@endora-commerce/mod-mfa 0.100.0

package/dist/backend/entities/mfa-social-identity.entity.js

@@ -0,0 +1,73 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Entity, Index, OptionalProps, PrimaryKey, Property } from '@mikro-orm/core';
+import { GlobalEntity } from '@endora-commerce/platform/tenancy';
+import { randomUUID } from 'crypto';
+/**
+ * Link between a platform account and an external provider identity
+ * (Google / Microsoft) — feature 042. Resolution is by the provider's
+ * verified primary email; the `providerSubject` (`sub` claim) is the stable
+ * provider-side id. Uniqueness constraints (declared in migration 067):
+ *   - (provider, provider_subject): one platform account per IdP identity;
+ *   - (subject_type, subject_id, provider): one link per provider per account.
+ */
+let MfaSocialIdentity = class MfaSocialIdentity {
+    [OptionalProps];
+    id = randomUUID();
+    subjectType;
+    subjectId;
+    /** `'google'` | `'microsoft'`. */
+    provider;
+    /** The IdP `sub` claim — stable provider-side identifier. */
+    providerSubject;
+    /** Verified email at link time (used for resolution). */
+    email;
+    linkedAt = new Date();
+    lastUsedAt;
+};
+__decorate([
+    PrimaryKey({ type: 'uuid' }),
+    __metadata("design:type", String)
+], MfaSocialIdentity.prototype, "id", void 0);
+__decorate([
+    Property({ type: 'string', length: 16 }),
+    __metadata("design:type", String)
+], MfaSocialIdentity.prototype, "subjectType", void 0);
+__decorate([
+    Property({ type: 'uuid' }),
+    __metadata("design:type", String)
+], MfaSocialIdentity.prototype, "subjectId", void 0);
+__decorate([
+    Property({ type: 'string', length: 16 }),
+    __metadata("design:type", String)
+], MfaSocialIdentity.prototype, "provider", void 0);
+__decorate([
+    Property({ type: 'string', length: 255 }),
+    __metadata("design:type", String)
+], MfaSocialIdentity.prototype, "providerSubject", void 0);
+__decorate([
+    Property({ type: 'string', length: 320 }),
+    Index(),
+    __metadata("design:type", String)
+], MfaSocialIdentity.prototype, "email", void 0);
+__decorate([
+    Property({ type: 'datetime', onCreate: () => new Date() }),
+    __metadata("design:type", Date)
+], MfaSocialIdentity.prototype, "linkedAt", void 0);
+__decorate([
+    Property({ type: 'datetime', nullable: true }),
+    __metadata("design:type", Object)
+], MfaSocialIdentity.prototype, "lastUsedAt", void 0);
+MfaSocialIdentity = __decorate([
+    GlobalEntity(),
+    Entity({ tableName: 'mfa_social_identities' })
+], MfaSocialIdentity);
+export { MfaSocialIdentity };
+//# sourceMappingURL=mfa-social-identity.entity.js.map

package/dist/backend/entities/mfa-social-identity.entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-social-identity.entity.js","sourceRoot":"","sources":["../../../src/backend/entities/mfa-social-identity.entity.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACrF,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEpC;;;;;;;GAOG;AAGI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC5B,CAAC,aAAa,CAAC,CAAoC;IAGnD,EAAE,GAAW,UAAU,EAAE,CAAC;IAG1B,WAAW,CAAU;IAGrB,SAAS,CAAU;IAEnB,kCAAkC;IAElC,QAAQ,CAAU;IAElB,6DAA6D;IAE7D,eAAe,CAAU;IAEzB,yDAAyD;IAGzD,KAAK,CAAU;IAGf,QAAQ,GAAS,IAAI,IAAI,EAAE,CAAC;IAG5B,UAAU,CAAe;CAC1B,CAAA;AA1BC;IADC,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;6CACH;AAG1B;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;;sDACpB;AAGrB;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;oDACR;AAInB;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;;mDACvB;AAIlB;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;0DACjB;AAKzB;IAFC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACzC,KAAK,EAAE;;gDACO;AAGf;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;8BACjD,IAAI;mDAAc;AAG5B;IADC,QAAQ,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;qDACtB;AA7Bd,iBAAiB;IAF7B,YAAY,EAAE;IACd,MAAM,CAAC,EAAE,SAAS,EAAE,uBAAuB,EAAE,CAAC;GAClC,iBAAiB,CA8B7B"}

package/dist/backend/index.d.ts

@@ -0,0 +1,131 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import type { FastifyRequest } from 'fastify';
+import type { Redis } from 'ioredis';
+import type { AuthSessionPort, MfaEnrolmentCountPort, MfaEnrolmentStatePort, MfaLoginPort } from '@endora-commerce/contracts';
+import type { AuditPort } from '@endora-commerce/platform/kernel';
+import type { CommandBus } from '@endora-commerce/platform/commands';
+import type { ModuleContext } from '@endora-commerce/platform/kernel';
+import type { RequireAdminFactory } from '@endora-commerce/platform/kernel';
+import type { SettingsReader } from './services/mfa-policy-resolver.js';
+import { type OAuthProviderPort } from './services/oauth-provider-service.js';
+import type { SocialIdentityDeps } from './services/social-identity-service.js';
+import { type MfaModuleHandle } from './plugin.js';
+import { MfaEnrolment } from './entities/mfa-enrolment.entity.js';
+import { MfaOrganizationPolicy } from './entities/mfa-organization-policy.entity.js';
+import { MfaRecoveryCode } from './entities/mfa-recovery-code.entity.js';
+import { MfaSocialIdentity } from './entities/mfa-social-identity.entity.js';
+/**
+ * `mfa` — the widest option surface in the wave, and why it is three names
+ * rather than fifteen (feature 072, wave 1, T096;
+ * `specs/110-instance-repository/` T118c).
+ *
+ * `MfaModuleOptions` had twenty-four fields. Wave 1 grouped six of them into a
+ * single `MfaActorBridge` contribution on the reasoning that they were the
+ * *shape a composition gives an actor* and that the two roots genuinely
+ * disagreed about it — production reading `request.actor`, the harness
+ * `request.testActor`. **T118c re-derived the six and the premise held for none
+ * of them.**
+ *
+ *  - `resolveCustomerActor` was a duplicate spelling of `customerActorResolver`,
+ *    byte-identical to the platform's contribution in production and to the
+ *    harness's in the harness. One question, two answers, agreeing by hand.
+ *  - `resolveAdminActor` was `adminContextResolver` plus a `promoteAdminActor`
+ *    call that every one of its call sites had already made: each sits behind
+ *    `requireAdmin`, whose `auth` implementation promotes and then refuses a
+ *    non-admin, so the bridge re-asked a question its own guard had answered.
+ *  - `resolveOrgAdmin` was the actor resolver plus one
+ *    `customerAccountReadPort.findById` and a role check.
+ *  - `resolveOrganizationCustomerIds`, `resolveAccountEmail` and
+ *    `verifyAccountPassword` were four identity ports and nothing else.
+ *
+ * So the module resolves them itself now: two contributed actor names it reads
+ * off the cradle like the eight other modules that read them, and four
+ * `lazyPort` reads over `admin_users`' and `customer_accounts`' published
+ * contracts — both already in this module's manifest `dependencies`, both
+ * `nonDeactivatable`, so no operator loses a control to the edge.
+ *
+ * **Two of the six were asserted by nothing**, which is what a bridge with an
+ * optional half buys: the harness omitted `resolveAccountEmail` and
+ * `verifyAccountPassword` and production supplied them, so under test an
+ * authenticator entry was labelled with a UUID instead of an e-mail address and
+ * the password branch of `reauthenticate` did not exist. Neither difference was
+ * reachable by any test in the tree. They are not optional any more — the
+ * module always answers — and `backend/test/integration/mfa/account-identity-wiring.test.ts`
+ * is where both are now asserted.
+ *
+ * The remaining three names are genuinely independent:
+ *
+ *  - `mfaOauthProvider` — absent on a deployment with no social sign-in.
+ *  - `mfaSocialAccountResolvers` — same, and separately omissible because a
+ *    deployment can carry the provider without standalone registration.
+ *  - `mfaDefaultChannelIdResolver` — defaults to `async () => null`, which is
+ *    exactly the `?? null` both roots already spell at the call site.
+ *
+ * `requireCustomer` is resolved rather than passed, and it is **not** this
+ * module's to own: it is `auth`'s customer-side guard, which `auth` provides as
+ * a port beside `requireAdmin` since issue #43. Until then each root declared
+ * its own — `composition.ts` inline, the harness as `requireTestCustomer()` —
+ * and the two disagreed on which request property carried the actor. Unifying
+ * them was filed as its own task rather than folded in here, because it touched
+ * twenty-seven call sites that have nothing to do with MFA.
+ *
+ * The base URLs come from the environment, read here rather than threaded from
+ * a root — a packaged module reads its own configuration.
+ */
+/**
+ * The origins MFA stamps into the links it sends and the OAuth redirects it
+ * builds. Defaults to the environment, because a packaged module reads its own
+ * configuration; contributed by a composition that has its own answer.
+ */
+export interface MfaBaseUrls {
+    readonly backend: string | undefined;
+    readonly storefront: string | undefined;
+    readonly admin: string | undefined;
+}
+export interface MfaCradle {
+    readonly emFactory: () => EntityManager;
+    readonly redis: Redis;
+    readonly auditLogService: AuditPort;
+    readonly commandBus: CommandBus;
+    readonly authSessionPort: AuthSessionPort;
+    readonly settingsReadPort: SettingsReader;
+    readonly requireAdmin: RequireAdminFactory;
+    readonly requireCustomer: (request: FastifyRequest) => Promise<void>;
+    /**
+     * T118c — the two actor names the composition already contributes for every
+     * other module that asks who is calling. Declared structurally, as the eight
+     * other consumers declare them, so this module names no composition root.
+     */
+    readonly customerActorResolver: (request: FastifyRequest) => {
+        customerAccountId: string;
+        organizationId: string | null;
+    };
+    readonly adminContextResolver: (request: FastifyRequest) => {
+        adminUserId: string;
+    };
+    readonly mfaOauthProvider: OAuthProviderPort | undefined;
+    readonly mfaSocialAccountResolvers: SocialIdentityDeps | undefined;
+    readonly mfaDefaultChannelIdResolver: () => Promise<string | null>;
+    readonly mfaBaseUrls: MfaBaseUrls;
+    readonly mfa: {
+        handle: () => MfaModuleHandle;
+        plugin: unknown;
+    };
+    readonly mfaLoginPort: MfaLoginPort;
+    readonly mfaEnrolmentCountPort: MfaEnrolmentCountPort;
+    readonly mfaEnrolmentStatePort: MfaEnrolmentStatePort;
+}
+export declare function registerModule(ctx: ModuleContext): void;
+/**
+ * The module's persisted entity classes, on the `./backend` subpath, as one
+ * array and **no named class export** (D-168).
+ *
+ * This is the shape the platform reads when the package is *installed*: the
+ * boot-time loader (`src/packages/package-runtime.ts`, `exported['entities']`)
+ * and the static declaration reader (`scripts/lib/package-declarations.ts`),
+ * which is the third source of `check:module-boundary`'s `table→owner` map and
+ * the package pass of `check-entity-tenant-classification`. A missing array is
+ * answered with `[]` — zero entities registered, no error anywhere.
+ */
+export declare const entities: (typeof MfaOrganizationPolicy | typeof MfaEnrolment | typeof MfaSocialIdentity | typeof MfaRecoveryCode)[];
+//# sourceMappingURL=index.d.ts.map

package/dist/backend/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/backend/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,KAAK,EAGV,eAAe,EAIf,qBAAqB,EACrB,qBAAqB,EACrB,YAAY,EACb,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AAEtE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,sCAAsC,CAAC;AAS9C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAa,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAC;AACrF,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAE7E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AAEH;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,aAAa,CAAC;IACxC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,eAAe,EAAE,SAAS,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,gBAAgB,EAAE,cAAc,CAAC;IAC1C,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,QAAQ,CAAC,eAAe,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK;QAC3D,iBAAiB,EAAE,MAAM,CAAC;QAC1B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;KAC/B,CAAC;IACF,QAAQ,CAAC,oBAAoB,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IACpF,QAAQ,CAAC,gBAAgB,EAAE,iBAAiB,GAAG,SAAS,CAAC;IACzD,QAAQ,CAAC,yBAAyB,EAAE,kBAAkB,GAAG,SAAS,CAAC;IACnE,QAAQ,CAAC,2BAA2B,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACnE,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,GAAG,EAAE;QAAE,MAAM,EAAE,MAAM,eAAe,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC;IACjE,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,qBAAqB,EAAE,qBAAqB,CAAC;IACtD,QAAQ,CAAC,qBAAqB,EAAE,qBAAqB,CAAC;CACvD;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,aAAa,GAAG,IAAI,CA2LvD;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,QAAQ,4GAKpB,CAAC"}

package/dist/backend/index.js

@@ -0,0 +1,173 @@
+import { lazyPort } from '@endora-commerce/platform/kernel';
+import { OpenIdOAuthProvider, readOAuthConfigFromEnv, } from './services/oauth-provider-service.js';
+import { createAccountEmailResolver, createAccountPasswordVerifier, createOrganizationAdminResolver, createOrganizationCustomerIdsResolver, } from './services/account-identity.js';
+import { MfaEnrolmentCountService } from './services/mfa-enrolment-count.service.js';
+import { MfaEnrolmentStateService } from './services/mfa-enrolment-state.service.js';
+import { mfaModule } from './plugin.js';
+import { MfaEnrolment } from './entities/mfa-enrolment.entity.js';
+import { MfaOrganizationPolicy } from './entities/mfa-organization-policy.entity.js';
+import { MfaRecoveryCode } from './entities/mfa-recovery-code.entity.js';
+import { MfaSocialIdentity } from './entities/mfa-social-identity.entity.js';
+export function registerModule(ctx) {
+    ctx.di.register({
+        /**
+         * Federated sign-in, defaulted to whatever this deployment's environment
+         * configures (T143c).
+         *
+         * It used to default to `undefined` and be contributed by a root, which
+         * meant `composition.ts` imported this module's provider class and its env
+         * reader to decide, on the module's behalf, whether the module had social
+         * sign-in — the shape the composition checklist rules out for a knob the
+         * module can read itself. `MFA_OAUTH_*` is this module's configuration and
+         * nothing else reads it.
+         *
+         * The seam it leaves is the one `organizations`' VAT clients left in T138 /
+         * T140: production takes the real `openid-client` provider by default, the
+         * test harness contributes a deterministic fake over the same name, and
+         * neither root names the class. `undefined` still means "no social sign-in
+         * on this deployment", which is what an unconfigured environment produces.
+         */
+        mfaOauthProvider: ctx
+            .asFunction(() => {
+            const config = readOAuthConfigFromEnv();
+            return config.google || config.microsoft ? new OpenIdOAuthProvider(config) : undefined;
+        })
+            .singleton(),
+        mfaSocialAccountResolvers: ctx
+            .asFunction(() => undefined)
+            .singleton(),
+        // `null` means "no system-default sales channel", which is what both roots
+        // already fall back to when the resolver finds none.
+        mfaDefaultChannelIdResolver: ctx
+            .asFunction(() => async () => null)
+            .singleton(),
+        mfaBaseUrls: ctx
+            .asFunction(() => ({
+            backend: process.env['BACKEND_PUBLIC_URL'],
+            storefront: process.env['STOREFRONT_BASE_URL'],
+            admin: process.env['ADMIN_BASE_URL'],
+        }))
+            .singleton(),
+        mfa: ctx
+            .asFunction(({ emFactory, redis, auditLogService, commandBus }) => {
+            const secretEncryptionKey = process.env['MFA_SECRET_ENCRYPTION_KEY'];
+            const { backend: backendBaseUrl, storefront: storefrontBaseUrl, admin: adminBaseUrl, } = ctx.cradle().mfaBaseUrls;
+            // Every cross-composition input below is read from the cradle at call
+            // time. Capturing them would freeze this module's view of the
+            // composition at the instant it happens to be constructed, which for
+            // a guard means it keeps admitting requests after `auth` goes away.
+            const { mfaOauthProvider: oauthProvider, mfaSocialAccountResolvers: socialAccountResolvers } = ctx.cradle();
+            // T118c — the four identity ports the retired bridge's members were
+            // built out of. `lazyPort` proxies, never resolved values: a captured
+            // gate keeps answering after its owner is switched off, and on an
+            // authentication path that is an account reachable without the factor
+            // it was supposed to require.
+            const customerAccounts = lazyPort(ctx, 'customerAccountReadPort');
+            const adminUsers = lazyPort(ctx, 'adminUserReadPort');
+            const resolveOrganizationAdmin = createOrganizationAdminResolver(customerAccounts);
+            return mfaModule({
+                emFactory,
+                redis,
+                // Deferred rather than destructured: both roots read `mfaLoginPort`
+                // to contribute the getter `customer_accounts` needs at login, and
+                // that read happens *before* either registers `settingsReadPort`.
+                // Taking it as a constructor argument would resolve this module at
+                // that moment and fail on a name that does not exist yet.
+                settingsService: {
+                    get: (code, salesChannelId, schema) => ctx.cradle().settingsReadPort.get(code, salesChannelId, schema),
+                },
+                auditLogService,
+                commandBus,
+                // Issue #222 — `customer_accounts`' published answer to "does this
+                // account have a password on record". Resolved lazily like the
+                // session port beside it: a captured gate would keep answering
+                // after its owner went away, and this one decides whether somebody
+                // may remove their last way into their account.
+                customerPasswordState: lazyPort(ctx, 'customerPasswordStatePort'),
+                // Feature 075 Phase C — `auth`'s published session surface, not its
+                // `SessionService` class. The two fields the second factor reads
+                // (the cookie value and its expiry) travel as plain data; the
+                // `Session` entity stays behind the boundary, where its `tokenHash`
+                // belongs.
+                sessionService: lazyPort(ctx, 'authSessionPort'),
+                resolveDefaultChannelId: () => ctx.cradle().mfaDefaultChannelIdResolver(),
+                ...(secretEncryptionKey === undefined ? {} : { secretEncryptionKey }),
+                ...(backendBaseUrl === undefined ? {} : { backendBaseUrl }),
+                ...(storefrontBaseUrl === undefined ? {} : { storefrontBaseUrl }),
+                ...(adminBaseUrl === undefined ? {} : { adminBaseUrl }),
+                requireCustomer: (request) => ctx.cradle().requireCustomer(request),
+                requireAdmin: (permission) => async (req, reply) => ctx.cradle().requireAdmin(permission)(req, reply),
+                // T118c — read from the cradle at call time for the reason every
+                // other input here is: the composition's answer to "who is asking",
+                // not a second copy of it written in this module.
+                resolveCustomerActor: (request) => ctx.cradle().customerActorResolver(request),
+                // `adminContextResolver`, and no `promoteAdminActor` beside it:
+                // every call site is behind `requireAdmin`, whose `auth`
+                // implementation promotes and then refuses a non-admin, so the
+                // promotion has happened before this runs.
+                resolveAdminActor: (request) => ctx.cradle().adminContextResolver(request),
+                resolveOrgAdmin: (request) => resolveOrganizationAdmin(ctx.cradle().customerActorResolver(request).customerAccountId),
+                resolveOrganizationCustomerIds: createOrganizationCustomerIdsResolver(customerAccounts),
+                resolveAccountEmail: createAccountEmailResolver(customerAccounts, adminUsers),
+                verifyAccountPassword: createAccountPasswordVerifier(lazyPort(ctx, 'customerPasswordVerificationPort'), lazyPort(ctx, 'adminPasswordVerificationPort')),
+                // Spread rather than assigned: `exactOptionalPropertyTypes` makes
+                // "absent" and "present as undefined" different types, and these
+                // two are genuinely absent on a deployment without social sign-in.
+                ...(oauthProvider === undefined ? {} : { oauthProvider }),
+                ...(socialAccountResolvers === undefined ? {} : { socialAccountResolvers }),
+            });
+        })
+            .singleton(),
+    });
+    ctx.di.providePort('mfaLoginPort', ctx.asFunction(({ mfa }) => mfa.handle().mfaLoginPort).singleton());
+    /**
+     * The live half of the deactivation-confirmation dialog (owner ruling on
+     * D-96.5): how many people currently hold a second factor.
+     *
+     * Gated like every other port, and that is exactly right here — the dialog
+     * renders *before* the flip, while this module is still on, so the question
+     * is asked through an open gate. `/platform/modules` decides presence before
+     * it resolves this and renders "unavailable" rather than blocking the flip if
+     * the read fails.
+     */
+    ctx.di.providePort('mfaEnrolmentCountPort', ctx
+        .asFunction(({ emFactory }) => new MfaEnrolmentCountService(emFactory))
+        .singleton());
+    /**
+     * Who holds a second factor, for the two identity modules that publish
+     * `twoFactorEnabled`.
+     *
+     * Gated like every other port, and unlike `mfaEnrolmentCountPort` above it is
+     * read on ordinary request paths rather than in a dialog that precedes the
+     * flip — so both consumers ask `effectiveState.isPresent('mfa')` before they
+     * resolve it and report `false` when this module is absent. That is a
+     * declared degrade, not a caught gate: with `mfa` off nothing asks for a
+     * second factor at sign-in, so no account is protected by one and `false` is
+     * the answer rather than a substitute for one.
+     */
+    ctx.di.providePort('mfaEnrolmentStatePort', ctx
+        .asFunction(({ emFactory }) => new MfaEnrolmentStateService(emFactory))
+        .singleton());
+    ctx.routes(async (app) => {
+        const plugin = ctx.cradle().mfa.plugin;
+        await plugin(app);
+    });
+}
+/**
+ * The module's persisted entity classes, on the `./backend` subpath, as one
+ * array and **no named class export** (D-168).
+ *
+ * This is the shape the platform reads when the package is *installed*: the
+ * boot-time loader (`src/packages/package-runtime.ts`, `exported['entities']`)
+ * and the static declaration reader (`scripts/lib/package-declarations.ts`),
+ * which is the third source of `check:module-boundary`'s `table→owner` map and
+ * the package pass of `check-entity-tenant-classification`. A missing array is
+ * answered with `[]` — zero entities registered, no error anywhere.
+ */
+export const entities = [
+    MfaEnrolment,
+    MfaOrganizationPolicy,
+    MfaRecoveryCode,
+    MfaSocialIdentity,
+];
+//# sourceMappingURL=index.js.map

package/dist/backend/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/backend/index.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAG5D,OAAO,EACL,mBAAmB,EACnB,sBAAsB,GAEvB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,EAC7B,+BAA+B,EAC/B,qCAAqC,GACtC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AAErF,OAAO,EAAE,SAAS,EAAwB,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAC;AACrF,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAqG7E,MAAM,UAAU,cAAc,CAAC,GAAkB;IAC/C,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC;QACd;;;;;;;;;;;;;;;;WAgBG;QACH,gBAAgB,EAAE,GAAG;aAClB,UAAU,CAAC,GAAkC,EAAE;YAC9C,MAAM,MAAM,GAAG,sBAAsB,EAAE,CAAC;YACxC,OAAO,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzF,CAAC,CAAC;aACD,SAAS,EAAE;QACd,yBAAyB,EAAE,GAAG;aAC3B,UAAU,CAAC,GAAmC,EAAE,CAAC,SAAS,CAAC;aAC3D,SAAS,EAAE;QACd,2EAA2E;QAC3E,qDAAqD;QACrD,2BAA2B,EAAE,GAAG;aAC7B,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,IAA4B,EAAE,CAAC,IAAI,CAAC;aAC1D,SAAS,EAAE;QACd,WAAW,EAAE,GAAG;aACb,UAAU,CACT,GAAgB,EAAE,CAAC,CAAC;YAClB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;YAC1C,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;YAC9C,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;SACrC,CAAC,CACH;aACA,SAAS,EAAE;QAEd,GAAG,EAAE,GAAG;aACL,UAAU,CACT,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE,UAAU,EAAa,EAAE,EAAE;YAC/D,MAAM,mBAAmB,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;YACrE,MAAM,EACJ,OAAO,EAAE,cAAc,EACvB,UAAU,EAAE,iBAAiB,EAC7B,KAAK,EAAE,YAAY,GACpB,GAAG,GAAG,CAAC,MAAM,EAAa,CAAC,WAAW,CAAC;YACxC,sEAAsE;YACtE,8DAA8D;YAC9D,qEAAqE;YACrE,oEAAoE;YACpE,MAAM,EAAE,gBAAgB,EAAE,aAAa,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,GAC1F,GAAG,CAAC,MAAM,EAAa,CAAC;YAC1B,oEAAoE;YACpE,sEAAsE;YACtE,kEAAkE;YAClE,sEAAsE;YACtE,8BAA8B;YAC9B,MAAM,gBAAgB,GAAG,QAAQ,CAC/B,GAAG,EACH,yBAAyB,CAC1B,CAAC;YACF,MAAM,UAAU,GAAG,QAAQ,CAAoB,GAAG,EAAE,mBAAmB,CAAC,CAAC;YACzE,MAAM,wBAAwB,GAAG,+BAA+B,CAAC,gBAAgB,CAAC,CAAC;YACnF,OAAO,SAAS,CAAC;gBACf,SAAS;gBACT,KAAK;gBACL,oEAAoE;gBACpE,mEAAmE;gBACnE,kEAAkE;gBAClE,mEAAmE;gBACnE,0DAA0D;gBAC1D,eAAe,EAAE;oBACf,GAAG,EAAE,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,CACpC,GAAG,CAAC,MAAM,EAAa,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC;iBAC7E;gBACD,eAAe;gBACf,UAAU;gBACV,mEAAmE;gBACnE,+DAA+D;gBAC/D,+DAA+D;gBAC/D,mEAAmE;gBACnE,gDAAgD;gBAChD,qBAAqB,EAAE,QAAQ,CAC7B,GAAG,EACH,2BAA2B,CAC5B;gBACD,oEAAoE;gBACpE,iEAAiE;gBACjE,8DAA8D;gBAC9D,oEAAoE;gBACpE,WAAW;gBACX,cAAc,EAAE,QAAQ,CAAkB,GAAG,EAAE,iBAAiB,CAAC;gBACjE,uBAAuB,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,EAAa,CAAC,2BAA2B,EAAE;gBACpF,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC;gBACrE,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC;gBAC3D,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC;gBACjE,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;gBACvD,eAAe,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,EAAa,CAAC,eAAe,CAAC,OAAO,CAAC;gBAC9E,YAAY,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CACjD,GAAG,CAAC,MAAM,EAAa,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC;gBAC9D,iEAAiE;gBACjE,oEAAoE;gBACpE,kDAAkD;gBAClD,oBAAoB,EAAE,CAAC,OAAO,EAAE,EAAE,CAChC,GAAG,CAAC,MAAM,EAAa,CAAC,qBAAqB,CAAC,OAAO,CAAC;gBACxD,gEAAgE;gBAChE,yDAAyD;gBACzD,+DAA+D;gBAC/D,2CAA2C;gBAC3C,iBAAiB,EAAE,CAAC,OAAO,EAAE,EAAE,CAC7B,GAAG,CAAC,MAAM,EAAa,CAAC,oBAAoB,CAAC,OAAO,CAAC;gBACvD,eAAe,EAAE,CAAC,OAAO,EAAE,EAAE,CAC3B,wBAAwB,CACtB,GAAG,CAAC,MAAM,EAAa,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,iBAAiB,CACzE;gBACH,8BAA8B,EAC5B,qCAAqC,CAAC,gBAAgB,CAAC;gBACzD,mBAAmB,EAAE,0BAA0B,CAAC,gBAAgB,EAAE,UAAU,CAAC;gBAC7E,qBAAqB,EAAE,6BAA6B,CAClD,QAAQ,CACN,GAAG,EACH,kCAAkC,CACnC,EACD,QAAQ,CAAgC,GAAG,EAAE,+BAA+B,CAAC,CAC9E;gBACD,kEAAkE;gBAClE,iEAAiE;gBACjE,mEAAmE;gBACnE,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC;gBACzD,GAAG,CAAC,sBAAsB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,CAAC;aAC5E,CAAC,CAAC;QACL,CAAC,CACF;aACA,SAAS,EAAE;KACf,CAAC,CAAC;IAEH,GAAG,CAAC,EAAE,CAAC,WAAW,CAChB,cAAc,EACd,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,EAAa,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,YAAY,CAAC,CAAC,SAAS,EAAE,CAC9E,CAAC;IAEF;;;;;;;;;OASG;IACH,GAAG,CAAC,EAAE,CAAC,WAAW,CAChB,uBAAuB,EACvB,GAAG;SACA,UAAU,CAAC,CAAC,EAAE,SAAS,EAAa,EAAE,EAAE,CAAC,IAAI,wBAAwB,CAAC,SAAS,CAAC,CAAC;SACjF,SAAS,EAAE,CACf,CAAC;IAEF;;;;;;;;;;;OAWG;IACH,GAAG,CAAC,EAAE,CAAC,WAAW,CAChB,uBAAuB,EACvB,GAAG;SACA,UAAU,CAAC,CAAC,EAAE,SAAS,EAAa,EAAE,EAAE,CAAC,IAAI,wBAAwB,CAAC,SAAS,CAAC,CAAC;SACjF,SAAS,EAAE,CACf,CAAC;IAEF,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACvB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,EAAa,CAAC,GAAG,CAAC,MAA0C,CAAC;QACtF,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,YAAY;IACZ,qBAAqB;IACrB,eAAe;IACf,iBAAiB;CAClB,CAAC"}

package/dist/backend/plugin.d.ts

@@ -0,0 +1,99 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import type { FastifyInstance, FastifyReply, FastifyRequest } from 'fastify';
+import type { Redis } from 'ioredis';
+import type { AuthSessionPort, CustomerPasswordStatePort, MfaLoginPort } from '@endora-commerce/contracts';
+import type { AuditPort } from '@endora-commerce/platform/kernel';
+import type { CommandBus } from '@endora-commerce/platform/commands';
+import { ChallengeStore } from './services/challenge-store.js';
+import { MfaPolicyResolver, type SettingsReader } from './services/mfa-policy-resolver.js';
+import { MfaEnrolmentService } from './services/mfa-enrolment-service.js';
+import { type SocialIdentityDeps } from './services/social-identity-service.js';
+import type { OAuthProviderPort } from './services/oauth-provider-service.js';
+import type { RequireAdminFactory } from '@endora-commerce/platform/kernel';
+/**
+ * The attach function this module hands its composition root.
+ *
+ * Typed on `fastify`'s own `FastifyInstance` rather than on the platform's
+ * `ModulePlugin`, which `contracts/host-package.md` §1.4g classifies **A**: the
+ * host does not publish it, so a packaged module cannot name it. The
+ * already-packaged `quote_requests` types its attach function the same way.
+ */
+type ModuleAttach = (app: FastifyInstance) => Promise<void>;
+/**
+ * MFA module composition root (feature 042).
+ *
+ * Owns 2FA enrolment, recovery codes, federated sign-in (later stories),
+ * policy resolution, and admin reset (later stories). Sibling services are
+ * injected so the module never imports another module's internals
+ * (Constitution Principle I). Exposes its `MfaLoginPort` via the handle for
+ * the per-surface login services.
+ *
+ * Enrolment requires `secretEncryptionKey`; when it is absent the module still
+ * composes and `beginLogin` works (password-only), but the enrolment + verify
+ * routes are not registered.
+ */
+export interface MfaModuleOptions {
+    emFactory: () => EntityManager;
+    redis: Redis;
+    settingsService: SettingsReader;
+    auditLogService: AuditPort;
+    /** Constitution XIII — the unlink is a security-relevant, audited write. */
+    commandBus: CommandBus;
+    /**
+     * Issue #222 — whether a customer account has a password on record, which is
+     * what decides whether its last federated identity may be severed. Mandatory:
+     * a composition without it would have to guess, and the two guesses are "lock
+     * the holder out" and "refuse forever".
+     */
+    customerPasswordState: CustomerPasswordStatePort;
+    sessionService: AuthSessionPort;
+    /** Resolves the system-default sales-channel id for global setting reads. */
+    resolveDefaultChannelId?: () => Promise<string | null>;
+    /** base64 32-byte AES key for TOTP secrets at rest. */
+    secretEncryptionKey?: string | undefined;
+    /** Storefront customer guard + actor resolver (for self-service routes). */
+    requireCustomer: (req: FastifyRequest, reply: FastifyReply) => Promise<void>;
+    resolveCustomerActor: (req: FastifyRequest) => {
+        customerAccountId: string;
+        organizationId: string | null;
+    };
+    /** Admin guard factory + actor resolver (admin self-service US2 + reset US6). */
+    requireAdmin?: RequireAdminFactory;
+    resolveAdminActor: (req: FastifyRequest) => {
+        adminUserId: string;
+    };
+    /** Lists an organization's customer-account ids (US6 bulk reset). */
+    resolveOrganizationCustomerIds: (organizationId: string) => Promise<string[]>;
+    /** Resolves an org-admin customer's org + asserts the role (US3 storefront). */
+    resolveOrgAdmin: (req: FastifyRequest) => Promise<{
+        organizationId: string;
+        actor: string;
+    }>;
+    /** Federated sign-in (US4/US5) — provider port + account resolvers + URLs. */
+    oauthProvider?: OAuthProviderPort;
+    socialAccountResolvers?: SocialIdentityDeps;
+    backendBaseUrl?: string;
+    storefrontBaseUrl?: string;
+    adminBaseUrl?: string;
+    /**
+     * `specs/110-instance-repository/` T118c — required, where both were optional
+     * while a composition root supplied them. `mfa` resolves each from the owning
+     * identity module's published port now, so there is no composition that has
+     * one and not the other, and the optionality was a live divergence rather
+     * than a capability: the harness omitted both and no test could see it.
+     */
+    resolveAccountEmail: (subjectType: 'customer' | 'admin', subjectId: string) => Promise<string | null>;
+    verifyAccountPassword: (subjectType: 'customer' | 'admin', subjectId: string, password: string) => Promise<boolean>;
+}
+export interface MfaModuleHandle {
+    mfaLoginPort: MfaLoginPort;
+    challengeStore: ChallengeStore;
+    policyResolver: MfaPolicyResolver;
+    enrolmentService: MfaEnrolmentService | null;
+}
+export declare function mfaModule(options: MfaModuleOptions): {
+    plugin: ModuleAttach;
+    handle: () => MfaModuleHandle;
+};
+export {};
+//# sourceMappingURL=plugin.d.ts.map

package/dist/backend/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../src/backend/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,KAAK,EAAE,eAAe,EAAE,yBAAyB,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC3G,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,iBAAiB,EACjB,KAAK,cAAc,EACpB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAE1E,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,uCAAuC,CAAC;AAE/C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAO9E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAE5E;;;;;;;GAOG;AACH,KAAK,YAAY,GAAG,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAE5D;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,aAAa,CAAC;IAC/B,KAAK,EAAE,KAAK,CAAC;IACb,eAAe,EAAE,cAAc,CAAC;IAChC,eAAe,EAAE,SAAS,CAAC;IAC3B,4EAA4E;IAC5E,UAAU,EAAE,UAAU,CAAC;IACvB;;;;;OAKG;IACH,qBAAqB,EAAE,yBAAyB,CAAC;IACjD,cAAc,EAAE,eAAe,CAAC;IAChC,6EAA6E;IAC7E,uBAAuB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACvD,uDAAuD;IACvD,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,4EAA4E;IAC5E,eAAe,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,oBAAoB,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK;QAC7C,iBAAiB,EAAE,MAAM,CAAC;QAC1B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;KAC/B,CAAC;IACF,iFAAiF;IACjF,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,iBAAiB,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IACpE,qEAAqE;IACrE,8BAA8B,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9E,gFAAgF;IAChF,eAAe,EAAE,CACf,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxD,8EAA8E;IAC9E,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAClC,sBAAsB,CAAC,EAAE,kBAAkB,CAAC;IAC5C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,mBAAmB,EAAE,CACnB,WAAW,EAAE,UAAU,GAAG,OAAO,EACjC,SAAS,EAAE,MAAM,KACd,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC5B,qBAAqB,EAAE,CACrB,WAAW,EAAE,UAAU,GAAG,OAAO,EACjC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,OAAO,CAAC,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,YAAY,CAAC;IAC3B,cAAc,EAAE,cAAc,CAAC;IAC/B,cAAc,EAAE,iBAAiB,CAAC;IAClC,gBAAgB,EAAE,mBAAmB,GAAG,IAAI,CAAC;CAC9C;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG;IACpD,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,MAAM,eAAe,CAAC;CAC/B,CAoHA"}

package/dist/backend/plugin.js

@@ -0,0 +1,111 @@
+import { ChallengeStore } from './services/challenge-store.js';
+import { MfaPolicyResolver, } from './services/mfa-policy-resolver.js';
+import { MfaLoginService } from './services/mfa-login-service.js';
+import { MfaEnrolmentService } from './services/mfa-enrolment-service.js';
+import { MfaOrgPolicyService } from './services/mfa-org-policy-service.js';
+import { SocialIdentityService, } from './services/social-identity-service.js';
+import { SocialLinkService } from './services/social-link-service.js';
+import { SecretCipher } from './services/secret-cipher.js';
+import { registerMfaPublicRoutes } from './routes.public.js';
+import { registerMfaSelfServiceRoutes } from './routes.self-service.js';
+import { registerMfaAdminRoutes } from './routes.admin.js';
+import { registerMfaOrgRoutes } from './routes.org.js';
+import { registerMfaOAuthRoutes } from './routes.oauth.js';
+export function mfaModule(options) {
+    const challengeStore = new ChallengeStore(options.redis);
+    const policyResolver = new MfaPolicyResolver(options.settingsService, options.emFactory, options.resolveDefaultChannelId ?? (async () => null));
+    const cipher = options.secretEncryptionKey
+        ? new SecretCipher(options.secretEncryptionKey)
+        : null;
+    const enrolmentService = cipher
+        ? new MfaEnrolmentService(options.emFactory, cipher, options.auditLogService)
+        : null;
+    const loginService = new MfaLoginService(options.emFactory, challengeStore, policyResolver, enrolmentService ?? undefined);
+    const orgPolicyService = new MfaOrgPolicyService(options.emFactory, options.auditLogService);
+    // Deliberately not behind the `oauthProvider` check below: the links an
+    // account already holds stay listable and severable after an operator turns
+    // a provider off, which is precisely when somebody goes looking for them.
+    const socialLinkService = new SocialLinkService(options.emFactory, options.commandBus, options.customerPasswordState);
+    const plugin = async (app) => {
+        if (!enrolmentService)
+            return; // enrolment disabled without an encryption key
+        await registerMfaPublicRoutes(app, {
+            loginService,
+            sessionService: options.sessionService,
+            challengeStore,
+            enrolmentService,
+            auditLogService: options.auditLogService,
+        });
+        // Storefront customer self-service (US1).
+        await registerMfaSelfServiceRoutes(app, {
+            pathPrefix: '/api/v1/account/mfa',
+            subjectType: 'customer',
+            auditObjectType: 'customer_account',
+            requireGuard: options.requireCustomer,
+            resolveSubjectId: (req) => options.resolveCustomerActor(req).customerAccountId,
+            resolveOrganizationId: (req) => options.resolveCustomerActor(req).organizationId,
+            enrolmentService,
+            policyResolver,
+            socialLinkService,
+            auditLogService: options.auditLogService,
+            resolveAccountEmail: options.resolveAccountEmail,
+            verifyAccountPassword: options.verifyAccountPassword,
+        });
+        // Federated sign-in (US4 customer / US5 admin).
+        if (options.oauthProvider && options.socialAccountResolvers) {
+            const socialIdentityService = new SocialIdentityService(options.emFactory, options.socialAccountResolvers, options.auditLogService);
+            await registerMfaOAuthRoutes(app, {
+                oauthProvider: options.oauthProvider,
+                challengeStore,
+                policyResolver,
+                socialIdentityService,
+                sessionService: options.sessionService,
+                backendBaseUrl: options.backendBaseUrl ?? 'http://localhost:8080',
+                storefrontBaseUrl: options.storefrontBaseUrl ?? 'http://localhost:3000',
+                adminBaseUrl: options.adminBaseUrl ?? 'http://localhost:3002',
+            });
+        }
+        // Storefront org-admin enforcement (US3).
+        await registerMfaOrgRoutes(app, {
+            orgPolicyService,
+            auditLogService: options.auditLogService,
+            requireCustomer: options.requireCustomer,
+            resolveOrgAdmin: options.resolveOrgAdmin,
+        });
+        // Admin user self-service (US2) + admin reset (US6) + org enforcement (US3).
+        const { requireAdmin, resolveAdminActor } = options;
+        if (requireAdmin) {
+            await registerMfaSelfServiceRoutes(app, {
+                pathPrefix: '/api/v1/admin/account/mfa',
+                subjectType: 'admin',
+                auditObjectType: 'admin_user',
+                requireGuard: requireAdmin(),
+                resolveSubjectId: (req) => resolveAdminActor(req).adminUserId,
+                enrolmentService,
+                policyResolver,
+                socialLinkService,
+                auditLogService: options.auditLogService,
+                resolveAccountEmail: options.resolveAccountEmail,
+                verifyAccountPassword: options.verifyAccountPassword,
+            });
+            await registerMfaAdminRoutes(app, {
+                enrolmentService,
+                orgPolicyService,
+                auditLogService: options.auditLogService,
+                requireAdmin,
+                resolveAdminActor,
+                resolveOrganizationCustomerIds: options.resolveOrganizationCustomerIds,
+            });
+        }
+    };
+    return {
+        plugin,
+        handle: () => ({
+            mfaLoginPort: loginService,
+            challengeStore,
+            policyResolver,
+            enrolmentService,
+        }),
+    };
+}
+//# sourceMappingURL=plugin.js.map

package/dist/backend/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../src/backend/plugin.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,iBAAiB,GAElB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC3E,OAAO,EACL,qBAAqB,GAEtB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAEtE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AA2F3D,MAAM,UAAU,SAAS,CAAC,OAAyB;IAIjD,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,cAAc,GAAG,IAAI,iBAAiB,CAC1C,OAAO,CAAC,eAAe,EACvB,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,uBAAuB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,CACtD,CAAC;IAEF,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB;QACxC,CAAC,CAAC,IAAI,YAAY,CAAC,OAAO,CAAC,mBAAmB,CAAC;QAC/C,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,gBAAgB,GAAG,MAAM;QAC7B,CAAC,CAAC,IAAI,mBAAmB,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,eAAe,CAAC;QAC7E,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,YAAY,GAAG,IAAI,eAAe,CACtC,OAAO,CAAC,SAAS,EACjB,cAAc,EACd,cAAc,EACd,gBAAgB,IAAI,SAAS,CAC9B,CAAC;IACF,MAAM,gBAAgB,GAAG,IAAI,mBAAmB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IAC7F,wEAAwE;IACxE,4EAA4E;IAC5E,0EAA0E;IAC1E,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,CAC7C,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,qBAAqB,CAC9B,CAAC;IAEF,MAAM,MAAM,GAAiB,KAAK,EAAE,GAAG,EAAE,EAAE;QACzC,IAAI,CAAC,gBAAgB;YAAE,OAAO,CAAC,+CAA+C;QAC9E,MAAM,uBAAuB,CAAC,GAAG,EAAE;YACjC,YAAY;YACZ,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,cAAc;YACd,gBAAgB;YAChB,eAAe,EAAE,OAAO,CAAC,eAAe;SACzC,CAAC,CAAC;QACH,0CAA0C;QAC1C,MAAM,4BAA4B,CAAC,GAAG,EAAE;YACtC,UAAU,EAAE,qBAAqB;YACjC,WAAW,EAAE,UAAU;YACvB,eAAe,EAAE,kBAAkB;YACnC,YAAY,EAAE,OAAO,CAAC,eAAe;YACrC,gBAAgB,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,iBAAiB;YAC9E,qBAAqB,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,cAAc;YAChF,gBAAgB;YAChB,cAAc;YACd,iBAAiB;YACjB,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;YAChD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;SACrD,CAAC,CAAC;QACH,gDAAgD;QAChD,IAAI,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,sBAAsB,EAAE,CAAC;YAC5D,MAAM,qBAAqB,GAAG,IAAI,qBAAqB,CACrD,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,sBAAsB,EAC9B,OAAO,CAAC,eAAe,CACxB,CAAC;YACF,MAAM,sBAAsB,CAAC,GAAG,EAAE;gBAChC,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,cAAc;gBACd,cAAc;gBACd,qBAAqB;gBACrB,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,uBAAuB;gBACjE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,uBAAuB;gBACvE,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,uBAAuB;aAC9D,CAAC,CAAC;QACL,CAAC;QACD,0CAA0C;QAC1C,MAAM,oBAAoB,CAAC,GAAG,EAAE;YAC9B,gBAAgB;YAChB,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,eAAe,EAAE,OAAO,CAAC,eAAe;SACzC,CAAC,CAAC;QACH,6EAA6E;QAC7E,MAAM,EAAE,YAAY,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAAC;QACpD,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,4BAA4B,CAAC,GAAG,EAAE;gBACtC,UAAU,EAAE,2BAA2B;gBACvC,WAAW,EAAE,OAAO;gBACpB,eAAe,EAAE,YAAY;gBAC7B,YAAY,EAAE,YAAY,EAAE;gBAC5B,gBAAgB,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,WAAW;gBAC7D,gBAAgB;gBAChB,cAAc;gBACd,iBAAiB;gBACjB,eAAe,EAAE,OAAO,CAAC,eAAe;gBACxC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;gBAChD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;aACrD,CAAC,CAAC;YACH,MAAM,sBAAsB,CAAC,GAAG,EAAE;gBAChC,gBAAgB;gBAChB,gBAAgB;gBAChB,eAAe,EAAE,OAAO,CAAC,eAAe;gBACxC,YAAY;gBACZ,iBAAiB;gBACjB,8BAA8B,EAAE,OAAO,CAAC,8BAA8B;aACvE,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,MAAM;QACN,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACb,YAAY,EAAE,YAAY;YAC1B,cAAc;YACd,cAAc;YACd,gBAAgB;SACjB,CAAC;KACH,CAAC;AACJ,CAAC"}