@endora-commerce/mod-mfa 0.100.0

package/dist/backend/services/social-link-service.js

@@ -0,0 +1,121 @@
+import { ERROR_CODES } from '@endora-commerce/contracts';
+import { HttpError } from '@endora-commerce/platform/http';
+import { MfaSocialIdentity } from '../entities/mfa-social-identity.entity.js';
+/**
+ * The account-holder's view of their federated identities, and the one write
+ * that removes one (issue #194).
+ *
+ * Separate from {@link SocialIdentityService}, which resolves an incoming
+ * provider identity to an account at sign-in and therefore needs the account
+ * resolvers and a configured provider. This surface needs neither: the links a
+ * subject already holds stay visible and severable after an operator switches a
+ * provider off, which is exactly when somebody wants to look at them.
+ *
+ * ## Why an unlink can be refused
+ *
+ * A customer auto-created by a federated sign-in is given a random password at
+ * signup (`customer_accounts/backend.ts`) — one nobody was ever told. So
+ * `password_hash is not null` is true for such an account and answers a
+ * different question from the one that matters here, which is whether the
+ * holder has a credential they can actually use.
+ *
+ * Issue #194 could not ask that question and therefore refused the **last**
+ * link of every account, absolutely. Issue #222 added the datum —
+ * `customer_accounts.password_set_at`, read here over
+ * {@link CustomerPasswordStatePort} — so the rule is now the narrower and
+ * truthful one: refuse the last link **only** while the account has no password
+ * on record. Where another link remains, or a password has been set, the
+ * removal goes through. An active TOTP enrolment still does not unblock it: a
+ * second factor is not a first one, and nobody signs in with TOTP alone.
+ *
+ * That is also what makes the sentence at the seam an instruction again. It
+ * told the holder to set a password first, then said plainly that there was no
+ * way out (!723), because with the rule counting links the instruction named a
+ * step that lifted nothing. It lifts it now, so the wording went back — in the
+ * thrown message and in `errors.MFA_SOCIAL_LAST_CREDENTIAL`, both languages.
+ *
+ * **The admin arm asks nobody.** An `AdminUser` cannot exist without a password
+ * somebody supplied: `AdminUserService.create` takes a required one (as does
+ * `createAdminUserRequestSchema`), and `SocialIdentityService.signInAdmin`
+ * matches an existing admin and refuses when there is none — there is no
+ * auto-create on that side to mint a random hash. So the answer is structurally
+ * `true` and a second column would record a constant.
+ * `test/unit/mfa/admin-password-is-structural.test.ts` is what keeps that
+ * premise from rotting quietly.
+ */
+export class SocialLinkService {
+    emFactory;
+    commandBus;
+    passwordState;
+    constructor(emFactory, commandBus, passwordState) {
+        this.emFactory = emFactory;
+        this.commandBus = commandBus;
+        this.passwordState = passwordState;
+    }
+    /** The links this subject holds, in link order, each with its unlink verdict. */
+    async list(subject) {
+        const rows = await this.emFactory().find(MfaSocialIdentity, { subjectType: subject.subjectType, subjectId: subject.subjectId }, { orderBy: { linkedAt: 'asc' } });
+        // Only the single-link case can be blocked, so only it asks — a status call
+        // for an account with two links, or none, has nothing to look up.
+        const blocked = rows.length === 1 && !(await this.#hasPasswordOnRecord(subject));
+        return rows.map((row) => ({
+            provider: row.provider,
+            email: row.email,
+            linkedAt: row.linkedAt.toISOString(),
+            canUnlink: !blocked,
+            unlinkBlockedReason: blocked ? 'last_credential' : null,
+        }));
+    }
+    /**
+     * Remove one provider link from this subject.
+     *
+     * Runs through the Command Bus (Constitution XIII): a security-relevant
+     * account change is audited co-transactionally, so a rollback takes the audit
+     * row with it.
+     */
+    async unlink(subject, provider) {
+        await this.commandBus.run(this.#unlinkCommand(subject, provider));
+    }
+    #unlinkCommand(subject, provider) {
+        return {
+            action: 'mfa.social_unlink',
+            objectType: subject.subjectType === 'admin' ? 'admin_user' : 'customer_account',
+            objectId: subject.subjectId,
+            run: async ({ em }) => {
+                const where = { subjectType: subject.subjectType, subjectId: subject.subjectId };
+                const rows = await em.find(MfaSocialIdentity, where);
+                const target = rows.find((row) => row.provider === provider);
+                if (!target) {
+                    throw new HttpError(404, ERROR_CODES.NOT_FOUND, `No ${provider} identity is linked to this account.`);
+                }
+                if (rows.length <= 1 && !(await this.#hasPasswordOnRecord(subject))) {
+                    throw new HttpError(409, ERROR_CODES.MFA_SOCIAL_LAST_CREDENTIAL, 'This is the last sign-in identity linked to the account and it has no password on record: set a password for the account first, then it can be removed.');
+                }
+                const before = {
+                    provider: target.provider,
+                    email: target.email,
+                    linkedAt: target.linkedAt.toISOString(),
+                };
+                em.remove(target);
+                return { result: undefined, before, after: null };
+            },
+        };
+    }
+    /**
+     * Whether the subject has a password its holder can use.
+     *
+     * Deliberately not wrapped in a `catch`. `customer_accounts` declares itself
+     * non-deactivatable, so the gate on its port cannot be reached today — but a
+     * `catch` here would be the fail-open shape whatever the manifest says, and
+     * the wrong answer to this question removes somebody's last way into their
+     * account. A `ModuleDisabledError` must surface as 503, not as "no password
+     * on record" and not as "has one".
+     */
+    async #hasPasswordOnRecord(subject) {
+        // Structurally true — see the class doc block.
+        if (subject.subjectType === 'admin')
+            return true;
+        return (await this.passwordState.passwordSetAt(subject.subjectId)) !== null;
+    }
+}
+//# sourceMappingURL=social-link-service.js.map

package/dist/backend/services/social-link-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"social-link-service.js","sourceRoot":"","sources":["../../../src/backend/services/social-link-service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAOzD,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAE3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,OAAO,iBAAiB;IAET;IACA;IACA;IAHnB,YACmB,SAA8B,EAC9B,UAAsB,EACtB,aAAwC;QAFxC,cAAS,GAAT,SAAS,CAAqB;QAC9B,eAAU,GAAV,UAAU,CAAY;QACtB,kBAAa,GAAb,aAAa,CAA2B;IACxD,CAAC;IAEJ,iFAAiF;IACjF,KAAK,CAAC,IAAI,CAAC,OAAsB;QAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CACtC,iBAAiB,EACjB,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,EAClE,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CACjC,CAAC;QACF,4EAA4E;QAC5E,kEAAkE;QAClE,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC;QACjF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,QAAQ,EAAE,GAAG,CAAC,QAA6B;YAC3C,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE;YACpC,SAAS,EAAE,CAAC,OAAO;YACnB,mBAAmB,EAAE,OAAO,CAAC,CAAC,CAAE,iBAA2B,CAAC,CAAC,CAAC,IAAI;SACnE,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CAAC,OAAsB,EAAE,QAA2B;QAC9D,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,cAAc,CAAC,OAAsB,EAAE,QAA2B;QAChE,OAAO;YACL,MAAM,EAAE,mBAAmB;YAC3B,UAAU,EAAE,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,kBAAkB;YAC/E,QAAQ,EAAE,OAAO,CAAC,SAAS;YAC3B,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;gBACpB,MAAM,KAAK,GAAG,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;gBACjF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;gBACrD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;gBAC7D,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,SAAS,EACrB,MAAM,QAAQ,sCAAsC,CACrD,CAAC;gBACJ,CAAC;gBACD,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;oBACpE,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,0BAA0B,EACtC,yJAAyJ,CAC1J,CAAC;gBACJ,CAAC;gBACD,MAAM,MAAM,GAAG;oBACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE;iBACxC,CAAC;gBACF,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAClB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACpD,CAAC;SACF,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,oBAAoB,CAAC,OAAsB;QAC/C,+CAA+C;QAC/C,IAAI,OAAO,CAAC,WAAW,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QACjD,OAAO,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,KAAK,IAAI,CAAC;IAC9E,CAAC;CACF"}

package/dist/backend/services/totp.d.ts

@@ -0,0 +1,11 @@
+export declare function generateSecret(accountLabel: string): {
+    secret: string;
+    otpauthUri: string;
+};
+/**
+ * Verify a 6-digit code against a base32 secret. Returns the absolute TOTP
+ * time-step that matched (for the replay guard), or null if invalid. Accepts
+ * the ±1 step drift window.
+ */
+export declare function verifyTotpStep(secretBase32: string, code: string): number | null;
+//# sourceMappingURL=totp.d.ts.map

package/dist/backend/services/totp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.d.ts","sourceRoot":"","sources":["../../../src/backend/services/totp.ts"],"names":[],"mappings":"AAaA,wBAAgB,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB,CAWA;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAchF"}

package/dist/backend/services/totp.js

@@ -0,0 +1,46 @@
+import { TOTP, Secret } from 'otpauth';
+/**
+ * TOTP helpers (feature 042) using the already-present `otpauth` dependency.
+ * Same parameters as the platform's existing TOTP primitive
+ * for authenticator-app compatibility (the `auth` re-export shim it used to
+ * name was deleted once it had no importers).
+ */
+const ISSUER = 'B2B Platform';
+const PERIOD = 30;
+const DIGITS = 6;
+const ALGORITHM = 'SHA1';
+export function generateSecret(accountLabel) {
+    const secret = new Secret({ size: 20 });
+    const totp = new TOTP({
+        issuer: ISSUER,
+        label: accountLabel,
+        algorithm: ALGORITHM,
+        digits: DIGITS,
+        period: PERIOD,
+        secret,
+    });
+    return { secret: secret.base32, otpauthUri: totp.toString() };
+}
+/**
+ * Verify a 6-digit code against a base32 secret. Returns the absolute TOTP
+ * time-step that matched (for the replay guard), or null if invalid. Accepts
+ * the ±1 step drift window.
+ */
+export function verifyTotpStep(secretBase32, code) {
+    const normalised = code.replace(/\s+/g, '');
+    if (!/^\d{6}$/.test(normalised))
+        return null;
+    const totp = new TOTP({
+        issuer: ISSUER,
+        label: 'verify',
+        algorithm: ALGORITHM,
+        digits: DIGITS,
+        period: PERIOD,
+        secret: Secret.fromBase32(secretBase32),
+    });
+    const delta = totp.validate({ token: normalised, window: 1 });
+    if (delta === null)
+        return null;
+    return Math.floor(Date.now() / 1000 / PERIOD) + delta;
+}
+//# sourceMappingURL=totp.js.map

package/dist/backend/services/totp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.js","sourceRoot":"","sources":["../../../src/backend/services/totp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEvC;;;;;GAKG;AACH,MAAM,MAAM,GAAG,cAAc,CAAC;AAC9B,MAAM,MAAM,GAAG,EAAE,CAAC;AAClB,MAAM,MAAM,GAAG,CAAC,CAAC;AACjB,MAAM,SAAS,GAAG,MAAe,CAAC;AAElC,MAAM,UAAU,cAAc,CAAC,YAAoB;IAIjD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;QACpB,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,YAAY;QACnB,SAAS,EAAE,SAAS;QACpB,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,MAAM;QACd,MAAM;KACP,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,YAAoB,EAAE,IAAY;IAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;QACpB,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,QAAQ;QACf,SAAS,EAAE,SAAS;QACpB,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9D,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,MAAM,CAAC,GAAG,KAAK,CAAC;AACxD,CAAC"}

package/dist/manifest.d.ts

@@ -0,0 +1,184 @@
+/** Exposed for the settings ManifestReconciler (boot + test harness). */
+export declare const mfaSettingsManifest: {
+    moduleCode: string;
+    groups: {
+        code: string;
+        name: string;
+        salesChannelCodes?: string[] | undefined;
+        isSystemProtected?: boolean | undefined;
+    }[];
+    settings: {
+        code: string;
+        name: string;
+        valueType: "string" | "number" | "boolean" | "json" | "string_list" | "secret" | "credential_ref";
+        defaultValue: unknown;
+        description?: string | undefined;
+        groupCode?: string | undefined;
+        previousDefaultValues?: unknown[] | undefined;
+        salesChannelCodes?: string[] | undefined;
+        enumOptions?: string[] | undefined;
+        configurationType?: string | undefined;
+        hidden?: boolean | undefined;
+    }[];
+};
+export declare const manifest: {
+    id: string;
+    name: string;
+    version: string;
+    dependencies: string[];
+    description?: string | undefined;
+    acknowledgedDependencies?: {
+        moduleId: string;
+        port: string;
+        reason: string;
+    }[] | undefined;
+    nonBindingDependencies?: {
+        moduleId: string;
+        name: string;
+        kind: "contributes-to" | "degrades-without" | "refuses-without";
+        reason: string;
+        whenAbsent?: string | undefined;
+    }[] | undefined;
+    activation?: {
+        settingCode: string;
+        default: boolean;
+    } | {
+        nonDeactivatable: true;
+        reason: string;
+    } | undefined;
+    settings?: {
+        moduleCode: string;
+        groups: {
+            code: string;
+            name: string;
+            salesChannelCodes?: string[] | undefined;
+            isSystemProtected?: boolean | undefined;
+        }[];
+        settings: {
+            code: string;
+            name: string;
+            valueType: "string" | "number" | "boolean" | "json" | "string_list" | "secret" | "credential_ref";
+            defaultValue: unknown;
+            description?: string | undefined;
+            groupCode?: string | undefined;
+            previousDefaultValues?: unknown[] | undefined;
+            salesChannelCodes?: string[] | undefined;
+            enumOptions?: string[] | undefined;
+            configurationType?: string | undefined;
+            hidden?: boolean | undefined;
+        }[];
+    } | undefined;
+    i18n?: {
+        bundlesDir: string;
+    } | undefined;
+    docs?: false | {
+        dir: string;
+    } | undefined;
+    demo?: false | {
+        summary: string;
+        seed: (context: import("@endora-commerce/contracts").ModuleDemoContext<never>) => Promise<import("@endora-commerce/contracts").DemoSeedResult>;
+        reset: (context: import("@endora-commerce/contracts").ModuleDemoContext<never>) => Promise<import("@endora-commerce/contracts").DemoResetResult>;
+        after?: readonly string[] | undefined;
+        package?: string | undefined;
+    } | undefined;
+    actions?: {
+        id: string;
+        labelKey: string;
+        icon: "Plus" | "Sparkles" | "Settings" | "Search" | "Boxes" | "Layers" | "Menu" | "PlusCircle" | "PlusSquare" | "FilePlus" | "FolderPlus" | "Upload" | "FileUp" | "CloudUpload" | "Download" | "FileDown" | "FileText" | "BookOpen" | "Rss" | "Package" | "Tag" | "ShoppingCart" | "Receipt" | "CreditCard" | "Users" | "UserPlus" | "Inbox" | "ListChecks" | "ClipboardList" | "Image" | "Video" | "LayoutDashboard" | "PanelLeft" | "KeyRound" | "ShieldCheck" | "Edit" | "Archive" | "Box" | "Truck" | "CircleDollarSign" | "Activity" | "LineChart" | "Smartphone" | "Webhook" | "Scale" | "PlugZap" | "PercentDiamond" | "Newspaper" | "Languages" | "Eraser" | "Warehouse" | "TrendingDown" | "Bell" | "PackageOpen" | "Building2" | "Store" | "ClipboardCheck";
+        targetRoute: string;
+        keywords: string[];
+        weight: number;
+        descriptionKey?: string | undefined;
+        requiredPermission?: string | undefined;
+    }[] | undefined;
+    permissions?: {
+        code: string;
+        label: string;
+        module?: string | undefined;
+        description?: string | undefined;
+        requires?: string[] | undefined;
+    }[] | undefined;
+    transactionalEmails?: {
+        code: string;
+        name: string;
+        variables: {
+            key: string;
+            label: string;
+            sampleValue?: string | undefined;
+            description?: string | undefined;
+        }[];
+        description?: string | undefined;
+        group?: string | undefined;
+    }[] | undefined;
+    capabilities?: string[] | undefined;
+    exclusiveCapabilities?: {
+        key: string;
+        errorCode: string;
+    }[] | undefined;
+    errorCodes?: {
+        code: string;
+        tokens?: string[] | undefined;
+    }[] | undefined;
+    blocks?: {
+        name: string;
+        labelKey: string;
+        category: string;
+        contexts: ("email" | "invoice" | "cms" | "newsletter")[];
+        fields: Record<string, {
+            type: "number" | "object" | "array" | "text" | "textarea" | "select" | "radio" | "external" | "uuid" | "richtext";
+            label?: string | undefined;
+            required?: boolean | undefined;
+            options?: {
+                label: string;
+                value: string | number;
+            }[] | undefined;
+            refKind?: string | undefined;
+        }>;
+        descriptionKey?: string | undefined;
+        defaultProps?: Record<string, unknown> | undefined;
+        responsiveFields?: string[] | undefined;
+        previewIcon?: string | undefined;
+        weight?: number | undefined;
+    }[] | undefined;
+    blockCategories?: {
+        key: string;
+        titleKey: string;
+        contexts: ("email" | "invoice" | "cms" | "newsletter")[];
+        weight?: number | undefined;
+        visible?: boolean | undefined;
+    }[] | undefined;
+    env?: {
+        name: string;
+        describes: {
+            en: string;
+            pl: string;
+        };
+        requirement: {
+            kind: "required";
+        } | {
+            kind: "requiredWhen";
+            input: string;
+            equals: string;
+        } | {
+            kind: "optional";
+            without: {
+                en: string;
+                pl: string;
+            };
+        };
+        secret: boolean;
+        generable: boolean;
+        owner: {
+            kind: "platform";
+        } | {
+            kind: "application";
+            application: "admin" | "backend" | "storefront";
+        } | {
+            kind: "module";
+            moduleId: string;
+        };
+        consumers: ("admin" | "backend" | "storefront")[];
+        addressOf: "admin" | "backend" | "storefront" | null;
+    }[] | undefined;
+};
+//# sourceMappingURL=manifest.d.ts.map

package/dist/manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AA2GA,yEAAyE;AACzE,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;CAAW,CAAC;AAE5C,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsKnB,CAAC"}

package/dist/manifest.js

@@ -0,0 +1,264 @@
+import { defineModuleManifest, defineModuleSettingsManifest, MFA_SETTING_CODES, } from '@endora-commerce/contracts';
+/**
+ * MFA module — feature 042.
+ *
+ * Owns two-factor authentication (TOTP + recovery codes) and federated
+ * sign-in (Google / Microsoft) across the Storefront and Admin UI, plus the
+ * per-surface / per-channel / per-organization enablement & enforcement
+ * policy and Platform-Admin 2FA reset.
+ *
+ * `mfa` is a singular acronym module name — a documented Principle VI
+ * carve-out (see specs/042-mfa-authentication/plan.md Complexity Tracking).
+ *
+ * Provider client id/secret are supplied via backend config/env, NOT settings.
+ */
+const settings = defineModuleSettingsManifest({
+    moduleCode: 'mfa',
+    groups: [{ code: 'mfa', name: 'Security / MFA' }],
+    settings: [
+        {
+            // Feature 074 — the operator's activation control. Platform-wide, and
+            // never channel-scoped even though four of the policy switches below are:
+            // activation stops at `global_value` → `default_value` by construction.
+            code: MFA_SETTING_CODES.ACTIVATION,
+            name: 'MFA enabled',
+            description: 'Switches the whole module on or off: two-factor enrolment and challenges, the federated sign-in buttons, the per-organization enforcement policy and the admin reset screen. Nothing is dropped — enrolled secrets, recovery codes and every policy value stay in the database and apply again exactly as before when you switch it back on.',
+            groupCode: 'mfa',
+            valueType: 'boolean',
+            defaultValue: true,
+        },
+        {
+            code: MFA_SETTING_CODES.ADMIN_TOTP_ENABLED,
+            name: 'Admin UI — allow 2FA',
+            description: 'When enabled, admin users may set up TOTP two-factor authentication.',
+            groupCode: 'mfa',
+            valueType: 'boolean',
+            defaultValue: false,
+        },
+        {
+            code: MFA_SETTING_CODES.ADMIN_TOTP_ENFORCED,
+            name: 'Admin UI — enforce 2FA',
+            description: 'When enabled, admin users must complete 2FA setup before accessing the Admin UI.',
+            groupCode: 'mfa',
+            valueType: 'boolean',
+            defaultValue: false,
+        },
+        {
+            code: MFA_SETTING_CODES.STOREFRONT_TOTP_ENABLED,
+            name: 'Storefront — allow 2FA',
+            description: 'When enabled, customers may set up TOTP two-factor authentication. Can be overridden per sales channel.',
+            groupCode: 'mfa',
+            valueType: 'boolean',
+            defaultValue: false,
+        },
+        {
+            code: MFA_SETTING_CODES.STOREFRONT_TOTP_ENFORCED,
+            name: 'Storefront — enforce 2FA',
+            description: 'When enabled, customers must complete 2FA setup before using the storefront. Can be overridden per sales channel.',
+            groupCode: 'mfa',
+            valueType: 'boolean',
+            defaultValue: false,
+        },
+        {
+            code: MFA_SETTING_CODES.ADMIN_GOOGLE_ENABLED,
+            name: 'Admin UI — Google sign-in',
+            description: 'Allow admin users to sign in with Google (existing admin users only).',
+            groupCode: 'mfa',
+            valueType: 'boolean',
+            defaultValue: false,
+        },
+        {
+            code: MFA_SETTING_CODES.ADMIN_MICROSOFT_ENABLED,
+            name: 'Admin UI — Microsoft sign-in',
+            description: 'Allow admin users to sign in with Microsoft (existing admin users only).',
+            groupCode: 'mfa',
+            valueType: 'boolean',
+            defaultValue: false,
+        },
+        {
+            code: MFA_SETTING_CODES.STOREFRONT_GOOGLE_ENABLED,
+            name: 'Storefront — Google sign-in',
+            description: 'Allow customers to sign in with Google. Can be overridden per sales channel.',
+            groupCode: 'mfa',
+            valueType: 'boolean',
+            defaultValue: false,
+        },
+        {
+            code: MFA_SETTING_CODES.STOREFRONT_MICROSOFT_ENABLED,
+            name: 'Storefront — Microsoft sign-in',
+            description: 'Allow customers to sign in with Microsoft. Can be overridden per sales channel.',
+            groupCode: 'mfa',
+            valueType: 'boolean',
+            defaultValue: false,
+        },
+    ],
+});
+/** Exposed for the settings ManifestReconciler (boot + test harness). */
+export const mfaSettingsManifest = settings;
+export const manifest = defineModuleManifest({
+    id: 'mfa',
+    name: 'MFA',
+    description: 'Two-factor authentication (TOTP + recovery codes) and Google/Microsoft sign-in, with per-scope enablement/enforcement and admin reset.',
+    version: '1.0.0',
+    /**
+     * What this module needs from the environment (`specs/117-instance-bring-up/`
+     * FR-002). Only what it **owns**: its reads of platform-owned names are
+     * satisfied by `packages/platform/src/env/index.ts`.
+     *
+     * Why each of these is not a Setting is its entry in
+     * `backend/scripts/ledgers/module-environment-inputs/mfa.ts`.
+     */
+    env: [
+        {
+            name: 'ADMIN_BASE_URL',
+            describes: {
+                en: 'Where the admin panel is, so that a link this instance mails an administrator opens their own installation.',
+                pl: 'Gdzie znajduje się panel administracyjny, aby link wysłany administratorowi otwierał jego własną instalację.',
+            },
+            requirement: {
+                kind: 'optional',
+                without: {
+                    en: 'A sign-in or recovery link mailed to an administrator points nowhere they can open — which matters most when the panel is on a host of its own.',
+                    pl: 'Link logowania lub odzyskiwania wysłany administratorowi prowadzi donikąd — co ma największe znaczenie, gdy panel stoi na osobnym hoście.',
+                },
+            },
+            secret: false,
+            generable: false,
+            owner: { kind: 'module', moduleId: 'mfa' },
+            consumers: ['backend'],
+            addressOf: 'admin',
+        },
+        {
+            name: 'MFA_SECRET_ENCRYPTION_KEY',
+            describes: {
+                en: 'The key that encrypts every stored second-factor secret, so a copy of the database is not a copy of everybody’s authenticator.',
+                pl: 'Klucz szyfrujący każdy zapisany sekret drugiego składnika, aby kopia bazy danych nie była kopią czyjegoś uwierzytelniacza.',
+            },
+            requirement: {
+                kind: 'optional',
+                without: {
+                    en: 'No second factor can be enrolled: the module serves its screens and refuses every enrolment, because it will not store a secret it cannot encrypt.',
+                    pl: 'Nie da się zarejestrować drugiego składnika: moduł udostępnia swoje ekrany i odmawia każdej rejestracji, bo nie zapisze sekretu, którego nie potrafi zaszyfrować.',
+                },
+            },
+            secret: true,
+            generable: true,
+            owner: { kind: 'module', moduleId: 'mfa' },
+            consumers: ['backend'],
+            addressOf: null,
+        },
+    ],
+    // `auth` owns `authSessionPort`, `requireAdmin` and the customer guard this
+    // module resolves; feature 072 made those container resolutions rather than
+    // constructor arguments, so the edge is real now and has to be declared.
+    // Feature 075 Phase C turned the session edge into the published port: the
+    // second factor mints its session over `authSessionPort`, so no `Session`
+    // entity and no `SessionService` class crosses into this module any more.
+    dependencies: ['admin_users', 'customer_accounts', 'organizations', 'settings', 'auth'],
+    settings,
+    // Feature 074 (Constitution XVII) — a control this module never had, so an
+    // operator could not decline it at all. Two-factor authentication is a client
+    // *security policy*, not a platform floor: a deployment behind a corporate
+    // SSO gateway or a VPN may run without it. The eight policy switches above
+    // stay where they are — they choose which factor a surface offers, which is a
+    // different question from whether the module is present. Default `true` so
+    // that merging this changes no deployment's state (FR-012).
+    activation: { settingCode: MFA_SETTING_CODES.ACTIVATION, default: true },
+    /**
+     * The operator-visible error codes this module owns (feature 090, D-182,
+     * `specs/090-module-owned-error-codes/`).
+     *
+     * The first ten entries are answer-preserving, not a judgement (§6.2 and
+     * §6.5), and were not written by hand: they are the verbatim output of the
+     * runbook's step-1 derivation over the frozen capture at
+     * `backend/test/fixtures/error-code-routing/chain-answers.ts`, which records
+     * what the prefix chain in `@endora-commerce/mod-i18n` answered at
+     * `49f3c6817`. Re-routing a code to a better owner was
+     * `specs/082-error-code-ownership/rulings.md` §9's remaining work, deliberately
+     * not done in Phase 3; the last two entries are that sweep arriving.
+     *
+     * **No shadow reaches this module, and that is a conclusion rather than a
+     * premise.** The chain is an ordered `if` and an earlier rule silently claims
+     * a later one's codes — it cost `inventory` two and gave `catalog` four
+     * (trap T1). Here the whole chain was read: the `MFA_` rule is second from
+     * last, no rule above it names an `MFA_`-prefixed code, and no misc set holds
+     * one, so the source reading and the answer reading coincide. The derivation
+     * was still run from the answer.
+     *
+     * **`TWO_FACTOR_REQUIRED` and `TWO_FACTOR_REQUIRED_BY_ROLE` were the codes a
+     * reader would look for here and not find** (trap T2). Both name this
+     * module's subject and neither carries the prefix, so they fell off the end
+     * of the chain to `core`, which is what the capture records; whether that was
+     * the right owner is the question §6.5 put out of scope. D-129's remaining
+     * sweep answers it — **both are declared below since MR 4** — and the entry
+     * after this list is the argument.
+     *
+     * **All ten of those are raised, and the spelling is why that had to be
+     * measured.**
+     * Nine of them are thrown as a bare string literal in the second argument of
+     * `new HttpError` — `throw new HttpError(409, 'MFA_ALREADY_ENROLLED', …)` —
+     * and only `MFA_SOCIAL_LAST_CREDENTIAL` is thrown as `ERROR_CODES.<CODE>`.
+     * Fourteen raise sites over `routes.public.ts`, `routes.self-service.ts`,
+     * `services/mfa-enrolment-service.ts` and `services/social-link-service.ts`,
+     * every code covered by at least one. A scan keyed on the `ERROR_CODES.`
+     * spelling sees one of the fourteen.
+     *
+     * No `tokens`, and it is derived rather than assumed. `refusalToken`
+     * (`packages/platform/src/http/error-envelope.ts`) reads `details.code` and
+     * nothing else, and **not one of the fourteen sites passes a fourth argument
+     * at all**, so there is nothing for it to read. The runbook's §5 raise-site
+     * scan agrees from the whole tree — it attributes the ten token-carrying
+     * codes to `core`, `invoices` and `carts` and names none of these — and so
+     * does the bundle from the other direction: ten `errors.<CODE>` keys in `en`
+     * and ten in `pl`, exactly these ten, and no `errors.<CODE>.<token>` key.
+     * There is no dead sentence in either direction and none of the ten is an
+     * `UNTRANSLATED_ERROR_CODES` entry.
+     *
+     * **`TWO_FACTOR_REQUIRED` and `TWO_FACTOR_REQUIRED_BY_ROLE` join them in
+     * D-129's remaining sweep, MR 4** (`d129-sweep.md` §5.2, Appendix A; D-186 in
+     * `specs/080-f4-real-scope/rulings.md`). D-121 T1 decides both: the noun is
+     * the second factor, which is this module's whole subject, and `_BY_ROLE`
+     * names `MfaOrganizationPolicy` — the per-role enforcement this module owns
+     * outright. Neither was a judgement about who throws them, because **nothing
+     * in the tree throws either**: they are members of `ERROR_CODES` that no raise
+     * site produces, which is the sweep's class D.
+     *
+     * **That is also why they arrive without a sentence, and why writing one
+     * would have been the wrong call.** Both carried a placeholder in `_i18n`'s
+     * bundle — `"Two Factor Required."` / `"Błąd: two factor required."`, the code
+     * rewritten twice — and D-186 §2 deletes a placeholder rather than moving it,
+     * because in this module's own bundle it would read as this module's answer
+     * and every instrument would count the code as translated for good.
+     * `d129-sweep.md` §5.4 keeps writing real prose available as the better
+     * outcome, and it is available whenever a raise site says what the refusal
+     * means. Here there is no raise site: a sentence would have to be invented
+     * from the code's own name, which is the placeholder again in longer words,
+     * and it would render for nobody. So both are `UNTRANSLATED_ERROR_CODES`
+     * entries under `mfa`, where the debt is findable and attached to the module
+     * that will write it if the refusal is ever implemented.
+     *
+     * They carry no `tokens` for the same reason the ten above do not, arrived at
+     * from the other end: there is no raise site to put a `details.code` on the
+     * wire.
+     */
+    errorCodes: [
+        { code: 'MFA_ALREADY_ENROLLED' },
+        { code: 'MFA_INVALID_CHALLENGE' },
+        { code: 'MFA_INVALID_CODE' },
+        { code: 'MFA_NOT_ENABLED' },
+        { code: 'MFA_NO_ACTIVE_ENROLMENT' },
+        { code: 'MFA_NO_PENDING_ENROLMENT' },
+        { code: 'MFA_REAUTH_REQUIRED' },
+        { code: 'MFA_SOCIAL_LAST_CREDENTIAL' },
+        { code: 'MFA_TOO_MANY_ATTEMPTS' },
+        { code: 'MFA_WRONG_SURFACE' },
+        { code: 'TWO_FACTOR_REQUIRED' },
+        { code: 'TWO_FACTOR_REQUIRED_BY_ROLE' },
+    ],
+    i18n: { bundlesDir: 'i18n' },
+    permissions: [
+        { code: 'mfa:reset', label: "Reset a user's 2FA" },
+        { code: 'mfa:manage', label: 'Manage 2FA policies and organization enforcement' },
+    ],
+});
+//# sourceMappingURL=manifest.js.map

package/dist/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,iBAAiB,GAClB,MAAM,4BAA4B,CAAC;AAEpC;;;;;;;;;;;;GAYG;AACH,MAAM,QAAQ,GAAG,4BAA4B,CAAC;IAC5C,UAAU,EAAE,KAAK;IACjB,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;IACjD,QAAQ,EAAE;QACR;YACE,sEAAsE;YACtE,0EAA0E;YAC1E,wEAAwE;YACxE,IAAI,EAAE,iBAAiB,CAAC,UAAU;YAClC,IAAI,EAAE,aAAa;YACnB,WAAW,EACT,8UAA8U;YAChV,SAAS,EAAE,KAAK;YAChB,SAAS,EAAE,SAAS;YACpB,YAAY,EAAE,IAAI;SACnB;QACD;YACE,IAAI,EAAE,iBAAiB,CAAC,kBAAkB;YAC1C,IAAI,EAAE,sBAAsB;YAC5B,WAAW,EAAE,sEAAsE;YACnF,SAAS,EAAE,KAAK;YAChB,SAAS,EAAE,SAAS;YACpB,YAAY,EAAE,KAAK;SACpB;QACD;YACE,IAAI,EAAE,iBAAiB,CAAC,mBAAmB;YAC3C,IAAI,EAAE,wBAAwB;YAC9B,WAAW,EACT,kFAAkF;YACpF,SAAS,EAAE,KAAK;YAChB,SAAS,EAAE,SAAS;YACpB,YAAY,EAAE,KAAK;SACpB;QACD;YACE,IAAI,EAAE,iBAAiB,CAAC,uBAAuB;YAC/C,IAAI,EAAE,wBAAwB;YAC9B,WAAW,EACT,yGAAyG;YAC3G,SAAS,EAAE,KAAK;YAChB,SAAS,EAAE,SAAS;YACpB,YAAY,EAAE,KAAK;SACpB;QACD;YACE,IAAI,EAAE,iBAAiB,CAAC,wBAAwB;YAChD,IAAI,EAAE,0BAA0B;YAChC,WAAW,EACT,mHAAmH;YACrH,SAAS,EAAE,KAAK;YAChB,SAAS,EAAE,SAAS;YACpB,YAAY,EAAE,KAAK;SACpB;QACD;YACE,IAAI,EAAE,iBAAiB,CAAC,oBAAoB;YAC5C,IAAI,EAAE,2BAA2B;YACjC,WAAW,EAAE,uEAAuE;YACpF,SAAS,EAAE,KAAK;YAChB,SAAS,EAAE,SAAS;YACpB,YAAY,EAAE,KAAK;SACpB;QACD;YACE,IAAI,EAAE,iBAAiB,CAAC,uBAAuB;YAC/C,IAAI,EAAE,8BAA8B;YACpC,WAAW,EAAE,0EAA0E;YACvF,SAAS,EAAE,KAAK;YAChB,SAAS,EAAE,SAAS;YACpB,YAAY,EAAE,KAAK;SACpB;QACD;YACE,IAAI,EAAE,iBAAiB,CAAC,yBAAyB;YACjD,IAAI,EAAE,6BAA6B;YACnC,WAAW,EACT,8EAA8E;YAChF,SAAS,EAAE,KAAK;YAChB,SAAS,EAAE,SAAS;YACpB,YAAY,EAAE,KAAK;SACpB;QACD;YACE,IAAI,EAAE,iBAAiB,CAAC,4BAA4B;YACpD,IAAI,EAAE,gCAAgC;YACtC,WAAW,EACT,iFAAiF;YACnF,SAAS,EAAE,KAAK;YAChB,SAAS,EAAE,SAAS;YACpB,YAAY,EAAE,KAAK;SACpB;KACF;CACF,CAAC,CAAC;AAEH,yEAAyE;AACzE,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAQ,CAAC;AAE5C,MAAM,CAAC,MAAM,QAAQ,GAAG,oBAAoB,CAAC;IAC3C,EAAE,EAAE,KAAK;IACT,IAAI,EAAE,KAAK;IACX,WAAW,EACT,wIAAwI;IAC1I,OAAO,EAAE,OAAO;IAChB;;;;;;;OAOG;IACH,GAAG,EAAE;QACH;YACE,IAAI,EAAE,gBAAgB;YACtB,SAAS,EAAE;gBACT,EAAE,EAAE,6GAA6G;gBACjH,EAAE,EAAE,8GAA8G;aACnH;YACD,WAAW,EAAE;gBACX,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE;oBACP,EAAE,EAAE,iJAAiJ;oBACrJ,EAAE,EAAE,2IAA2I;iBAChJ;aACF;YACD,MAAM,EAAE,KAAK;YACb,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE;YAC1C,SAAS,EAAE,CAAC,SAAS,CAAC;YACtB,SAAS,EAAE,OAAO;SACnB;QACD;YACE,IAAI,EAAE,2BAA2B;YACjC,SAAS,EAAE;gBACT,EAAE,EAAE,gIAAgI;gBACpI,EAAE,EAAE,4HAA4H;aACjI;YACD,WAAW,EAAE;gBACX,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE;oBACP,EAAE,EAAE,oJAAoJ;oBACxJ,EAAE,EAAE,mKAAmK;iBACxK;aACF;YACD,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE;YAC1C,SAAS,EAAE,CAAC,SAAS,CAAC;YACtB,SAAS,EAAE,IAAI;SAChB;KACF;IACD,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,2EAA2E;IAC3E,0EAA0E;IAC1E,0EAA0E;IAC1E,YAAY,EAAE,CAAC,aAAa,EAAE,mBAAmB,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,CAAC;IACvF,QAAQ;IACR,2EAA2E;IAC3E,8EAA8E;IAC9E,2EAA2E;IAC3E,2EAA2E;IAC3E,8EAA8E;IAC9E,2EAA2E;IAC3E,4DAA4D;IAC5D,UAAU,EAAE,EAAE,WAAW,EAAE,iBAAiB,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE;IACxE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4EG;IACH,UAAU,EAAE;QACV,EAAE,IAAI,EAAE,sBAAsB,EAAE;QAChC,EAAE,IAAI,EAAE,uBAAuB,EAAE;QACjC,EAAE,IAAI,EAAE,kBAAkB,EAAE;QAC5B,EAAE,IAAI,EAAE,iBAAiB,EAAE;QAC3B,EAAE,IAAI,EAAE,yBAAyB,EAAE;QACnC,EAAE,IAAI,EAAE,0BAA0B,EAAE;QACpC,EAAE,IAAI,EAAE,qBAAqB,EAAE;QAC/B,EAAE,IAAI,EAAE,4BAA4B,EAAE;QACtC,EAAE,IAAI,EAAE,uBAAuB,EAAE;QACjC,EAAE,IAAI,EAAE,mBAAmB,EAAE;QAC7B,EAAE,IAAI,EAAE,qBAAqB,EAAE;QAC/B,EAAE,IAAI,EAAE,6BAA6B,EAAE;KACxC;IACD,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE;IAC5B,WAAW,EAAE;QACX,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,oBAAoB,EAAE;QAClD,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,kDAAkD,EAAE;KAClF;CACF,CAAC,CAAC"}