@endora-commerce/mod-mfa 0.100.0

package/dist/backend/services/mfa-policy-resolver.js

@@ -0,0 +1,82 @@
+import { z } from 'zod';
+import { MFA_SETTING_CODES } from '@endora-commerce/contracts';
+import { MfaOrganizationPolicy } from '../entities/mfa-organization-policy.entity.js';
+export class MfaPolicyResolver {
+    settings;
+    emFactory;
+    resolveDefaultChannelId;
+    constructor(settings, emFactory, 
+    /**
+     * Resolves the system-default sales-channel id for a storefront request
+     * that arrived without one. `settingsService.get` requires a real channel
+     * uuid or `null`, so a literal sentinel cannot be used.
+     */
+    resolveDefaultChannelId = async () => null) {
+        this.settings = settings;
+        this.emFactory = emFactory;
+        this.resolveDefaultChannelId = resolveDefaultChannelId;
+    }
+    async resolve(subject, ctx) {
+        const isAdmin = subject.subjectType === 'admin';
+        // The admin surface has no storefront, so its four `mfa.admin.*` settings
+        // are platform-wide by nature: `null` reads `global_value ?? default_value`
+        // directly (feature 072, D-41 case c). It used to resolve the system-default
+        // *channel* and read there, then coerce a missing one to `''` — which is not
+        // a uuid, so the query threw in the driver and the `catch` below reported
+        // every policy as `false`, i.e. MFA quietly off.
+        //
+        // A storefront subject keeps its channel: `mfa.storefront.*` genuinely
+        // differs per storefront. With no request channel it falls back to the
+        // system default, and to platform-wide only if there is none.
+        const channelId = isAdmin
+            ? null
+            : ctx.salesChannelId ?? (await this.resolveDefaultChannelId());
+        const codes = isAdmin
+            ? {
+                enabled: MFA_SETTING_CODES.ADMIN_TOTP_ENABLED,
+                enforced: MFA_SETTING_CODES.ADMIN_TOTP_ENFORCED,
+                google: MFA_SETTING_CODES.ADMIN_GOOGLE_ENABLED,
+                microsoft: MFA_SETTING_CODES.ADMIN_MICROSOFT_ENABLED,
+            }
+            : {
+                enabled: MFA_SETTING_CODES.STOREFRONT_TOTP_ENABLED,
+                enforced: MFA_SETTING_CODES.STOREFRONT_TOTP_ENFORCED,
+                google: MFA_SETTING_CODES.STOREFRONT_GOOGLE_ENABLED,
+                microsoft: MFA_SETTING_CODES.STOREFRONT_MICROSOFT_ENABLED,
+            };
+        const [totpEnabledRaw, totpEnforcedRaw, googleEnabled, microsoftEnabled] = await Promise.all([
+            this.readBool(codes.enabled, channelId),
+            this.readBool(codes.enforced, channelId),
+            this.readBool(codes.google, channelId),
+            this.readBool(codes.microsoft, channelId),
+        ]);
+        // Organization enforcement is additive (customers only).
+        let orgEnforced = false;
+        if (!isAdmin && ctx.organizationId) {
+            orgEnforced = await this.readOrgEnforcement(ctx.organizationId);
+        }
+        const totpEnforced = totpEnforcedRaw || orgEnforced;
+        // Invariant FR-016: enforcement implies enablement.
+        const totpEnabled = totpEnabledRaw || totpEnforced;
+        return { totpEnabled, totpEnforced, googleEnabled, microsoftEnabled };
+    }
+    async readBool(code, channelId) {
+        try {
+            return await this.settings.get(code, channelId, z.boolean());
+        }
+        catch {
+            return false;
+        }
+    }
+    async readOrgEnforcement(organizationId) {
+        try {
+            const em = this.emFactory();
+            const policy = await em.findOne(MfaOrganizationPolicy, { organizationId });
+            return policy?.enforceTotp ?? false;
+        }
+        catch {
+            return false;
+        }
+    }
+}
+//# sourceMappingURL=mfa-policy-resolver.js.map

package/dist/backend/services/mfa-policy-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-policy-resolver.js","sourceRoot":"","sources":["../../../src/backend/services/mfa-policy-resolver.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAE/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,+CAA+C,CAAC;AA2BtF,MAAM,OAAO,iBAAiB;IAET;IACA;IAMA;IARnB,YACmB,QAAwB,EACxB,SAA8B;IAC/C;;;;OAIG;IACc,0BAAwD,KAAK,IAAI,EAAE,CAAC,IAAI;QAPxE,aAAQ,GAAR,QAAQ,CAAgB;QACxB,cAAS,GAAT,SAAS,CAAqB;QAM9B,4BAAuB,GAAvB,uBAAuB,CAAiD;IACxF,CAAC;IAEJ,KAAK,CAAC,OAAO,CACX,OAAsB,EACtB,GAAoB;QAEpB,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC;QAChD,0EAA0E;QAC1E,4EAA4E;QAC5E,6EAA6E;QAC7E,6EAA6E;QAC7E,0EAA0E;QAC1E,iDAAiD;QACjD,EAAE;QACF,uEAAuE;QACvE,uEAAuE;QACvE,8DAA8D;QAC9D,MAAM,SAAS,GAAG,OAAO;YACvB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,MAAM,IAAI,CAAC,uBAAuB,EAAE,CAAC,CAAC;QAEjE,MAAM,KAAK,GAAG,OAAO;YACnB,CAAC,CAAC;gBACE,OAAO,EAAE,iBAAiB,CAAC,kBAAkB;gBAC7C,QAAQ,EAAE,iBAAiB,CAAC,mBAAmB;gBAC/C,MAAM,EAAE,iBAAiB,CAAC,oBAAoB;gBAC9C,SAAS,EAAE,iBAAiB,CAAC,uBAAuB;aACrD;YACH,CAAC,CAAC;gBACE,OAAO,EAAE,iBAAiB,CAAC,uBAAuB;gBAClD,QAAQ,EAAE,iBAAiB,CAAC,wBAAwB;gBACpD,MAAM,EAAE,iBAAiB,CAAC,yBAAyB;gBACnD,SAAS,EAAE,iBAAiB,CAAC,4BAA4B;aAC1D,CAAC;QAEN,MAAM,CAAC,cAAc,EAAE,eAAe,EAAE,aAAa,EAAE,gBAAgB,CAAC,GACtE,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC;YACvC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC;YACxC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC;SAC1C,CAAC,CAAC;QAEL,yDAAyD;QACzD,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;YACnC,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,YAAY,GAAG,eAAe,IAAI,WAAW,CAAC;QACpD,oDAAoD;QACpD,MAAM,WAAW,GAAG,cAAc,IAAI,YAAY,CAAC;QAEnD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,CAAC;IACxE,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,SAAwB;QAC3D,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,cAAsB;QACrD,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,qBAAqB,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC;YAC3E,OAAO,MAAM,EAAE,WAAW,IAAI,KAAK,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF"}

package/dist/backend/services/oauth-provider-service.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Federated sign-in provider port (feature 042, US4/US5). The `mfa` routes
+ * depend on this interface; production wires the `openid-client`-backed
+ * implementation below, tests inject a deterministic fake. Provider client
+ * id/secret come from backend config/env — never the Settings table (R2).
+ */
+export type OAuthProviderName = 'google' | 'microsoft';
+export interface OAuthIdentity {
+    provider: OAuthProviderName;
+    /** Stable provider subject (`sub` claim). */
+    sub: string;
+    email: string;
+    emailVerified: boolean;
+}
+export interface OAuthProviderPort {
+    /** Whether the provider has client credentials configured. */
+    isEnabled(provider: OAuthProviderName): boolean;
+    buildAuthorizationUrl(provider: OAuthProviderName, args: {
+        state: string;
+        codeVerifier: string;
+        nonce: string;
+        redirectUri: string;
+    }): Promise<string>;
+    exchangeCode(provider: OAuthProviderName, args: {
+        code: string;
+        state: string;
+        codeVerifier: string;
+        nonce: string;
+        redirectUri: string;
+    }): Promise<OAuthIdentity>;
+}
+export interface OAuthProviderConfig {
+    google?: {
+        clientId: string;
+        clientSecret: string;
+    } | undefined;
+    microsoft?: {
+        clientId: string;
+        clientSecret: string;
+        tenant?: string | undefined;
+    } | undefined;
+}
+/** Builds the provider config from environment, or `null` when nothing is set. */
+export declare function readOAuthConfigFromEnv(env?: NodeJS.ProcessEnv): OAuthProviderConfig;
+export declare class OpenIdOAuthProvider implements OAuthProviderPort {
+    private readonly cfg;
+    private readonly configs;
+    constructor(cfg: OAuthProviderConfig);
+    isEnabled(provider: OAuthProviderName): boolean;
+    private config;
+    buildAuthorizationUrl(provider: OAuthProviderName, args: {
+        state: string;
+        codeVerifier: string;
+        nonce: string;
+        redirectUri: string;
+    }): Promise<string>;
+    exchangeCode(provider: OAuthProviderName, args: {
+        code: string;
+        state: string;
+        codeVerifier: string;
+        nonce: string;
+        redirectUri: string;
+    }): Promise<OAuthIdentity>;
+}
+//# sourceMappingURL=oauth-provider-service.d.ts.map

package/dist/backend/services/oauth-provider-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-provider-service.d.ts","sourceRoot":"","sources":["../../../src/backend/services/oauth-provider-service.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEvD,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,6CAA6C;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,8DAA8D;IAC9D,SAAS,CAAC,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC;IAChD,qBAAqB,CACnB,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAChF,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,YAAY,CACV,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE;QACJ,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,YAAY,EAAE,MAAM,CAAC;QACrB,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;KACrB,GACA,OAAO,CAAC,aAAa,CAAC,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAChE,SAAS,CAAC,EACN;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,GACvE,SAAS,CAAC;CACf;AAED,kFAAkF;AAClF,wBAAgB,sBAAsB,CAAC,GAAG,oBAAc,GAAG,mBAAmB,CAgB7E;AAED,qBAAa,mBAAoB,YAAW,iBAAiB;IAG/C,OAAO,CAAC,QAAQ,CAAC,GAAG;IAFhC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoD;gBAE/C,GAAG,EAAE,mBAAmB;IAErD,SAAS,CAAC,QAAQ,EAAE,iBAAiB,GAAG,OAAO;YAIjC,MAAM;IAwBd,qBAAqB,CACzB,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAChF,OAAO,CAAC,MAAM,CAAC;IAcZ,YAAY,CAChB,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE;QACJ,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,YAAY,EAAE,MAAM,CAAC;QACrB,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;KACrB,GACA,OAAO,CAAC,aAAa,CAAC;CAmB1B"}

package/dist/backend/services/oauth-provider-service.js

@@ -0,0 +1,80 @@
+import * as oidc from 'openid-client';
+/** Builds the provider config from environment, or `null` when nothing is set. */
+export function readOAuthConfigFromEnv(env = process.env) {
+    const cfg = {};
+    if (env['MFA_OAUTH_GOOGLE_CLIENT_ID'] && env['MFA_OAUTH_GOOGLE_CLIENT_SECRET']) {
+        cfg.google = {
+            clientId: env['MFA_OAUTH_GOOGLE_CLIENT_ID'],
+            clientSecret: env['MFA_OAUTH_GOOGLE_CLIENT_SECRET'],
+        };
+    }
+    if (env['MFA_OAUTH_MICROSOFT_CLIENT_ID'] && env['MFA_OAUTH_MICROSOFT_CLIENT_SECRET']) {
+        cfg.microsoft = {
+            clientId: env['MFA_OAUTH_MICROSOFT_CLIENT_ID'],
+            clientSecret: env['MFA_OAUTH_MICROSOFT_CLIENT_SECRET'],
+            tenant: env['MFA_OAUTH_MICROSOFT_TENANT'] ?? 'common',
+        };
+    }
+    return cfg;
+}
+export class OpenIdOAuthProvider {
+    cfg;
+    configs = new Map();
+    constructor(cfg) {
+        this.cfg = cfg;
+    }
+    isEnabled(provider) {
+        return provider === 'google' ? Boolean(this.cfg.google) : Boolean(this.cfg.microsoft);
+    }
+    async config(provider) {
+        const cached = this.configs.get(provider);
+        if (cached)
+            return cached;
+        if (provider === 'google') {
+            if (!this.cfg.google)
+                throw new Error('Google OAuth is not configured.');
+            const config = await oidc.discovery(new URL('https://accounts.google.com'), this.cfg.google.clientId, this.cfg.google.clientSecret);
+            this.configs.set(provider, config);
+            return config;
+        }
+        if (!this.cfg.microsoft)
+            throw new Error('Microsoft OAuth is not configured.');
+        const tenant = this.cfg.microsoft.tenant ?? 'common';
+        const config = await oidc.discovery(new URL(`https://login.microsoftonline.com/${tenant}/v2.0`), this.cfg.microsoft.clientId, this.cfg.microsoft.clientSecret);
+        this.configs.set(provider, config);
+        return config;
+    }
+    async buildAuthorizationUrl(provider, args) {
+        const config = await this.config(provider);
+        const codeChallenge = await oidc.calculatePKCECodeChallenge(args.codeVerifier);
+        const url = oidc.buildAuthorizationUrl(config, {
+            redirect_uri: args.redirectUri,
+            scope: 'openid email profile',
+            code_challenge: codeChallenge,
+            code_challenge_method: 'S256',
+            state: args.state,
+            nonce: args.nonce,
+        });
+        return url.href;
+    }
+    async exchangeCode(provider, args) {
+        const config = await this.config(provider);
+        const currentUrl = new URL(args.redirectUri);
+        currentUrl.searchParams.set('code', args.code);
+        currentUrl.searchParams.set('state', args.state);
+        const tokens = await oidc.authorizationCodeGrant(config, currentUrl, {
+            pkceCodeVerifier: args.codeVerifier,
+            expectedNonce: args.nonce,
+            expectedState: args.state,
+            idTokenExpected: true,
+        });
+        const claims = tokens.claims();
+        return {
+            provider,
+            sub: String(claims?.sub ?? ''),
+            email: typeof claims?.['email'] === 'string' ? claims['email'] : '',
+            emailVerified: claims?.['email_verified'] === true,
+        };
+    }
+}
+//# sourceMappingURL=oauth-provider-service.js.map

package/dist/backend/services/oauth-provider-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-provider-service.js","sourceRoot":"","sources":["../../../src/backend/services/oauth-provider-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AA4CtC,kFAAkF;AAClF,MAAM,UAAU,sBAAsB,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG;IACtD,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,IAAI,GAAG,CAAC,4BAA4B,CAAC,IAAI,GAAG,CAAC,gCAAgC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,MAAM,GAAG;YACX,QAAQ,EAAE,GAAG,CAAC,4BAA4B,CAAC;YAC3C,YAAY,EAAE,GAAG,CAAC,gCAAgC,CAAC;SACpD,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,+BAA+B,CAAC,IAAI,GAAG,CAAC,mCAAmC,CAAC,EAAE,CAAC;QACrF,GAAG,CAAC,SAAS,GAAG;YACd,QAAQ,EAAE,GAAG,CAAC,+BAA+B,CAAC;YAC9C,YAAY,EAAE,GAAG,CAAC,mCAAmC,CAAC;YACtD,MAAM,EAAE,GAAG,CAAC,4BAA4B,CAAC,IAAI,QAAQ;SACtD,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,OAAO,mBAAmB;IAGD;IAFZ,OAAO,GAAG,IAAI,GAAG,EAAyC,CAAC;IAE5E,YAA6B,GAAwB;QAAxB,QAAG,GAAH,GAAG,CAAqB;IAAG,CAAC;IAEzD,SAAS,CAAC,QAA2B;QACnC,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACxF,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,QAA2B;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACzE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CACjC,IAAI,GAAG,CAAC,6BAA6B,CAAC,EACtC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EACxB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAC7B,CAAC;YACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACnC,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,IAAI,QAAQ,CAAC;QACrD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CACjC,IAAI,GAAG,CAAC,qCAAqC,MAAM,OAAO,CAAC,EAC3D,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,EAC3B,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAChC,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,QAA2B,EAC3B,IAAiF;QAEjF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC/E,MAAM,GAAG,GAAG,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE;YAC7C,YAAY,EAAE,IAAI,CAAC,WAAW;YAC9B,KAAK,EAAE,sBAAsB;YAC7B,cAAc,EAAE,aAAa;YAC7B,qBAAqB,EAAE,MAAM;YAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,QAA2B,EAC3B,IAMC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC7C,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/C,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,UAAU,EAAE;YACnE,gBAAgB,EAAE,IAAI,CAAC,YAAY;YACnC,aAAa,EAAE,IAAI,CAAC,KAAK;YACzB,aAAa,EAAE,IAAI,CAAC,KAAK;YACzB,eAAe,EAAE,IAAI;SACtB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QAC/B,OAAO;YACL,QAAQ;YACR,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC;YAC9B,KAAK,EAAE,OAAO,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAM,CAAC,OAAO,CAAY,CAAC,CAAC,CAAC,EAAE;YAC/E,aAAa,EAAE,MAAM,EAAE,CAAC,gBAAgB,CAAC,KAAK,IAAI;SACnD,CAAC;IACJ,CAAC;CACF"}

package/dist/backend/services/recovery-codes.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Recovery (backup) code helpers (feature 042). Codes are shown once at
+ * activation/regeneration; only their SHA-256 hashes are stored. Matching is
+ * case-insensitive and whitespace-tolerant (the hash normalizes the input).
+ */
+export declare const RECOVERY_CODE_COUNT = 10;
+export declare function generateRecoveryCodes(count?: number): string[];
+export declare function hashRecoveryCode(code: string): string;
+export declare function normalizeRecoveryCode(code: string): string;
+//# sourceMappingURL=recovery-codes.d.ts.map

package/dist/backend/services/recovery-codes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-codes.d.ts","sourceRoot":"","sources":["../../../src/backend/services/recovery-codes.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAGtC,wBAAgB,qBAAqB,CAAC,KAAK,GAAE,MAA4B,GAAG,MAAM,EAAE,CAInF;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE1D"}

package/dist/backend/services/recovery-codes.js

@@ -0,0 +1,18 @@
+import { createHash, randomBytes } from 'crypto';
+/**
+ * Recovery (backup) code helpers (feature 042). Codes are shown once at
+ * activation/regeneration; only their SHA-256 hashes are stored. Matching is
+ * case-insensitive and whitespace-tolerant (the hash normalizes the input).
+ */
+export const RECOVERY_CODE_COUNT = 10;
+const CODE_BYTES = 5; // → 10 hex chars
+export function generateRecoveryCodes(count = RECOVERY_CODE_COUNT) {
+    return Array.from({ length: count }, () => randomBytes(CODE_BYTES).toString('hex').toUpperCase());
+}
+export function hashRecoveryCode(code) {
+    return createHash('sha256').update(normalizeRecoveryCode(code)).digest('hex');
+}
+export function normalizeRecoveryCode(code) {
+    return code.replace(/\s+/g, '').toUpperCase();
+}
+//# sourceMappingURL=recovery-codes.js.map

package/dist/backend/services/recovery-codes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-codes.js","sourceRoot":"","sources":["../../../src/backend/services/recovery-codes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAEjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AACtC,MAAM,UAAU,GAAG,CAAC,CAAC,CAAC,iBAAiB;AAEvC,MAAM,UAAU,qBAAqB,CAAC,QAAgB,mBAAmB;IACvE,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,CACxC,WAAW,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CACtD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAChD,CAAC"}

package/dist/backend/services/secret-cipher.d.ts

@@ -0,0 +1,16 @@
+export interface EncryptedSecret {
+    ciphertext: Buffer;
+    iv: Buffer;
+    authTag: Buffer;
+}
+export declare class SecretCipher {
+    private readonly key;
+    constructor(keyBase64: string);
+    /** Encrypt a plaintext secret (the base32 TOTP secret). */
+    encrypt(plaintext: string): EncryptedSecret;
+    /** Decrypt; throws if the ciphertext or tag has been tampered with. */
+    decrypt(secret: EncryptedSecret): string;
+}
+/** Timing-safe equality for two same-length hex/base64 strings. */
+export declare function safeEqual(a: string, b: string): boolean;
+//# sourceMappingURL=secret-cipher.d.ts.map

package/dist/backend/services/secret-cipher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-cipher.d.ts","sourceRoot":"","sources":["../../../src/backend/services/secret-cipher.ts"],"names":[],"mappings":"AAmBA,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;gBAEjB,SAAS,EAAE,MAAM;IAU7B,2DAA2D;IAC3D,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe;IAW3C,uEAAuE;IACvE,OAAO,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM;CASzC;AAED,mEAAmE;AACnE,wBAAgB,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAKvD"}

package/dist/backend/services/secret-cipher.js

@@ -0,0 +1,52 @@
+import { createCipheriv, createDecipheriv, randomBytes, timingSafeEqual, } from 'crypto';
+/**
+ * Authenticated encryption for the TOTP secret at rest (feature 042, R7).
+ *
+ * AES-256-GCM via Node's built-in crypto — no new dependency. The 32-byte key
+ * comes from `MFA_SECRET_ENCRYPTION_KEY` (base64). Each enrolment row stores
+ * its own random 12-byte IV and the GCM auth tag, so a leaked database does
+ * not yield working TOTP secrets.
+ */
+const ALGORITHM = 'aes-256-gcm';
+const IV_LENGTH = 12;
+const KEY_LENGTH = 32;
+export class SecretCipher {
+    key;
+    constructor(keyBase64) {
+        const key = Buffer.from(keyBase64, 'base64');
+        if (key.length !== KEY_LENGTH) {
+            throw new Error(`MFA_SECRET_ENCRYPTION_KEY must decode to ${KEY_LENGTH} bytes (got ${key.length}).`);
+        }
+        this.key = key;
+    }
+    /** Encrypt a plaintext secret (the base32 TOTP secret). */
+    encrypt(plaintext) {
+        const iv = randomBytes(IV_LENGTH);
+        const cipher = createCipheriv(ALGORITHM, this.key, iv);
+        const ciphertext = Buffer.concat([
+            cipher.update(plaintext, 'utf8'),
+            cipher.final(),
+        ]);
+        const authTag = cipher.getAuthTag();
+        return { ciphertext, iv, authTag };
+    }
+    /** Decrypt; throws if the ciphertext or tag has been tampered with. */
+    decrypt(secret) {
+        const decipher = createDecipheriv(ALGORITHM, this.key, secret.iv);
+        decipher.setAuthTag(secret.authTag);
+        const plaintext = Buffer.concat([
+            decipher.update(secret.ciphertext),
+            decipher.final(),
+        ]);
+        return plaintext.toString('utf8');
+    }
+}
+/** Timing-safe equality for two same-length hex/base64 strings. */
+export function safeEqual(a, b) {
+    const bufA = Buffer.from(a);
+    const bufB = Buffer.from(b);
+    if (bufA.length !== bufB.length)
+        return false;
+    return timingSafeEqual(bufA, bufB);
+}
+//# sourceMappingURL=secret-cipher.js.map

package/dist/backend/services/secret-cipher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-cipher.js","sourceRoot":"","sources":["../../../src/backend/services/secret-cipher.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,eAAe,GAChB,MAAM,QAAQ,CAAC;AAEhB;;;;;;;GAOG;AACH,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,UAAU,GAAG,EAAE,CAAC;AAQtB,MAAM,OAAO,YAAY;IACN,GAAG,CAAS;IAE7B,YAAY,SAAiB;QAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC7C,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,4CAA4C,UAAU,eAAe,GAAG,CAAC,MAAM,IAAI,CACpF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED,2DAA2D;IAC3D,OAAO,CAAC,SAAiB;QACvB,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACvD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;YAC/B,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC;YAChC,MAAM,CAAC,KAAK,EAAE;SACf,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACpC,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;IACrC,CAAC;IAED,uEAAuE;IACvE,OAAO,CAAC,MAAuB;QAC7B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAClE,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;YAClC,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC;QACH,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;CACF;AAED,mEAAmE;AACnE,MAAM,UAAU,SAAS,CAAC,CAAS,EAAE,CAAS;IAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC"}

package/dist/backend/services/social-identity-service.d.ts

@@ -0,0 +1,40 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import type { AuditPort } from '@endora-commerce/platform/kernel';
+import type { OAuthIdentity } from './oauth-provider-service.js';
+/**
+ * Resolves a federated identity to a platform account and records the link
+ * (feature 042, R6). Account find/create is delegated to injected ports so the
+ * `mfa` module never reaches into the customer/admin internals (Principle I):
+ *   - Storefront: match by verified email, else auto-create a standalone
+ *     customer (when registration-without-organization is allowed).
+ *   - Admin: match an existing admin user only — never auto-create.
+ */
+export interface SocialIdentityDeps {
+    resolveCustomerByEmail: (email: string) => Promise<{
+        id: string;
+    } | null>;
+    /** Returns the new account id, or null when standalone registration is off. */
+    autoCreateCustomer: (email: string) => Promise<{
+        id: string;
+    } | null>;
+    resolveAdminByEmail: (email: string) => Promise<{
+        id: string;
+    } | null>;
+}
+export type SocialSignInResult = {
+    ok: true;
+    subjectId: string;
+} | {
+    ok: false;
+    reason: 'unverified' | 'registration_required' | 'no_account';
+};
+export declare class SocialIdentityService {
+    private readonly emFactory;
+    private readonly deps;
+    private readonly auditLogService;
+    constructor(emFactory: () => EntityManager, deps: SocialIdentityDeps, auditLogService: AuditPort);
+    signInCustomer(identity: OAuthIdentity): Promise<SocialSignInResult>;
+    signInAdmin(identity: OAuthIdentity): Promise<SocialSignInResult>;
+    private upsertLink;
+}
+//# sourceMappingURL=social-identity-service.d.ts.map

package/dist/backend/services/social-identity-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"social-identity-service.d.ts","sourceRoot":"","sources":["../../../src/backend/services/social-identity-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAElE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,sBAAsB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAC1E,+EAA+E;IAC/E,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACtE,mBAAmB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CACxE;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,YAAY,GAAG,uBAAuB,GAAG,YAAY,CAAA;CAAE,CAAC;AAEjF,qBAAa,qBAAqB;IAE9B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,eAAe;gBAFf,SAAS,EAAE,MAAM,aAAa,EAC9B,IAAI,EAAE,kBAAkB,EACxB,eAAe,EAAE,SAAS;IAGvC,cAAc,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAmBpE,WAAW,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC;YAazD,UAAU;CA0BzB"}

package/dist/backend/services/social-identity-service.js

@@ -0,0 +1,69 @@
+import { MfaSocialIdentity } from '../entities/mfa-social-identity.entity.js';
+export class SocialIdentityService {
+    emFactory;
+    deps;
+    auditLogService;
+    constructor(emFactory, deps, auditLogService) {
+        this.emFactory = emFactory;
+        this.deps = deps;
+        this.auditLogService = auditLogService;
+    }
+    async signInCustomer(identity) {
+        if (!identity.emailVerified || !identity.email)
+            return { ok: false, reason: 'unverified' };
+        const existing = await this.deps.resolveCustomerByEmail(identity.email);
+        let account = existing;
+        let created = false;
+        if (!account) {
+            account = await this.deps.autoCreateCustomer(identity.email);
+            if (!account)
+                return { ok: false, reason: 'registration_required' };
+            created = true;
+        }
+        await this.upsertLink('customer', account.id, identity);
+        await this.auditLogService.record({
+            action: created ? 'mfa.social_account_created' : 'mfa.social_linked',
+            objectType: 'customer_account',
+            objectId: account.id,
+        });
+        return { ok: true, subjectId: account.id };
+    }
+    async signInAdmin(identity) {
+        if (!identity.emailVerified || !identity.email)
+            return { ok: false, reason: 'unverified' };
+        const account = await this.deps.resolveAdminByEmail(identity.email);
+        if (!account)
+            return { ok: false, reason: 'no_account' };
+        await this.upsertLink('admin', account.id, identity);
+        await this.auditLogService.record({
+            action: 'mfa.social_linked',
+            objectType: 'admin_user',
+            objectId: account.id,
+        });
+        return { ok: true, subjectId: account.id };
+    }
+    async upsertLink(subjectType, subjectId, identity) {
+        const em = this.emFactory();
+        let link = await em.findOne(MfaSocialIdentity, {
+            provider: identity.provider,
+            providerSubject: identity.sub,
+        });
+        if (!link) {
+            link = em.create(MfaSocialIdentity, {
+                subjectType,
+                subjectId,
+                provider: identity.provider,
+                providerSubject: identity.sub,
+                email: identity.email,
+                lastUsedAt: new Date(),
+            });
+            em.persist(link);
+        }
+        else {
+            link.email = identity.email;
+            link.lastUsedAt = new Date();
+        }
+        await em.flush();
+    }
+}
+//# sourceMappingURL=social-identity-service.js.map

package/dist/backend/services/social-identity-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"social-identity-service.js","sourceRoot":"","sources":["../../../src/backend/services/social-identity-service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAsB9E,MAAM,OAAO,qBAAqB;IAEb;IACA;IACA;IAHnB,YACmB,SAA8B,EAC9B,IAAwB,EACxB,eAA0B;QAF1B,cAAS,GAAT,SAAS,CAAqB;QAC9B,SAAI,GAAJ,IAAI,CAAoB;QACxB,oBAAe,GAAf,eAAe,CAAW;IAC1C,CAAC;IAEJ,KAAK,CAAC,cAAc,CAAC,QAAuB;QAC1C,IAAI,CAAC,QAAQ,CAAC,aAAa,IAAI,CAAC,QAAQ,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QAC3F,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACxE,IAAI,OAAO,GAAG,QAAQ,CAAC;QACvB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC7D,IAAI,CAAC,OAAO;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;YACpE,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QACxD,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;YAChC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,mBAAmB;YACpE,UAAU,EAAE,kBAAkB;YAC9B,QAAQ,EAAE,OAAO,CAAC,EAAE;SACrB,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,QAAuB;QACvC,IAAI,CAAC,QAAQ,CAAC,aAAa,IAAI,CAAC,QAAQ,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QAC3F,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACpE,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QACzD,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QACrD,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;YAChC,MAAM,EAAE,mBAAmB;YAC3B,UAAU,EAAE,YAAY;YACxB,QAAQ,EAAE,OAAO,CAAC,EAAE;SACrB,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;IAC7C,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,WAAiC,EACjC,SAAiB,EACjB,QAAuB;QAEvB,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,iBAAiB,EAAE;YAC7C,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,eAAe,EAAE,QAAQ,CAAC,GAAG;SAC9B,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,EAAE,CAAC,MAAM,CAAC,iBAAiB,EAAE;gBAClC,WAAW;gBACX,SAAS;gBACT,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,eAAe,EAAE,QAAQ,CAAC,GAAG;gBAC7B,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,UAAU,EAAE,IAAI,IAAI,EAAE;aACvB,CAAC,CAAC;YACH,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;YAC5B,IAAI,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;QAC/B,CAAC;QACD,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;CACF"}

package/dist/backend/services/social-link-service.d.ts

@@ -0,0 +1,63 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import type { CustomerPasswordStatePort, MfaSocialLinkSummary, MfaSocialProvider, MfaSubjectRef } from '@endora-commerce/contracts';
+import type { CommandBus } from '@endora-commerce/platform/commands';
+/**
+ * The account-holder's view of their federated identities, and the one write
+ * that removes one (issue #194).
+ *
+ * Separate from {@link SocialIdentityService}, which resolves an incoming
+ * provider identity to an account at sign-in and therefore needs the account
+ * resolvers and a configured provider. This surface needs neither: the links a
+ * subject already holds stay visible and severable after an operator switches a
+ * provider off, which is exactly when somebody wants to look at them.
+ *
+ * ## Why an unlink can be refused
+ *
+ * A customer auto-created by a federated sign-in is given a random password at
+ * signup (`customer_accounts/backend.ts`) — one nobody was ever told. So
+ * `password_hash is not null` is true for such an account and answers a
+ * different question from the one that matters here, which is whether the
+ * holder has a credential they can actually use.
+ *
+ * Issue #194 could not ask that question and therefore refused the **last**
+ * link of every account, absolutely. Issue #222 added the datum —
+ * `customer_accounts.password_set_at`, read here over
+ * {@link CustomerPasswordStatePort} — so the rule is now the narrower and
+ * truthful one: refuse the last link **only** while the account has no password
+ * on record. Where another link remains, or a password has been set, the
+ * removal goes through. An active TOTP enrolment still does not unblock it: a
+ * second factor is not a first one, and nobody signs in with TOTP alone.
+ *
+ * That is also what makes the sentence at the seam an instruction again. It
+ * told the holder to set a password first, then said plainly that there was no
+ * way out (!723), because with the rule counting links the instruction named a
+ * step that lifted nothing. It lifts it now, so the wording went back — in the
+ * thrown message and in `errors.MFA_SOCIAL_LAST_CREDENTIAL`, both languages.
+ *
+ * **The admin arm asks nobody.** An `AdminUser` cannot exist without a password
+ * somebody supplied: `AdminUserService.create` takes a required one (as does
+ * `createAdminUserRequestSchema`), and `SocialIdentityService.signInAdmin`
+ * matches an existing admin and refuses when there is none — there is no
+ * auto-create on that side to mint a random hash. So the answer is structurally
+ * `true` and a second column would record a constant.
+ * `test/unit/mfa/admin-password-is-structural.test.ts` is what keeps that
+ * premise from rotting quietly.
+ */
+export declare class SocialLinkService {
+    #private;
+    private readonly emFactory;
+    private readonly commandBus;
+    private readonly passwordState;
+    constructor(emFactory: () => EntityManager, commandBus: CommandBus, passwordState: CustomerPasswordStatePort);
+    /** The links this subject holds, in link order, each with its unlink verdict. */
+    list(subject: MfaSubjectRef): Promise<MfaSocialLinkSummary[]>;
+    /**
+     * Remove one provider link from this subject.
+     *
+     * Runs through the Command Bus (Constitution XIII): a security-relevant
+     * account change is audited co-transactionally, so a rollback takes the audit
+     * row with it.
+     */
+    unlink(subject: MfaSubjectRef, provider: MfaSocialProvider): Promise<void>;
+}
+//# sourceMappingURL=social-link-service.d.ts.map

package/dist/backend/services/social-link-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"social-link-service.d.ts","sourceRoot":"","sources":["../../../src/backend/services/social-link-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE3D,OAAO,KAAK,EACV,yBAAyB,EACzB,oBAAoB,EACpB,iBAAiB,EACjB,aAAa,EACd,MAAM,4BAA4B,CAAC;AAEpC,OAAO,KAAK,EAAW,UAAU,EAAE,MAAM,oCAAoC,CAAC;AAG9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,qBAAa,iBAAiB;;IAE1B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAFb,SAAS,EAAE,MAAM,aAAa,EAC9B,UAAU,EAAE,UAAU,EACtB,aAAa,EAAE,yBAAyB;IAG3D,iFAAiF;IAC3E,IAAI,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAkBnE;;;;;;OAMG;IACG,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;CAqDjF"}