@endora-commerce/mod-mfa 0.100.0

package/dist/migrations/20260611T140409_mfa_init.d.ts

@@ -0,0 +1,22 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * MFA module init (feature 042).
+ *
+ * Creates the four MFA-owned tables:
+ *   - mfa_enrolments            — per-account TOTP enrolment (encrypted secret)
+ *   - mfa_recovery_codes        — single-use backup codes (hashed)
+ *   - mfa_social_identities     — Google/Microsoft account links
+ *   - mfa_organization_policies — per-organization enforcement flag
+ *
+ * The legacy scaffolding columns (`customer_accounts.two_factor_secret`,
+ * `admin_users.two_factor_secret`, …) are SUPERSEDED by `mfa_enrolments` and
+ * left dormant (research §R8). No encrypted backfill is performed in SQL: the
+ * secret cipher runs in application code, and the legacy columns hold no
+ * live, confirmed enrolments (the earlier 2FA path was never wired). Any
+ * pre-existing user simply re-enrols from the security screen.
+ */
+export declare class Migration20260611T140409MfaInit extends Migration {
+    up(): Promise<void>;
+    down(): Promise<void>;
+}
+//# sourceMappingURL=20260611T140409_mfa_init.d.ts.map

package/dist/migrations/20260611T140409_mfa_init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260611T140409_mfa_init.d.ts","sourceRoot":"","sources":["../../src/migrations/20260611T140409_mfa_init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,+BAAgC,SAAQ,SAAS;IAC7C,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC;IAwFnB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAMrC"}

package/dist/migrations/20260611T140409_mfa_init.js

@@ -0,0 +1,94 @@
+import { Migration } from '@mikro-orm/migrations';
+/**
+ * MFA module init (feature 042).
+ *
+ * Creates the four MFA-owned tables:
+ *   - mfa_enrolments            — per-account TOTP enrolment (encrypted secret)
+ *   - mfa_recovery_codes        — single-use backup codes (hashed)
+ *   - mfa_social_identities     — Google/Microsoft account links
+ *   - mfa_organization_policies — per-organization enforcement flag
+ *
+ * The legacy scaffolding columns (`customer_accounts.two_factor_secret`,
+ * `admin_users.two_factor_secret`, …) are SUPERSEDED by `mfa_enrolments` and
+ * left dormant (research §R8). No encrypted backfill is performed in SQL: the
+ * secret cipher runs in application code, and the legacy columns hold no
+ * live, confirmed enrolments (the earlier 2FA path was never wired). Any
+ * pre-existing user simply re-enrols from the security screen.
+ */
+export class Migration20260611T140409MfaInit extends Migration {
+    async up() {
+        // --- mfa_enrolments -----------------------------------------------------
+        this.addSql(`
+      create table "mfa_enrolments" (
+        "id" uuid not null,
+        "subject_type" varchar(16) not null,
+        "subject_id" uuid not null,
+        "status" varchar(16) not null default 'pending',
+        "secret_ciphertext" bytea not null,
+        "secret_iv" bytea not null,
+        "secret_auth_tag" bytea not null,
+        "last_accepted_step" bigint null,
+        "confirmed_at" timestamptz null,
+        "created_at" timestamptz not null,
+        "updated_at" timestamptz not null,
+        constraint "mfa_enrolments_pkey" primary key ("id")
+      );
+    `);
+        this.addSql(`create index "mfa_enrolments_subject_type_index" on "mfa_enrolments" ("subject_type");`);
+        this.addSql(`create index "mfa_enrolments_subject_id_index" on "mfa_enrolments" ("subject_id");`);
+        // At most one active enrolment per subject.
+        this.addSql(`create unique index "mfa_enrolments_active_subject_unique" on "mfa_enrolments" ("subject_type", "subject_id") where "status" = 'active';`);
+        // --- mfa_recovery_codes -------------------------------------------------
+        this.addSql(`
+      create table "mfa_recovery_codes" (
+        "id" uuid not null,
+        "enrolment_id" uuid not null,
+        "code_hash" varchar(128) not null,
+        "used_at" timestamptz null,
+        "created_at" timestamptz not null,
+        constraint "mfa_recovery_codes_pkey" primary key ("id"),
+        constraint "mfa_recovery_codes_enrolment_fk" foreign key ("enrolment_id")
+          references "mfa_enrolments" ("id") on delete cascade
+      );
+    `);
+        this.addSql(`create index "mfa_recovery_codes_enrolment_id_index" on "mfa_recovery_codes" ("enrolment_id");`);
+        this.addSql(`create unique index "mfa_recovery_codes_enrolment_hash_unique" on "mfa_recovery_codes" ("enrolment_id", "code_hash");`);
+        // --- mfa_social_identities ----------------------------------------------
+        this.addSql(`
+      create table "mfa_social_identities" (
+        "id" uuid not null,
+        "subject_type" varchar(16) not null,
+        "subject_id" uuid not null,
+        "provider" varchar(16) not null,
+        "provider_subject" varchar(255) not null,
+        "email" varchar(320) not null,
+        "linked_at" timestamptz not null,
+        "last_used_at" timestamptz null,
+        constraint "mfa_social_identities_pkey" primary key ("id")
+      );
+    `);
+        this.addSql(`create unique index "mfa_social_identities_provider_subject_unique" on "mfa_social_identities" ("provider", "provider_subject");`);
+        this.addSql(`create unique index "mfa_social_identities_subject_provider_unique" on "mfa_social_identities" ("subject_type", "subject_id", "provider");`);
+        this.addSql(`create index "mfa_social_identities_provider_email_index" on "mfa_social_identities" ("provider", "email");`);
+        // --- mfa_organization_policies ------------------------------------------
+        this.addSql(`
+      create table "mfa_organization_policies" (
+        "id" uuid not null,
+        "organization_id" uuid not null,
+        "enforce_totp" boolean not null default false,
+        "updated_by_actor" varchar(64) null,
+        "created_at" timestamptz not null,
+        "updated_at" timestamptz not null,
+        constraint "mfa_organization_policies_pkey" primary key ("id"),
+        constraint "mfa_organization_policies_org_unique" unique ("organization_id")
+      );
+    `);
+    }
+    async down() {
+        this.addSql(`drop table if exists "mfa_organization_policies";`);
+        this.addSql(`drop table if exists "mfa_social_identities";`);
+        this.addSql(`drop table if exists "mfa_recovery_codes";`);
+        this.addSql(`drop table if exists "mfa_enrolments";`);
+    }
+}
+//# sourceMappingURL=20260611T140409_mfa_init.js.map

package/dist/migrations/20260611T140409_mfa_init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"20260611T140409_mfa_init.js","sourceRoot":"","sources":["../../src/migrations/20260611T140409_mfa_init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,+BAAgC,SAAQ,SAAS;IACnD,KAAK,CAAC,EAAE;QACf,2EAA2E;QAC3E,IAAI,CAAC,MAAM,CAAC;;;;;;;;;;;;;;;KAeX,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CACT,wFAAwF,CACzF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,oFAAoF,CACrF,CAAC;QACF,4CAA4C;QAC5C,IAAI,CAAC,MAAM,CACT,0IAA0I,CAC3I,CAAC;QAEF,2EAA2E;QAC3E,IAAI,CAAC,MAAM,CAAC;;;;;;;;;;;KAWX,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CACT,gGAAgG,CACjG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,uHAAuH,CACxH,CAAC;QAEF,2EAA2E;QAC3E,IAAI,CAAC,MAAM,CAAC;;;;;;;;;;;;KAYX,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CACT,kIAAkI,CACnI,CAAC;QACF,IAAI,CAAC,MAAM,CACT,4IAA4I,CAC7I,CAAC;QACF,IAAI,CAAC,MAAM,CACT,6GAA6G,CAC9G,CAAC;QAEF,2EAA2E;QAC3E,IAAI,CAAC,MAAM,CAAC;;;;;;;;;;;KAWX,CAAC,CAAC;IACL,CAAC;IAEQ,KAAK,CAAC,IAAI;QACjB,IAAI,CAAC,MAAM,CAAC,mDAAmD,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,CAAC,+CAA+C,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,4CAA4C,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,wCAAwC,CAAC,CAAC;IACxD,CAAC;CACF"}

package/dist/migrations/index.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The `./migrations` subpath — every migration class this module owns, as one
+ * ordered `migrations` array.
+ *
+ * The array is what the platform reads when this module is **installed**:
+ * `src/packages/package-runtime.ts` takes `exported['migrations']` and refuses
+ * the package outright when it is absent (D-168).
+ *
+ * Listed in ascending timestamp, which is the order of this module's own
+ * migrations and of nothing else (feature 081): a manifest `dependencies` array
+ * is the only thing ordering this block against another module's.
+ *
+ * The **named** exports stay beside the array, and the asymmetry with
+ * `./backend` — which publishes an array and no named class (D-168) — is
+ * deliberate. `db/migrations-registry.generated.ts` imports each class by name
+ * from this specifier, and a migration class name is contract in a way an entity
+ * class name is not: `mikro_orm_migrations` persists it, so it is a string every
+ * already-migrated database holds.
+ *
+ * A class that is in neither the array nor the barrel is a migration that does
+ * not run: `migration:pending` reports nothing pending and the first symptom is
+ * a query against a table nobody created.
+ */
+import { Migration20260611T140409MfaInit } from './20260611T140409_mfa_init.js';
+export declare const migrations: (typeof Migration20260611T140409MfaInit)[];
+export { Migration20260611T140409MfaInit, };
+//# sourceMappingURL=index.d.ts.map

package/dist/migrations/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/migrations/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AAEhF,eAAO,MAAM,UAAU,4CAEtB,CAAC;AAEF,OAAO,EACL,+BAA+B,GAChC,CAAC"}

package/dist/migrations/index.js

@@ -0,0 +1,29 @@
+/**
+ * The `./migrations` subpath — every migration class this module owns, as one
+ * ordered `migrations` array.
+ *
+ * The array is what the platform reads when this module is **installed**:
+ * `src/packages/package-runtime.ts` takes `exported['migrations']` and refuses
+ * the package outright when it is absent (D-168).
+ *
+ * Listed in ascending timestamp, which is the order of this module's own
+ * migrations and of nothing else (feature 081): a manifest `dependencies` array
+ * is the only thing ordering this block against another module's.
+ *
+ * The **named** exports stay beside the array, and the asymmetry with
+ * `./backend` — which publishes an array and no named class (D-168) — is
+ * deliberate. `db/migrations-registry.generated.ts` imports each class by name
+ * from this specifier, and a migration class name is contract in a way an entity
+ * class name is not: `mikro_orm_migrations` persists it, so it is a string every
+ * already-migrated database holds.
+ *
+ * A class that is in neither the array nor the barrel is a migration that does
+ * not run: `migration:pending` reports nothing pending and the first symptom is
+ * a query against a table nobody created.
+ */
+import { Migration20260611T140409MfaInit } from './20260611T140409_mfa_init.js';
+export const migrations = [
+    Migration20260611T140409MfaInit,
+];
+export { Migration20260611T140409MfaInit, };
+//# sourceMappingURL=index.js.map

package/dist/migrations/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/migrations/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AAEhF,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,+BAA+B;CAChC,CAAC;AAEF,OAAO,EACL,+BAA+B,GAChC,CAAC"}

package/i18n/en.json

@@ -0,0 +1,14 @@
+{
+  "adminRoles.permission.mfa:reset": "Reset a user's 2FA",
+  "adminRoles.permission.mfa:manage": "Manage 2FA policies and organization enforcement",
+  "errors.MFA_SOCIAL_LAST_CREDENTIAL": "This is the last sign-in identity linked to the account, and the account has no password on record — removing it could lock its holder out for good. Set a password for the account first, then this link can be removed.",
+  "errors.MFA_ALREADY_ENROLLED": "Two-factor authentication is already set up on this account, so there is nothing left to configure. To move it to a different authenticator app, switch it off first and then set it up again.",
+  "errors.MFA_INVALID_CHALLENGE": "This sign-in step is no longer valid — it has expired, or it was already finished. Sign in again to start a new one.",
+  "errors.MFA_INVALID_CODE": "That code was not accepted. A code from your authenticator app is only valid for about half a minute, so wait for the next one and enter it without spaces; a recovery code can be used only once.",
+  "errors.MFA_NOT_ENABLED": "Two-factor authentication is not available here, so it cannot be switched on for this account. Your administrator decides where it can be used — ask them to enable it.",
+  "errors.MFA_NO_ACTIVE_ENROLMENT": "Two-factor authentication is not switched on for this account, so there are no recovery codes to reissue. Set it up first — the codes are handed to you at the end of setup.",
+  "errors.MFA_NO_PENDING_ENROLMENT": "There is no setup waiting to be confirmed — it was either finished already, or started again somewhere else. Begin the setup again and scan the new QR code before entering a code.",
+  "errors.MFA_REAUTH_REQUIRED": "Switching two-factor authentication off has to be confirmed by you. Enter a current code from your authenticator app, or the password for this account.",
+  "errors.MFA_TOO_MANY_ATTEMPTS": "Too many incorrect codes were entered, so this sign-in attempt was stopped. Sign in again and use the next code straight from your authenticator app, or one of your recovery codes.",
+  "errors.MFA_WRONG_SURFACE": "This sign-in was started somewhere else, so the code cannot be confirmed here. Go back to the page you were signing in on and enter it there."
+}

package/i18n/pl.json

@@ -0,0 +1,14 @@
+{
+  "adminRoles.permission.mfa:reset": "Resetowanie 2FA użytkownika",
+  "adminRoles.permission.mfa:manage": "Zarządzanie politykami 2FA i wymuszaniem w Organizacji",
+  "errors.MFA_SOCIAL_LAST_CREDENTIAL": "To ostatnia tożsamość logowania powiązana z kontem, a konto nie ma zapisanego hasła — usunięcie jej mogłoby trwale odciąć dostęp do konta. Najpierw ustaw hasło do konta, a potem to powiązanie będzie można usunąć.",
+  "errors.MFA_ALREADY_ENROLLED": "Uwierzytelnianie dwuskładnikowe jest już skonfigurowane na tym koncie i nie ma nic więcej do ustawienia. Aby przenieść je do innej aplikacji uwierzytelniającej, najpierw je wyłącz, a potem skonfiguruj od nowa.",
+  "errors.MFA_INVALID_CHALLENGE": "Ten krok logowania nie jest już ważny — wygasł albo został już zakończony. Zaloguj się ponownie, aby rozpocząć nowy.",
+  "errors.MFA_INVALID_CODE": "Ten kod nie został przyjęty. Kod z aplikacji uwierzytelniającej jest ważny tylko przez około pół minuty, więc poczekaj na kolejny i wpisz go bez spacji; kodu odzyskiwania można użyć tylko raz.",
+  "errors.MFA_NOT_ENABLED": "Uwierzytelnianie dwuskładnikowe nie jest tu dostępne, więc nie można go włączyć na tym koncie. O tym, gdzie można z niego korzystać, decyduje administrator — poproś go o włączenie tej opcji.",
+  "errors.MFA_NO_ACTIVE_ENROLMENT": "Uwierzytelnianie dwuskładnikowe nie jest włączone na tym koncie, więc nie ma kodów odzyskiwania do wygenerowania na nowo. Najpierw je skonfiguruj — kody otrzymasz na końcu konfiguracji.",
+  "errors.MFA_NO_PENDING_ENROLMENT": "Nie ma konfiguracji czekającej na potwierdzenie — została już zakończona albo rozpoczęta na nowo w innym miejscu. Rozpocznij konfigurację jeszcze raz i zeskanuj nowy kod QR, zanim wpiszesz kod.",
+  "errors.MFA_REAUTH_REQUIRED": "Wyłączenie uwierzytelniania dwuskładnikowego musi zostać przez Ciebie potwierdzone. Podaj aktualny kod z aplikacji uwierzytelniającej albo hasło do tego konta.",
+  "errors.MFA_TOO_MANY_ATTEMPTS": "Wpisano zbyt wiele błędnych kodów, więc ta próba logowania została przerwana. Zaloguj się ponownie i użyj kolejnego kodu prosto z aplikacji uwierzytelniającej albo jednego z kodów odzyskiwania.",
+  "errors.MFA_WRONG_SURFACE": "To logowanie zostało rozpoczęte w innym miejscu, więc tego kodu nie można tu potwierdzić. Wróć na stronę, na której rozpoczęło się logowanie, i wpisz kod tam."
+}

package/package.json

@@ -0,0 +1,102 @@
+{
+  "name": "@endora-commerce/mod-mfa",
+  "version": "0.100.0",
+  "type": "module",
+  "sideEffects": false,
+  "description": "Two-factor authentication (TOTP + recovery codes) and Google/Microsoft sign-in, with per-scope enablement/enforcement and admin reset.",
+  "license": "MIT",
+  "endora": {
+    "type": "module",
+    "id": "mfa"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/endora-commerce/endora-commerce.git",
+    "directory": "packages/modules/mfa"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/manifest.d.ts",
+      "default": "./dist/manifest.js"
+    },
+    "./backend": {
+      "types": "./dist/backend/index.d.ts",
+      "default": "./dist/backend/index.js"
+    },
+    "./migrations": {
+      "types": "./dist/migrations/index.d.ts",
+      "default": "./dist/migrations/index.js"
+    },
+    "./admin": {
+      "types": "./dist/admin/index.d.ts",
+      "default": "./dist/admin/index.js"
+    },
+    "./tailwind.css": "./tailwind.css",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "i18n",
+    "tailwind.css"
+  ],
+  "engines": {
+    "node": ">=22.18.0"
+  },
+  "peerDependencies": {
+    "@fastify/cookie": "^11",
+    "@mikro-orm/core": "^6",
+    "@mikro-orm/migrations": "^6",
+    "@mikro-orm/postgresql": "^6",
+    "fastify": "^5",
+    "ioredis": "^5",
+    "lucide-react": "^1",
+    "openid-client": "^6",
+    "otpauth": "^9",
+    "react": "^19",
+    "zod": "^4",
+    "@endora-commerce/admin-kit": "0.100.0",
+    "@endora-commerce/contracts": "0.100.0",
+    "@endora-commerce/platform": "0.100.0"
+  },
+  "peerDependenciesMeta": {
+    "@endora-commerce/admin-kit": {
+      "optional": true
+    },
+    "lucide-react": {
+      "optional": true
+    },
+    "react": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@fastify/cookie": "^11.0.2",
+    "@fastify/type-provider-zod": "^1.0.0",
+    "@mikro-orm/core": "^6.6.13",
+    "@mikro-orm/migrations": "^6.6.13",
+    "@mikro-orm/postgresql": "^6.6.13",
+    "@types/node": "^22.9.0",
+    "@types/react": "^19.2.14",
+    "fastify": "^5.12.5",
+    "ioredis": "^5.10.1",
+    "lucide-react": "^1.11.0",
+    "openid-client": "^6.8.4",
+    "otpauth": "^9.5.0",
+    "react": "^19.2.5",
+    "typescript": "^5.9.3",
+    "vitest": "^4.1.11",
+    "zod": "^4.2.0",
+    "@endora-commerce/admin-kit": "0.100.0",
+    "@endora-commerce/platform": "0.100.0",
+    "@endora-commerce/contracts": "0.100.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json && tsc -p tsconfig.ui.json",
+    "typecheck": "tsc -p tsconfig.json && tsc -p tsconfig.ui.json --noEmit",
+    "lint": "eslint src",
+    "test": "vitest run"
+  }
+}

package/tailwind.css

@@ -0,0 +1,14 @@
+/* @endora-commerce/mod-mfa — AUTO-GENERATED by `pnpm --filter backend run manifests:generate`.
+ *
+ * The `@source` directives this package asks its host to scan
+ * (`specs/110-instance-repository/contracts/admin-stylesheet-composition.md` R1).
+ * They resolve relative to **this file**, so they hold wherever the package is
+ * installed — a workspace link here, `node_modules` in a client's instance.
+ *
+ * The `dist` line is what a published tarball ships and is what an instance
+ * scans; the `src` line is inert there and is what keeps `pnpm --filter admin
+ * run dev` reading source in this repository. Do not edit: run
+ * `pnpm --filter backend run manifests:generate`.
+ */
+@source "./dist/admin";
+@source "./src/admin";