } from '@endora-commerce/platform/commands';
+export class AdminAuthService {
+    emFactory;
+    sessionPort;
+    getMfaLoginPort;
+    auditLog;
+    constructor(emFactory, 
+    /** `auth`'s published session surface (feature 075, Phase C). */
+    sessionPort, 
+    /** Lazily resolved so composition can late-bind the MFA module. */
+    getMfaLoginPort, auditLog) {
+        this.emFactory = emFactory;
+        this.sessionPort = sessionPort;
+        this.getMfaLoginPort = getMfaLoginPort;
+        this.auditLog = auditLog;
+    }
+    async login(input) {
+        const em = this.emFactory();
+        // The address is folded before it is compared, because it was folded before
+        // it was stored: Postgres' `=` on `text` is case-sensitive, so an operator
+        // created as `Operator.Mixed@example.com` matched no row when they typed the
+        // address they were handed, and the refusal below says nothing about
+        // casing. `normalizeEmailAddress` is the same fold the write applies.
+        const admin = await em.findOne(AdminUser, {
+            email: normalizeEmailAddress(input.email),
+            deletedAt: null,
+        });
+        if (!admin || admin.status !== 'active') {
+            throw new HttpError(401, ERROR_CODES.UNAUTHORIZED, 'Invalid email or password.');
+        }
+        const ok = await verifyPassword(admin.passwordHash, input.password);
+        if (!ok) {
+            throw new HttpError(401, ERROR_CODES.UNAUTHORIZED, 'Invalid email or password.');
+        }
+        // Second factor (feature 042). No session until it succeeds.
+        const mfaPort = this.getMfaLoginPort?.();
+        if (mfaPort) {
+            const decision = await mfaPort.beginLogin({ subjectType: 'admin', subjectId: admin.id }, { salesChannelId: null, organizationId: null });
+            if (decision.kind === 'challenge') {
+                return { status: 'mfaRequired', challengeId: decision.challengeId };
+            }
+            if (decision.kind === 'setup') {
+                return { status: 'mfaSetupRequired', setupTicket: decision.setupTicket };
+            }
+        }
+        const session = await this.sessionPort.createSession({
+            kind: 'admin',
+            adminUserId: admin.id,
+            ...(input.ip !== undefined ? { ipAddress: input.ip } : {}),
+            ...(input.userAgent !== undefined ? { userAgent: input.userAgent } : {}),
+        });
+        // command-coverage-ignore: stamps lastLoginAt — high-volume auth bookkeeping
+        // (session lifecycle owned by SessionService), not an audited domain write.
+        admin.lastLoginAt = new Date();
+        await em.flush();
+        return {
+            status: 'authenticated',
+            adminUser: admin,
+            sessionCookieValue: session.cookieValue,
+            sessionExpiresAt: session.expiresAt,
+        };
+    }
+    async changePassword(adminUserId, currentPassword, newPassword) {
+        const em = this.emFactory();
+        const admin = await em.findOne(AdminUser, { id: adminUserId, deletedAt: null });
+        if (!admin) {
+            throw new HttpError(401, ERROR_CODES.UNAUTHORIZED, 'Admin session required.');
+        }
+        const ok = await verifyPassword(admin.passwordHash, currentPassword);
+        if (!ok) {
+            throw new HttpError(401, ERROR_CODES.CURRENT_PASSWORD_INVALID, 'Current password is incorrect.');
+        }
+        admin.passwordHash = await hashPassword(newPassword);
+        if (this.auditLog) {
+            recordAuditFromContext(this.auditLog, em, {
+                action: 'admin_user.change_password',
+                objectType: 'admin_user',
+                objectId: admin.id,
+                stateBefore: null,
+                stateAfter: { via: 'self_service' },
+            });
+        }
+        await em.flush();
+    }
+    async logout(sessionId) {
+        await this.sessionPort.destroySession(sessionId);
+    }
+}
+//# sourceMappingURL=admin-auth-service.js.map

package/dist/backend/services/admin-auth-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-auth-service.js","sourceRoot":"","sources":["../../../src/backend/services/admin-auth-service.ts"],"names":[],"mappings":"AACA,OAAO,EACL,WAAW,EACX,qBAAqB,GAGtB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAChF,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAqB5E,MAAM,OAAO,gBAAgB;IAER;IAEA;IAEA;IACA;IANnB,YACmB,SAA8B;IAC/C,iEAAiE;IAChD,WAA4B;IAC7C,mEAAmE;IAClD,eAAgD,EAChD,QAAoB;QALpB,cAAS,GAAT,SAAS,CAAqB;QAE9B,gBAAW,GAAX,WAAW,CAAiB;QAE5B,oBAAe,GAAf,eAAe,CAAiC;QAChD,aAAQ,GAAR,QAAQ,CAAY;IACpC,CAAC;IAEJ,KAAK,CAAC,KAAK,CAAC,KAKX;QACC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,4EAA4E;QAC5E,2EAA2E;QAC3E,6EAA6E;QAC7E,qEAAqE;QACrE,sEAAsE;QACtE,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE;YACxC,KAAK,EAAE,qBAAqB,CAAC,KAAK,CAAC,KAAK,CAAC;YACzC,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxC,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,YAAY,EAAE,4BAA4B,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpE,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,YAAY,EAAE,4BAA4B,CAAC,CAAC;QACnF,CAAC;QAED,6DAA6D;QAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;QACzC,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,UAAU,CACvC,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,EAC7C,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAC/C,CAAC;YACF,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAClC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC;YACtE,CAAC;YACD,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC9B,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC3E,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC;YACnD,IAAI,EAAE,OAAO;YACb,WAAW,EAAE,KAAK,CAAC,EAAE;YACrB,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE,CAAC,CAAC;QACH,6EAA6E;QAC7E,4EAA4E;QAC5E,KAAK,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC;QAC/B,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO;YACL,MAAM,EAAE,eAAe;YACvB,SAAS,EAAE,KAAK;YAChB,kBAAkB,EAAE,OAAO,CAAC,WAAW;YACvC,gBAAgB,EAAE,OAAO,CAAC,SAAS;SACpC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,WAAmB,EACnB,eAAuB,EACvB,WAAmB;QAEnB,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,YAAY,EAAE,yBAAyB,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;QACrE,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,wBAAwB,EACpC,gCAAgC,CACjC,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,YAAY,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;QACrD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,sBAAsB,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE;gBACxC,MAAM,EAAE,4BAA4B;gBACpC,UAAU,EAAE,YAAY;gBACxB,QAAQ,EAAE,KAAK,CAAC,EAAE;gBAClB,WAAW,EAAE,IAAI;gBACjB,UAAU,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE;aACpC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB;QAC5B,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;IACnD,CAAC;CACF"}

package/dist/backend/services/admin-user-ports.d.ts

@@ -0,0 +1,75 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import type { AdminPasswordVerificationPort, AdminUserLookupOptions, AdminUserPreferencePort, AdminUserReadPort, AdminUserRecord, ImpersonationPort } from '@endora-commerce/contracts';
+import { AdminUser } from '../entities/admin-user.entity.js';
+import type { AdminUserService } from './admin-user-service.js';
+import type { ImpersonationService } from './impersonation-service.js';
+import type { TwoFactorEnrolmentReader } from './two-factor-enrolments.js';
+/**
+ * The published face of `admin_users` (feature 075, Phase P).
+ *
+ * Seven of the eleven inbound sites read the `AdminUser` entity to put a name
+ * beside an id: `admin_roles` resolving a user's role, `quote_requests`
+ * listing the admins a notification goes to, `catalog` attributing a bulk
+ * operation, `organizations` rendering the sales-rep picker.
+ *
+ * `passwordHash` does not survive the mapping, for the reason
+ * `CustomerAccountRecord` gives: exactly one module reads it.
+ */
+export declare class AdminUserReadService implements AdminUserReadPort {
+    private readonly emFactory;
+    private readonly twoFactorEnrolments;
+    constructor(emFactory: () => EntityManager, twoFactorEnrolments: TwoFactorEnrolmentReader);
+    findById(id: string, options?: AdminUserLookupOptions): Promise<AdminUserRecord | null>;
+    findByIds(ids: readonly string[], options?: AdminUserLookupOptions): Promise<AdminUserRecord[]>;
+    findByEmail(email: string, options?: AdminUserLookupOptions): Promise<AdminUserRecord | null>;
+    listAll(options?: AdminUserLookupOptions): Promise<AdminUserRecord[]>;
+    listByRoleId(adminRoleId: string): Promise<AdminUserRecord[]>;
+}
+/**
+ * Step-up re-verification, for `mfa` (feature 080, T052).
+ *
+ * The read is `admin_users`' own row and the comparison is the platform
+ * hasher's, so both halves are on this side of the seam. The composition roots
+ * held them instead: each read `passwordHash` off the entity and called
+ * `verifyPassword` itself, which is a credential column and a hash comparison
+ * living in a file that owns neither.
+ *
+ * The hash never leaves this function — that is the difference between this
+ * port and a `passwordHash` field on `AdminUserRecord`, and it is the whole
+ * reason the port exists.
+ */
+export declare function createAdminPasswordVerificationPort(emFactory: () => EntityManager): AdminPasswordVerificationPort;
+/** `_i18n` writes the admin's language choice and reads nothing else. */
+export declare function createAdminUserPreferencePort(getService: () => AdminUserService, twoFactorEnrolments: TwoFactorEnrolmentReader): AdminUserPreferencePort;
+/**
+ * `customers` hosts the "view as this customer" control, so the surface and
+ * the machinery sit in different modules by design.
+ *
+ * The only substitution the adapter makes is `impersonatedCustomerAccount`:
+ * the service answers with the `CustomerAccount` entity, and the port with the
+ * four fields the one consumer renders. Mapping to a full
+ * `CustomerAccountRecord` here would mean importing `customer_accounts`'
+ * mapper — a new cross-module edge, in the merge request whose job is to
+ * remove them.
+ */
+export declare function createImpersonationPort(getService: () => ImpersonationService): ImpersonationPort;
+/**
+ * The published record, with `twoFactorEnabled` taken from `mfa` rather than
+ * from this module's `two_factor_confirmed_at` column.
+ *
+ * The second parameter is required and has no default on purpose. The column it
+ * replaces had no writer on this table — ever — so the field was a provably
+ * constant `false` on `/admin-users`, on `/admin/me` and on every consumer of
+ * this record. A default would have let the next call site reintroduce exactly
+ * that, silently; making the caller answer means the compiler asks.
+ */
+export declare function toAdminUserRecord(admin: AdminUser, twoFactorEnabled: boolean): AdminUserRecord;
+/**
+ * One `mfa` read for a whole page of admins, rather than one per row.
+ *
+ * Every caller of this mapper is a list or a single entity, so batching here
+ * keeps `/admin-users` at two queries instead of one per user, and leaves the
+ * single-row callers spelling the same thing.
+ */
+export declare function toAdminUserRecords(twoFactorEnrolments: TwoFactorEnrolmentReader, admins: readonly AdminUser[]): Promise<AdminUserRecord[]>;
+//# sourceMappingURL=admin-user-ports.d.ts.map

package/dist/backend/services/admin-user-ports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-user-ports.d.ts","sourceRoot":"","sources":["../../../src/backend/services/admin-user-ports.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE3D,OAAO,KAAK,EACV,6BAA6B,EAC7B,sBAAsB,EACtB,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EAClB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAC7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAE3E;;;;;;;;;;GAUG;AACH,qBAAa,oBAAqB,YAAW,iBAAiB;IAE1D,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;gBADnB,SAAS,EAAE,MAAM,aAAa,EAC9B,mBAAmB,EAAE,wBAAwB;IAG1D,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAKvF,SAAS,CACb,GAAG,EAAE,SAAS,MAAM,EAAE,EACtB,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,eAAe,EAAE,CAAC;IASvB,WAAW,CACf,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAY5B,OAAO,CAAC,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IASrE,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;CAQpE;AAMD;;;;;;;;;;;;GAYG;AACH,wBAAgB,mCAAmC,CACjD,SAAS,EAAE,MAAM,aAAa,GAC7B,6BAA6B,CAS/B;AAED,yEAAyE;AACzE,wBAAgB,6BAA6B,CAC3C,UAAU,EAAE,MAAM,gBAAgB,EAClC,mBAAmB,EAAE,wBAAwB,GAC5C,uBAAuB,CAOzB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,MAAM,oBAAoB,GACrC,iBAAiB,CAmBnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,OAAO,GAAG,eAAe,CAe9F;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,mBAAmB,EAAE,wBAAwB,EAC7C,MAAM,EAAE,SAAS,SAAS,EAAE,GAC3B,OAAO,CAAC,eAAe,EAAE,CAAC,CAI5B"}

package/dist/backend/services/admin-user-ports.js

@@ -0,0 +1,160 @@
+import { normalizeEmailAddress } from '@endora-commerce/contracts';
+import { verifyPassword } from '@endora-commerce/platform/kernel';
+import { AdminUser } from '../entities/admin-user.entity.js';
+/**
+ * The published face of `admin_users` (feature 075, Phase P).
+ *
+ * Seven of the eleven inbound sites read the `AdminUser` entity to put a name
+ * beside an id: `admin_roles` resolving a user's role, `quote_requests`
+ * listing the admins a notification goes to, `catalog` attributing a bulk
+ * operation, `organizations` rendering the sales-rep picker.
+ *
+ * `passwordHash` does not survive the mapping, for the reason
+ * `CustomerAccountRecord` gives: exactly one module reads it.
+ */
+export class AdminUserReadService {
+    emFactory;
+    twoFactorEnrolments;
+    constructor(emFactory, twoFactorEnrolments) {
+        this.emFactory = emFactory;
+        this.twoFactorEnrolments = twoFactorEnrolments;
+    }
+    async findById(id, options) {
+        const admin = await this.emFactory().findOne(AdminUser, { id, ...activeFilter(options) });
+        return admin ? (await toAdminUserRecords(this.twoFactorEnrolments, [admin]))[0] : null;
+    }
+    async findByIds(ids, options) {
+        if (ids.length === 0)
+            return [];
+        const admins = await this.emFactory().find(AdminUser, {
+            id: { $in: [...ids] },
+            ...activeFilter(options),
+        });
+        return toAdminUserRecords(this.twoFactorEnrolments, admins);
+    }
+    async findByEmail(email, options) {
+        // Folded before the comparison, like every other read of this column: the
+        // callers that reach this method arrive from entrances that go through no
+        // request schema — the bootstrap CLI, an identity provider's claim — so the
+        // spelling they hand over is whatever their source held.
+        const admin = await this.emFactory().findOne(AdminUser, {
+            email: normalizeEmailAddress(email),
+            ...activeFilter(options),
+        });
+        return admin ? (await toAdminUserRecords(this.twoFactorEnrolments, [admin]))[0] : null;
+    }
+    async listAll(options) {
+        const admins = await this.emFactory().find(AdminUser, activeFilter(options), { orderBy: { email: 'asc' } });
+        return toAdminUserRecords(this.twoFactorEnrolments, admins);
+    }
+    async listByRoleId(adminRoleId) {
+        const admins = await this.emFactory().find(AdminUser, { adminRoleId }, { orderBy: { email: 'asc' } });
+        return toAdminUserRecords(this.twoFactorEnrolments, admins);
+    }
+}
+function activeFilter(options) {
+    return options?.activeOnly ? { deletedAt: null } : {};
+}
+/**
+ * Step-up re-verification, for `mfa` (feature 080, T052).
+ *
+ * The read is `admin_users`' own row and the comparison is the platform
+ * hasher's, so both halves are on this side of the seam. The composition roots
+ * held them instead: each read `passwordHash` off the entity and called
+ * `verifyPassword` itself, which is a credential column and a hash comparison
+ * living in a file that owns neither.
+ *
+ * The hash never leaves this function — that is the difference between this
+ * port and a `passwordHash` field on `AdminUserRecord`, and it is the whole
+ * reason the port exists.
+ */
+export function createAdminPasswordVerificationPort(emFactory) {
+    return {
+        async verifyPassword(adminUserId, password) {
+            const admin = await emFactory().findOne(AdminUser, { id: adminUserId });
+            // The bare call is the imported hasher: an object method name is not a
+            // binding, so it shadows nothing.
+            return admin ? verifyPassword(admin.passwordHash, password) : false;
+        },
+    };
+}
+/** `_i18n` writes the admin's language choice and reads nothing else. */
+export function createAdminUserPreferencePort(getService, twoFactorEnrolments) {
+    return {
+        async setPreferredLanguage(id, preferredLanguage) {
+            const admin = await getService().setPreferredLanguage(id, preferredLanguage);
+            return (await toAdminUserRecords(twoFactorEnrolments, [admin]))[0];
+        },
+    };
+}
+/**
+ * `customers` hosts the "view as this customer" control, so the surface and
+ * the machinery sit in different modules by design.
+ *
+ * The only substitution the adapter makes is `impersonatedCustomerAccount`:
+ * the service answers with the `CustomerAccount` entity, and the port with the
+ * four fields the one consumer renders. Mapping to a full
+ * `CustomerAccountRecord` here would mean importing `customer_accounts`'
+ * mapper — a new cross-module edge, in the merge request whose job is to
+ * remove them.
+ */
+export function createImpersonationPort(getService) {
+    return {
+        async start(input) {
+            const started = await getService().start(input);
+            return {
+                impersonationSessionId: started.impersonationSessionId,
+                impersonationCookieValue: started.impersonationCookieValue,
+                impersonationExpiresAt: started.impersonationExpiresAt,
+                adminShadowSessionCookieValue: started.adminShadowSessionCookieValue,
+                impersonatedCustomerAccount: {
+                    id: started.impersonatedCustomerAccount.id,
+                    email: started.impersonatedCustomerAccount.email,
+                    firstName: started.impersonatedCustomerAccount.firstName,
+                    lastName: started.impersonatedCustomerAccount.lastName,
+                },
+            };
+        },
+        end: (input) => getService().end(input),
+    };
+}
+/**
+ * The published record, with `twoFactorEnabled` taken from `mfa` rather than
+ * from this module's `two_factor_confirmed_at` column.
+ *
+ * The second parameter is required and has no default on purpose. The column it
+ * replaces had no writer on this table — ever — so the field was a provably
+ * constant `false` on `/admin-users`, on `/admin/me` and on every consumer of
+ * this record. A default would have let the next call site reintroduce exactly
+ * that, silently; making the caller answer means the compiler asks.
+ */
+export function toAdminUserRecord(admin, twoFactorEnabled) {
+    return {
+        id: admin.id,
+        email: admin.email,
+        firstName: admin.firstName,
+        lastName: admin.lastName,
+        adminRoleId: admin.adminRoleId ?? null,
+        status: admin.status,
+        twoFactorEnabled,
+        lastLoginAt: admin.lastLoginAt ?? null,
+        preferredLanguage: admin.preferredLanguage ?? null,
+        createdAt: admin.createdAt,
+        updatedAt: admin.updatedAt,
+        deletedAt: admin.deletedAt ?? null,
+    };
+}
+/**
+ * One `mfa` read for a whole page of admins, rather than one per row.
+ *
+ * Every caller of this mapper is a list or a single entity, so batching here
+ * keeps `/admin-users` at two queries instead of one per user, and leaves the
+ * single-row callers spelling the same thing.
+ */
+export async function toAdminUserRecords(twoFactorEnrolments, admins) {
+    if (admins.length === 0)
+        return [];
+    const enrolled = await twoFactorEnrolments(admins.map((admin) => admin.id));
+    return admins.map((admin) => toAdminUserRecord(admin, enrolled.has(admin.id)));
+}
+//# sourceMappingURL=admin-user-ports.js.map

package/dist/backend/services/admin-user-ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-user-ports.js","sourceRoot":"","sources":["../../../src/backend/services/admin-user-ports.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AASnE,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAK7D;;;;;;;;;;GAUG;AACH,MAAM,OAAO,oBAAoB;IAEZ;IACA;IAFnB,YACmB,SAA8B,EAC9B,mBAA6C;QAD7C,cAAS,GAAT,SAAS,CAAqB;QAC9B,wBAAmB,GAAnB,mBAAmB,CAA0B;IAC7D,CAAC;IAEJ,KAAK,CAAC,QAAQ,CAAC,EAAU,EAAE,OAAgC;QACzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC1F,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1F,CAAC;IAED,KAAK,CAAC,SAAS,CACb,GAAsB,EACtB,OAAgC;QAEhC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE;YACpD,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE;YACrB,GAAG,YAAY,CAAC,OAAO,CAAC;SACzB,CAAC,CAAC;QACH,OAAO,kBAAkB,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,WAAW,CACf,KAAa,EACb,OAAgC;QAEhC,0EAA0E;QAC1E,0EAA0E;QAC1E,4EAA4E;QAC5E,yDAAyD;QACzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE;YACtD,KAAK,EAAE,qBAAqB,CAAC,KAAK,CAAC;YACnC,GAAG,YAAY,CAAC,OAAO,CAAC;SACzB,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1F,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAgC;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CACxC,SAAS,EACT,YAAY,CAAC,OAAO,CAAC,EACrB,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAC9B,CAAC;QACF,OAAO,kBAAkB,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,WAAmB;QACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CACxC,SAAS,EACT,EAAE,WAAW,EAAE,EACf,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAC9B,CAAC;QACF,OAAO,kBAAkB,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;IAC9D,CAAC;CACF;AAED,SAAS,YAAY,CAAC,OAAgC;IACpD,OAAO,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mCAAmC,CACjD,SAA8B;IAE9B,OAAO;QACL,KAAK,CAAC,cAAc,CAAC,WAAW,EAAE,QAAQ;YACxC,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;YACxE,uEAAuE;YACvE,kCAAkC;YAClC,OAAO,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACtE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,6BAA6B,CAC3C,UAAkC,EAClC,mBAA6C;IAE7C,OAAO;QACL,KAAK,CAAC,oBAAoB,CAAC,EAAE,EAAE,iBAAiB;YAC9C,MAAM,KAAK,GAAG,MAAM,UAAU,EAAE,CAAC,oBAAoB,CAAC,EAAE,EAAE,iBAAiB,CAAC,CAAC;YAC7E,OAAO,CAAC,MAAM,kBAAkB,CAAC,mBAAmB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;QACtE,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CACrC,UAAsC;IAEtC,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,KAAK;YACf,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAChD,OAAO;gBACL,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;gBACtD,wBAAwB,EAAE,OAAO,CAAC,wBAAwB;gBAC1D,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;gBACtD,6BAA6B,EAAE,OAAO,CAAC,6BAA6B;gBACpE,2BAA2B,EAAE;oBAC3B,EAAE,EAAE,OAAO,CAAC,2BAA2B,CAAC,EAAE;oBAC1C,KAAK,EAAE,OAAO,CAAC,2BAA2B,CAAC,KAAK;oBAChD,SAAS,EAAE,OAAO,CAAC,2BAA2B,CAAC,SAAS;oBACxD,QAAQ,EAAE,OAAO,CAAC,2BAA2B,CAAC,QAAQ;iBACvD;aACF,CAAC;QACJ,CAAC;QACD,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC;KACxC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAgB,EAAE,gBAAyB;IAC3E,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;QACtC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,gBAAgB;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;QACtC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI;QAClD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;KACnC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,mBAA6C,EAC7C,MAA4B;IAE5B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5E,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACjF,CAAC"}