@endora-commerce/mod-mfa 0.100.0

package/dist/backend/services/mfa-enrolment-service.js

@@ -0,0 +1,217 @@
+import { HttpError } from '@endora-commerce/platform/http';
+import { MfaEnrolment } from '../entities/mfa-enrolment.entity.js';
+import { MfaRecoveryCode } from '../entities/mfa-recovery-code.entity.js';
+import { recordAuditFromContext } from '@endora-commerce/platform/commands';
+import { generateRecoveryCodes, hashRecoveryCode, } from './recovery-codes.js';
+import { generateSecret, verifyTotpStep } from './totp.js';
+/**
+ * TOTP enrolment lifecycle (feature 042): setup → activate (issue recovery
+ * codes) → disable / regenerate, plus the second-factor verification used by
+ * the login flow. The TOTP secret is encrypted at rest via `SecretCipher`;
+ * recovery codes are stored only as SHA-256 hashes.
+ */
+export class MfaEnrolmentService {
+    emFactory;
+    cipher;
+    auditLog;
+    constructor(emFactory, cipher, auditLog) {
+        this.emFactory = emFactory;
+        this.cipher = cipher;
+        this.auditLog = auditLog;
+    }
+    #audit(em, action, subject) {
+        if (this.auditLog) {
+            recordAuditFromContext(this.auditLog, em, {
+                action,
+                objectType: 'mfa_enrolment',
+                objectId: `${subject.subjectType}:${subject.subjectId}`,
+                stateBefore: null,
+                stateAfter: null,
+            });
+        }
+    }
+    /** Begin (or restart) enrolment — creates a `pending` enrolment. */
+    async setup(subject, accountLabel) {
+        const em = this.emFactory();
+        const active = await em.findOne(MfaEnrolment, {
+            subjectType: subject.subjectType,
+            subjectId: subject.subjectId,
+            status: 'active',
+        });
+        if (active) {
+            throw new HttpError(409, 'MFA_ALREADY_ENROLLED', '2FA is already enabled for this account.');
+        }
+        // Replace any half-finished pending enrolment.
+        const pendings = await em.find(MfaEnrolment, {
+            subjectType: subject.subjectType,
+            subjectId: subject.subjectId,
+            status: 'pending',
+        });
+        for (const p of pendings)
+            em.remove(p);
+        const { secret, otpauthUri } = generateSecret(accountLabel);
+        const enc = this.cipher.encrypt(secret);
+        const enrolment = em.create(MfaEnrolment, {
+            subjectType: subject.subjectType,
+            subjectId: subject.subjectId,
+            status: 'pending',
+            secretCiphertext: enc.ciphertext,
+            secretIv: enc.iv,
+            secretAuthTag: enc.authTag,
+        });
+        em.persist(enrolment);
+        this.#audit(em, 'mfa.setup', subject);
+        await em.flush();
+        return { secret, otpauthUri };
+    }
+    /** Confirm the pending enrolment with a live code; issue recovery codes. */
+    async activate(subject, code) {
+        const em = this.emFactory();
+        const pending = await em.findOne(MfaEnrolment, {
+            subjectType: subject.subjectType,
+            subjectId: subject.subjectId,
+            status: 'pending',
+        });
+        if (!pending) {
+            throw new HttpError(400, 'MFA_NO_PENDING_ENROLMENT', 'No pending 2FA setup to confirm.');
+        }
+        const secret = this.decryptSecret(pending);
+        const step = verifyTotpStep(secret, code);
+        if (step === null) {
+            throw new HttpError(401, 'MFA_INVALID_CODE', 'The code is invalid or expired.');
+        }
+        pending.status = 'active';
+        pending.confirmedAt = new Date();
+        pending.lastAcceptedStep = String(step);
+        const codes = generateRecoveryCodes();
+        for (const c of codes) {
+            em.persist(em.create(MfaRecoveryCode, {
+                enrolmentId: pending.id,
+                codeHash: hashRecoveryCode(c),
+            }));
+        }
+        this.#audit(em, 'mfa.activate', subject);
+        await em.flush();
+        return { recoveryCodes: codes };
+    }
+    /**
+     * Admin reset — clear ALL enrolments (active + pending) for a subject.
+     * Recovery codes cascade. Returns whether anything was removed (so a bulk
+     * caller can report affected vs skipped). FR-025.
+     */
+    async reset(subject) {
+        const em = this.emFactory();
+        const affected = await em.nativeDelete(MfaEnrolment, {
+            subjectType: subject.subjectType,
+            subjectId: subject.subjectId,
+        });
+        if (affected > 0) {
+            this.#audit(em, 'mfa.reset', subject);
+            await em.flush();
+        }
+        return affected > 0;
+    }
+    /** Disable 2FA for the subject (idempotent). Removes secret + recovery codes. */
+    async disable(subject) {
+        const em = this.emFactory();
+        const active = await em.findOne(MfaEnrolment, {
+            subjectType: subject.subjectType,
+            subjectId: subject.subjectId,
+            status: 'active',
+        });
+        if (!active)
+            return;
+        await em.nativeDelete(MfaRecoveryCode, { enrolmentId: active.id });
+        this.#audit(em, 'mfa.disable', subject);
+        await em.removeAndFlush(active);
+    }
+    /** Invalidate the old recovery-code set and issue a fresh one. */
+    async regenerateRecoveryCodes(subject) {
+        const em = this.emFactory();
+        const active = await em.findOne(MfaEnrolment, {
+            subjectType: subject.subjectType,
+            subjectId: subject.subjectId,
+            status: 'active',
+        });
+        if (!active) {
+            throw new HttpError(400, 'MFA_NO_ACTIVE_ENROLMENT', '2FA is not enabled for this account.');
+        }
+        await em.nativeDelete(MfaRecoveryCode, { enrolmentId: active.id });
+        const codes = generateRecoveryCodes();
+        for (const c of codes) {
+            em.persist(em.create(MfaRecoveryCode, {
+                enrolmentId: active.id,
+                codeHash: hashRecoveryCode(c),
+            }));
+        }
+        this.#audit(em, 'mfa.regenerate_recovery_codes', subject);
+        await em.flush();
+        return { recoveryCodes: codes };
+    }
+    async status(subject) {
+        const em = this.emFactory();
+        const active = await em.findOne(MfaEnrolment, {
+            subjectType: subject.subjectType,
+            subjectId: subject.subjectId,
+            status: 'active',
+        });
+        if (!active)
+            return { totpActive: false, recoveryCodesRemaining: 0 };
+        const recoveryCodesRemaining = await em.count(MfaRecoveryCode, {
+            enrolmentId: active.id,
+            usedAt: null,
+        });
+        return { totpActive: true, recoveryCodesRemaining };
+    }
+    /**
+     * Verify a second factor (TOTP or recovery code) for an active enrolment.
+     * A 6-digit input is treated as a TOTP code (with replay guard); anything
+     * else is matched against unused recovery codes (single-use). Reports which
+     * factor matched so callers can audit recovery-code use.
+     */
+    async verifySecondFactor(subject, code) {
+        // command-coverage-ignore: per-login 2FA verification — advances the TOTP
+        // replay-guard step and consumes a one-time recovery code; auth-flow
+        // bookkeeping (the enrolment lifecycle setup/activate/disable is audited).
+        const em = this.emFactory();
+        const active = await em.findOne(MfaEnrolment, {
+            subjectType: subject.subjectType,
+            subjectId: subject.subjectId,
+            status: 'active',
+        });
+        if (!active)
+            return { ok: false };
+        const normalised = code.replace(/\s+/g, '');
+        if (/^\d{6}$/.test(normalised)) {
+            const secret = this.decryptSecret(active);
+            const step = verifyTotpStep(secret, normalised);
+            if (step === null)
+                return { ok: false };
+            // Replay guard — a step at or before the last accepted one is rejected.
+            if (active.lastAcceptedStep != null && Number(active.lastAcceptedStep) >= step) {
+                return { ok: false };
+            }
+            active.lastAcceptedStep = String(step);
+            await em.flush();
+            return { ok: true, factor: 'totp' };
+        }
+        const rc = await em.findOne(MfaRecoveryCode, {
+            enrolmentId: active.id,
+            codeHash: hashRecoveryCode(normalised),
+            usedAt: null,
+        });
+        if (!rc)
+            return { ok: false };
+        rc.usedAt = new Date();
+        await em.flush();
+        return { ok: true, factor: 'recovery' };
+    }
+    decryptSecret(enrolment) {
+        return this.cipher.decrypt({
+            ciphertext: enrolment.secretCiphertext,
+            iv: enrolment.secretIv,
+            authTag: enrolment.secretAuthTag,
+        });
+    }
+}
+//# sourceMappingURL=mfa-enrolment-service.js.map

package/dist/backend/services/mfa-enrolment-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-enrolment-service.js","sourceRoot":"","sources":["../../../src/backend/services/mfa-enrolment-service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAE3D,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAE1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAE5E,OAAO,EACL,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE3D;;;;;GAKG;AACH,MAAM,OAAO,mBAAmB;IAEX;IACA;IACA;IAHnB,YACmB,SAA8B,EAC9B,MAAoB,EACpB,QAAoB;QAFpB,cAAS,GAAT,SAAS,CAAqB;QAC9B,WAAM,GAAN,MAAM,CAAc;QACpB,aAAQ,GAAR,QAAQ,CAAY;IACpC,CAAC;IAEJ,MAAM,CAAC,EAAiB,EAAE,MAAc,EAAE,OAAsB;QAC9D,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,sBAAsB,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE;gBACxC,MAAM;gBACN,UAAU,EAAE,eAAe;gBAC3B,QAAQ,EAAE,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,SAAS,EAAE;gBACvD,WAAW,EAAE,IAAI;gBACjB,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,KAAK,CAAC,KAAK,CACT,OAAsB,EACtB,YAAoB;QAEpB,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE;YAC5C,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;QACH,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,sBAAsB,EAAE,0CAA0C,CAAC,CAAC;QAC/F,CAAC;QACD,+CAA+C;QAC/C,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE;YAC3C,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,SAAS;SAClB,CAAC,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAEvC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE;YACxC,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,SAAS;YACjB,gBAAgB,EAAE,GAAG,CAAC,UAAU;YAChC,QAAQ,EAAE,GAAG,CAAC,EAAE;YAChB,aAAa,EAAE,GAAG,CAAC,OAAO;SAC3B,CAAC,CAAC;QACH,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACtB,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;QACtC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAChC,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,QAAQ,CACZ,OAAsB,EACtB,IAAY;QAEZ,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE;YAC7C,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,SAAS;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,0BAA0B,EAAE,kCAAkC,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC1C,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,kBAAkB,EAAE,iCAAiC,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC;QAC1B,OAAO,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC;QACjC,OAAO,CAAC,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAExC,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;QACtC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,EAAE,CAAC,OAAO,CACR,EAAE,CAAC,MAAM,CAAC,eAAe,EAAE;gBACzB,WAAW,EAAE,OAAO,CAAC,EAAE;gBACvB,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC;aAC9B,CAAC,CACH,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;QACzC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAC,OAAsB;QAChC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE;YACnD,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC,CAAC;QACH,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;YACtC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;QACD,OAAO,QAAQ,GAAG,CAAC,CAAC;IACtB,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,OAAO,CAAC,OAAsB;QAClC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE;YAC5C,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,EAAE,CAAC,YAAY,CAAC,eAAe,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;QACxC,MAAM,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAED,kEAAkE;IAClE,KAAK,CAAC,uBAAuB,CAC3B,OAAsB;QAEtB,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE;YAC5C,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,yBAAyB,EAAE,sCAAsC,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,EAAE,CAAC,YAAY,CAAC,eAAe,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;QACtC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,EAAE,CAAC,OAAO,CACR,EAAE,CAAC,MAAM,CAAC,eAAe,EAAE;gBACzB,WAAW,EAAE,MAAM,CAAC,EAAE;gBACtB,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC;aAC9B,CAAC,CACH,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,+BAA+B,EAAE,OAAO,CAAC,CAAC;QAC1D,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,MAAM,CACV,OAAsB;QAEtB,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE;YAC5C,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,EAAE,CAAC;QACrE,MAAM,sBAAsB,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,eAAe,EAAE;YAC7D,WAAW,EAAE,MAAM,CAAC,EAAE;YACtB,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QACH,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;IACtD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB,CACtB,OAAsB,EACtB,IAAY;QAEZ,0EAA0E;QAC1E,qEAAqE;QACrE,2EAA2E;QAC3E,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE;YAC5C,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QAElC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC5C,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YAChD,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;YACxC,wEAAwE;YACxE,IAAI,MAAM,CAAC,gBAAgB,IAAI,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,IAAI,EAAE,CAAC;gBAC/E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;YACvB,CAAC;YACD,MAAM,CAAC,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YACvC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACtC,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE;YAC3C,WAAW,EAAE,MAAM,CAAC,EAAE;YACtB,QAAQ,EAAE,gBAAgB,CAAC,UAAU,CAAC;YACtC,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QACH,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QAC9B,EAAE,CAAC,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC1C,CAAC;IAEO,aAAa,CAAC,SAAuB;QAC3C,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;YACzB,UAAU,EAAE,SAAS,CAAC,gBAAgB;YACtC,EAAE,EAAE,SAAS,CAAC,QAAQ;YACtB,OAAO,EAAE,SAAS,CAAC,aAAa;SACjC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/backend/services/mfa-enrolment-state.service.d.ts

@@ -0,0 +1,27 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import type { MfaEnrolmentStatePort, MfaSubjectType } from '@endora-commerce/contracts';
+/**
+ * Who currently holds a second factor, for the surfaces that publish
+ * `twoFactorEnabled`.
+ *
+ * It lives here for the reason `MfaEnrolmentCountService` beside it does:
+ * `mfa_enrolments` is this module's table, and the two identity modules that
+ * publish the field own the *subject*, not its enrolment. Until this port
+ * existed each of them derived the field from a `two_factor_confirmed_at`
+ * column on its own table that no code has ever written — so the answer was a
+ * constant `false` on six responses, including the buyer's own account page.
+ *
+ * The read is a subset over the ids the caller already has, not a count and not
+ * a per-row lookup: every caller is a list surface, and one query per row
+ * behind `/admin-users` is how a correct field becomes a slow screen.
+ *
+ * `subjectId` is indexed and `status` is indexed; the pair is exactly the
+ * partial unique index the enrolment table was created with, so the subset is a
+ * single index scan.
+ */
+export declare class MfaEnrolmentStateService implements MfaEnrolmentStatePort {
+    private readonly emFactory;
+    constructor(emFactory: () => EntityManager);
+    activeSubjectIds(subjectType: MfaSubjectType, subjectIds: readonly string[]): Promise<string[]>;
+}
+//# sourceMappingURL=mfa-enrolment-state.service.d.ts.map

package/dist/backend/services/mfa-enrolment-state.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-enrolment-state.service.d.ts","sourceRoot":"","sources":["../../../src/backend/services/mfa-enrolment-state.service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAGxF;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,wBAAyB,YAAW,qBAAqB;IACxD,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,MAAM,aAAa;IAErD,gBAAgB,CACpB,WAAW,EAAE,cAAc,EAC3B,UAAU,EAAE,SAAS,MAAM,EAAE,GAC5B,OAAO,CAAC,MAAM,EAAE,CAAC;CASrB"}

package/dist/backend/services/mfa-enrolment-state.service.js

@@ -0,0 +1,33 @@
+import { MfaEnrolment } from '../entities/mfa-enrolment.entity.js';
+/**
+ * Who currently holds a second factor, for the surfaces that publish
+ * `twoFactorEnabled`.
+ *
+ * It lives here for the reason `MfaEnrolmentCountService` beside it does:
+ * `mfa_enrolments` is this module's table, and the two identity modules that
+ * publish the field own the *subject*, not its enrolment. Until this port
+ * existed each of them derived the field from a `two_factor_confirmed_at`
+ * column on its own table that no code has ever written — so the answer was a
+ * constant `false` on six responses, including the buyer's own account page.
+ *
+ * The read is a subset over the ids the caller already has, not a count and not
+ * a per-row lookup: every caller is a list surface, and one query per row
+ * behind `/admin-users` is how a correct field becomes a slow screen.
+ *
+ * `subjectId` is indexed and `status` is indexed; the pair is exactly the
+ * partial unique index the enrolment table was created with, so the subset is a
+ * single index scan.
+ */
+export class MfaEnrolmentStateService {
+    emFactory;
+    constructor(emFactory) {
+        this.emFactory = emFactory;
+    }
+    async activeSubjectIds(subjectType, subjectIds) {
+        if (subjectIds.length === 0)
+            return [];
+        const rows = await this.emFactory().find(MfaEnrolment, { status: 'active', subjectType, subjectId: { $in: [...new Set(subjectIds)] } }, { fields: ['subjectId'] });
+        return rows.map((row) => row.subjectId);
+    }
+}
+//# sourceMappingURL=mfa-enrolment-state.service.js.map

package/dist/backend/services/mfa-enrolment-state.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-enrolment-state.service.js","sourceRoot":"","sources":["../../../src/backend/services/mfa-enrolment-state.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAEnE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,wBAAwB;IACN;IAA7B,YAA6B,SAA8B;QAA9B,cAAS,GAAT,SAAS,CAAqB;IAAG,CAAC;IAE/D,KAAK,CAAC,gBAAgB,CACpB,WAA2B,EAC3B,UAA6B;QAE7B,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CACtC,YAAY,EACZ,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,EAC/E,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,CAC1B,CAAC;QACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;CACF"}

package/dist/backend/services/mfa-login-service.d.ts

@@ -0,0 +1,56 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import type { MfaLoginContext, MfaLoginDecision, MfaLoginPort, MfaSubjectRef } from '@endora-commerce/contracts';
+import type { ChallengeStore } from './challenge-store.js';
+import type { MfaPolicyResolver } from './mfa-policy-resolver.js';
+import type { MfaEnrolmentService } from './mfa-enrolment-service.js';
+/** Result of completing the second step. */
+export type MfaVerifyResult = {
+    ok: true;
+    subject: MfaSubjectRef;
+    factor: 'totp' | 'recovery';
+} | {
+    ok: false;
+    error: 'invalid_challenge';
+} | {
+    ok: false;
+    error: 'invalid_code' | 'locked';
+    subject: MfaSubjectRef;
+};
+/**
+ * Orchestrates the post-first-factor MFA decision (feature 042, R4).
+ * Implements the `MfaLoginPort` consumed by the login services.
+ *
+ * The second-step verification (`verifySecondFactor`) and the enrolment
+ * endpoints arrive with User Story 1; this Phase-2 slice provides the
+ * `beginLogin` decision so login can already return the two-step union while
+ * behaving as password-only until a subject actually enrols or enforcement is
+ * switched on.
+ */
+export declare class MfaLoginService implements MfaLoginPort {
+    private readonly emFactory;
+    private readonly challengeStore;
+    private readonly policyResolver;
+    /** Present once the cipher key is configured; required by `verifyChallenge`. */
+    private readonly enrolmentService?;
+    constructor(emFactory: () => EntityManager, challengeStore: ChallengeStore, policyResolver: MfaPolicyResolver, 
+    /** Present once the cipher key is configured; required by `verifyChallenge`. */
+    enrolmentService?: MfaEnrolmentService | undefined);
+    beginLogin(subject: MfaSubjectRef, ctx: MfaLoginContext): Promise<MfaLoginDecision>;
+    /**
+     * Whether the subject currently has an active TOTP enrolment.
+     *
+     * D-96.4 — no longer part of `MfaLoginPort`: it had no consumer in `src/`,
+     * and the port answers exactly one question now. Kept on the service because
+     * it is a fact about this module's own table.
+     */
+    isTwoFactorActive(subject: MfaSubjectRef): Promise<boolean>;
+    /**
+     * Complete the second step: verify the code against the challenge's subject.
+     * On failure, the attempt budget is decremented and the challenge burned when
+     * exhausted. On success the challenge is consumed and the subject returned so
+     * the route can mint the session.
+     */
+    verifyChallenge(challengeId: string, code: string): Promise<MfaVerifyResult>;
+    private findActiveEnrolment;
+}
+//# sourceMappingURL=mfa-login-service.d.ts.map

package/dist/backend/services/mfa-login-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-login-service.d.ts","sourceRoot":"","sources":["../../../src/backend/services/mfa-login-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EACV,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACd,MAAM,4BAA4B,CAAC;AAEpC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,4CAA4C;AAC5C,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAA;CAAE,GACjE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,mBAAmB,CAAA;CAAE,GACzC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,cAAc,GAAG,QAAQ,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,CAAC;AAE5E;;;;;;;;;GASG;AACH,qBAAa,eAAgB,YAAW,YAAY;IAEhD,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,gFAAgF;IAChF,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;gBAJjB,SAAS,EAAE,MAAM,aAAa,EAC9B,cAAc,EAAE,cAAc,EAC9B,cAAc,EAAE,iBAAiB;IAClD,gFAAgF;IAC/D,gBAAgB,CAAC,EAAE,mBAAmB,YAAA;IAGnD,UAAU,CACd,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,eAAe,GACnB,OAAO,CAAC,gBAAgB,CAAC;IAwB5B;;;;;;OAMG;IACG,iBAAiB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;IAIjE;;;;;OAKG;IACG,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;YAkBpE,mBAAmB;CAUlC"}

package/dist/backend/services/mfa-login-service.js

@@ -0,0 +1,89 @@
+import { MfaEnrolment } from '../entities/mfa-enrolment.entity.js';
+/**
+ * Orchestrates the post-first-factor MFA decision (feature 042, R4).
+ * Implements the `MfaLoginPort` consumed by the login services.
+ *
+ * The second-step verification (`verifySecondFactor`) and the enrolment
+ * endpoints arrive with User Story 1; this Phase-2 slice provides the
+ * `beginLogin` decision so login can already return the two-step union while
+ * behaving as password-only until a subject actually enrols or enforcement is
+ * switched on.
+ */
+export class MfaLoginService {
+    emFactory;
+    challengeStore;
+    policyResolver;
+    enrolmentService;
+    constructor(emFactory, challengeStore, policyResolver, 
+    /** Present once the cipher key is configured; required by `verifyChallenge`. */
+    enrolmentService) {
+        this.emFactory = emFactory;
+        this.challengeStore = challengeStore;
+        this.policyResolver = policyResolver;
+        this.enrolmentService = enrolmentService;
+    }
+    async beginLogin(subject, ctx) {
+        const active = await this.findActiveEnrolment(subject);
+        if (active) {
+            const challengeId = await this.challengeStore.issueChallenge({
+                subjectType: subject.subjectType,
+                subjectId: subject.subjectId,
+                salesChannelId: ctx.salesChannelId,
+            });
+            return { kind: 'challenge', challengeId };
+        }
+        const policy = await this.policyResolver.resolve(subject, ctx);
+        if (policy.totpEnforced) {
+            const setupTicket = await this.challengeStore.issueSetupTicket({
+                subjectType: subject.subjectType,
+                subjectId: subject.subjectId,
+                salesChannelId: ctx.salesChannelId,
+            });
+            return { kind: 'setup', setupTicket };
+        }
+        return { kind: 'proceed' };
+    }
+    /**
+     * Whether the subject currently has an active TOTP enrolment.
+     *
+     * D-96.4 — no longer part of `MfaLoginPort`: it had no consumer in `src/`,
+     * and the port answers exactly one question now. Kept on the service because
+     * it is a fact about this module's own table.
+     */
+    async isTwoFactorActive(subject) {
+        return (await this.findActiveEnrolment(subject)) !== null;
+    }
+    /**
+     * Complete the second step: verify the code against the challenge's subject.
+     * On failure, the attempt budget is decremented and the challenge burned when
+     * exhausted. On success the challenge is consumed and the subject returned so
+     * the route can mint the session.
+     */
+    async verifyChallenge(challengeId, code) {
+        if (!this.enrolmentService)
+            return { ok: false, error: 'invalid_challenge' };
+        const challenge = await this.challengeStore.getChallenge(challengeId);
+        if (!challenge)
+            return { ok: false, error: 'invalid_challenge' };
+        const subject = {
+            subjectType: challenge.subjectType,
+            subjectId: challenge.subjectId,
+        };
+        const verified = await this.enrolmentService.verifySecondFactor(subject, code);
+        if (!verified.ok) {
+            const remaining = await this.challengeStore.recordFailedAttempt(challengeId);
+            return { ok: false, error: remaining <= 0 ? 'locked' : 'invalid_code', subject };
+        }
+        await this.challengeStore.consumeChallenge(challengeId);
+        return { ok: true, subject, factor: verified.factor ?? 'totp' };
+    }
+    async findActiveEnrolment(subject) {
+        const em = this.emFactory();
+        return em.findOne(MfaEnrolment, {
+            subjectType: subject.subjectType,
+            subjectId: subject.subjectId,
+            status: 'active',
+        });
+    }
+}
+//# sourceMappingURL=mfa-login-service.js.map

package/dist/backend/services/mfa-login-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-login-service.js","sourceRoot":"","sources":["../../../src/backend/services/mfa-login-service.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAWnE;;;;;;;;;GASG;AACH,MAAM,OAAO,eAAe;IAEP;IACA;IACA;IAEA;IALnB,YACmB,SAA8B,EAC9B,cAA8B,EAC9B,cAAiC;IAClD,gFAAgF;IAC/D,gBAAsC;QAJtC,cAAS,GAAT,SAAS,CAAqB;QAC9B,mBAAc,GAAd,cAAc,CAAgB;QAC9B,mBAAc,GAAd,cAAc,CAAmB;QAEjC,qBAAgB,GAAhB,gBAAgB,CAAsB;IACtD,CAAC;IAEJ,KAAK,CAAC,UAAU,CACd,OAAsB,EACtB,GAAoB;QAEpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC;gBAC3D,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,cAAc,EAAE,GAAG,CAAC,cAAc;aACnC,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;QAC5C,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC/D,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,gBAAgB,CAAC;gBAC7D,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,cAAc,EAAE,GAAG,CAAC,cAAc;aACnC,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;QACxC,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,iBAAiB,CAAC,OAAsB;QAC5C,OAAO,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC;IAC5D,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CAAC,WAAmB,EAAE,IAAY;QACrD,IAAI,CAAC,IAAI,CAAC,gBAAgB;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;QAC7E,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QACtE,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;QAEjE,MAAM,OAAO,GAAkB;YAC7B,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,SAAS,EAAE,SAAS,CAAC,SAAS;SAC/B,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC/E,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;YAC7E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,EAAE,OAAO,EAAE,CAAC;QACnF,CAAC;QACD,MAAM,IAAI,CAAC,cAAc,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;QACxD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,MAAM,EAAE,CAAC;IAClE,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAC/B,OAAsB;QAEtB,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE;YAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/backend/services/mfa-org-policy-service.d.ts

@@ -0,0 +1,16 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import type { AuditPort } from '@endora-commerce/platform/kernel';
+/**
+ * Per-organization 2FA enforcement (feature 042, US3, FR-014). Owned by the
+ * `mfa` module; consulted additively by `MfaPolicyResolver`.
+ */
+export declare class MfaOrgPolicyService {
+    private readonly emFactory;
+    private readonly auditLog?;
+    constructor(emFactory: () => EntityManager, auditLog?: AuditPort | undefined);
+    setEnforcement(organizationId: string, enforceTotp: boolean, actor: string): Promise<{
+        enforceTotp: boolean;
+    }>;
+    getEnforcement(organizationId: string): Promise<boolean>;
+}
+//# sourceMappingURL=mfa-org-policy-service.d.ts.map

package/dist/backend/services/mfa-org-policy-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-org-policy-service.d.ts","sourceRoot":"","sources":["../../../src/backend/services/mfa-org-policy-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAG3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAElE;;;GAGG;AACH,qBAAa,mBAAmB;IAE5B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBADT,SAAS,EAAE,MAAM,aAAa,EAC9B,QAAQ,CAAC,EAAE,SAAS,YAAA;IAGjC,cAAc,CAClB,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,OAAO,EACpB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC;QAAE,WAAW,EAAE,OAAO,CAAA;KAAE,CAAC;IAuB9B,cAAc,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAK/D"}

package/dist/backend/services/mfa-org-policy-service.js

@@ -0,0 +1,43 @@
+import { MfaOrganizationPolicy } from '../entities/mfa-organization-policy.entity.js';
+import { recordAuditFromContext } from '@endora-commerce/platform/commands';
+/**
+ * Per-organization 2FA enforcement (feature 042, US3, FR-014). Owned by the
+ * `mfa` module; consulted additively by `MfaPolicyResolver`.
+ */
+export class MfaOrgPolicyService {
+    emFactory;
+    auditLog;
+    constructor(emFactory, auditLog) {
+        this.emFactory = emFactory;
+        this.auditLog = auditLog;
+    }
+    async setEnforcement(organizationId, enforceTotp, actor) {
+        const em = this.emFactory();
+        let policy = await em.findOne(MfaOrganizationPolicy, { organizationId });
+        if (!policy) {
+            policy = em.create(MfaOrganizationPolicy, { organizationId, enforceTotp, updatedByActor: actor });
+            em.persist(policy);
+        }
+        else {
+            policy.enforceTotp = enforceTotp;
+            policy.updatedByActor = actor;
+        }
+        if (this.auditLog) {
+            recordAuditFromContext(this.auditLog, em, {
+                action: 'mfa.set_org_enforcement',
+                objectType: 'mfa_organization_policy',
+                objectId: organizationId,
+                stateBefore: null,
+                stateAfter: { enforceTotp },
+            });
+        }
+        await em.flush();
+        return { enforceTotp };
+    }
+    async getEnforcement(organizationId) {
+        const em = this.emFactory();
+        const policy = await em.findOne(MfaOrganizationPolicy, { organizationId });
+        return policy?.enforceTotp ?? false;
+    }
+}
+//# sourceMappingURL=mfa-org-policy-service.js.map

package/dist/backend/services/mfa-org-policy-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-org-policy-service.js","sourceRoot":"","sources":["../../../src/backend/services/mfa-org-policy-service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,+CAA+C,CAAC;AACtF,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAG5E;;;GAGG;AACH,MAAM,OAAO,mBAAmB;IAEX;IACA;IAFnB,YACmB,SAA8B,EAC9B,QAAoB;QADpB,cAAS,GAAT,SAAS,CAAqB;QAC9B,aAAQ,GAAR,QAAQ,CAAY;IACpC,CAAC;IAEJ,KAAK,CAAC,cAAc,CAClB,cAAsB,EACtB,WAAoB,EACpB,KAAa;QAEb,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,IAAI,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,qBAAqB,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,qBAAqB,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;YAClG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,WAAW,GAAG,WAAW,CAAC;YACjC,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC;QAChC,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,sBAAsB,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE;gBACxC,MAAM,EAAE,yBAAyB;gBACjC,UAAU,EAAE,yBAAyB;gBACrC,QAAQ,EAAE,cAAc;gBACxB,WAAW,EAAE,IAAI;gBACjB,UAAU,EAAE,EAAE,WAAW,EAAE;aAC5B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO,EAAE,WAAW,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,cAAsB;QACzC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,qBAAqB,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3E,OAAO,MAAM,EAAE,WAAW,IAAI,KAAK,CAAC;IACtC,CAAC;CACF"}

package/dist/backend/services/mfa-policy-resolver.d.ts

@@ -0,0 +1,47 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import { z } from 'zod';
+import type { MfaLoginContext, MfaSubjectRef } from '@endora-commerce/contracts';
+/**
+ * Resolves the effective MFA policy for a subject (feature 042, R5).
+ *
+ * Reuses the Settings engine's most-specific-wins resolution: storefront
+ * settings read at the subject's sales channel (per-channel value → global →
+ * default); admin settings are read platform-wide, which since feature 072
+ * (D-41) has a spelling of its own — `null`. Organization enforcement is
+ * additive. The invariant `enforced ⇒ enabled` (FR-016) is applied here.
+ *
+ * Every settings read is defensive: if a setting is not yet registered (e.g. a
+ * narrow test that skips manifest seeding) the resolver treats it as `false`,
+ * so login degrades safely to password-only rather than erroring.
+ */
+export interface MfaResolvedPolicy {
+    totpEnabled: boolean;
+    totpEnforced: boolean;
+    googleEnabled: boolean;
+    microsoftEnabled: boolean;
+}
+/** The slice of SettingsService the resolver needs (port — not the class). */
+export interface SettingsReader {
+    get<T>(code: string, salesChannelId: string | null, schema: z.ZodType<T>): Promise<T>;
+}
+export declare class MfaPolicyResolver {
+    private readonly settings;
+    private readonly emFactory;
+    /**
+     * Resolves the system-default sales-channel id for a storefront request
+     * that arrived without one. `settingsService.get` requires a real channel
+     * uuid or `null`, so a literal sentinel cannot be used.
+     */
+    private readonly resolveDefaultChannelId;
+    constructor(settings: SettingsReader, emFactory: () => EntityManager, 
+    /**
+     * Resolves the system-default sales-channel id for a storefront request
+     * that arrived without one. `settingsService.get` requires a real channel
+     * uuid or `null`, so a literal sentinel cannot be used.
+     */
+    resolveDefaultChannelId?: () => Promise<string | null>);
+    resolve(subject: MfaSubjectRef, ctx: MfaLoginContext): Promise<MfaResolvedPolicy>;
+    private readBool;
+    private readOrgEnforcement;
+}
+//# sourceMappingURL=mfa-policy-resolver.d.ts.map

package/dist/backend/services/mfa-policy-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-policy-resolver.d.ts","sourceRoot":"","sources":["../../../src/backend/services/mfa-policy-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAGjF;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,OAAO,CAAC;IACtB,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED,8EAA8E;AAC9E,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACvF;AAED,qBAAa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,uBAAuB;gBAPvB,QAAQ,EAAE,cAAc,EACxB,SAAS,EAAE,MAAM,aAAa;IAC/C;;;;OAIG;IACc,uBAAuB,GAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAoB;IAGrF,OAAO,CACX,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,eAAe,GACnB,OAAO,CAAC,iBAAiB,CAAC;YAmDf,QAAQ;YAQR,kBAAkB;CASjC"}