@homeflare/alchemy 0.5.0 → 0.7.0

package/src/openbao/mfa-totp-form.ts

@@ -0,0 +1,155 @@
+/**
+ * The form half of Bao.MfaTotpMethod — a TOTP login-MFA method, identified by its `method_name`.
+ *
+ * ★ READ FROM openbao v2.6.2 vault/identity/store.go:349-427 (fields) and vault/identity/mfa.go
+ *   parseTOTPConfig (:662-741): `issuer` is required; `algorithm` is SHA1|SHA256|SHA512; `digits`
+ *   6|8; `skew` 0|1; `period`, `key_size` above zero; `max_validation_attempts` 0 means the default
+ *   of 5 (:35). EVERY field is `d.Get`, so a write resets whatever it omits — every one is sent.
+ * ★ THE READ (login_mfa.go mfaConfigToMap :775-829) answers `period` in seconds and `algorithm` as
+ *   its name; `name`, `id` and `namespace_path` ride along.
+ * ⚠️ A CHANGED ALGORITHM, DIGITS OR PERIOD APPLIES TO NEW ENROLMENTS ONLY. Validation uses the
+ *   parameters stored with each entity's own secret (login_mfa.go validateTOTP :1520-1545), so an
+ *   enrolled admin keeps working — with the old parameters — until re-enrolled.
+ * ⛔ NO SECRET: the method holds no key. Each entity's TOTP secret is generated per entity by
+ *   `.../totp/generate` or `admin-generate`, which RETURNS it; this resource calls neither.
+ */
+import { sha256 } from './digest.ts';
+import { parseDuration, ttlSeconds } from './mount-form.ts';
+
+export type BaoTotpAlgorithm = 'SHA1' | 'SHA256' | 'SHA512';
+
+export interface BaoMfaTotpMethodProps {
+  /** `method_name` — the declarative key, unique per namespace. ⛔ A rename is refused (mfa-totp.ts). */
+  name: string;
+  /** The issuer an authenticator app shows, e.g. `vault-example`. */
+  issuer: string;
+  /** Code lifetime. Default `30s`. */
+  period?: string;
+  /** Secret size in bytes. Default 20. */
+  keySize?: number;
+  /** QR code size in pixels; `0` for none. Default 200. */
+  qrSize?: number;
+  /** Default `SHA1` — the one every authenticator app supports. */
+  algorithm?: BaoTotpAlgorithm;
+  /** Default 6. */
+  digits?: 6 | 8;
+  /** Periods of clock skew accepted. Default 1. */
+  skew?: 0 | 1;
+  /** Failed codes before the entity is locked out of this method. Default 5. */
+  maxValidationAttempts?: number;
+}
+
+export interface BaoMfaTotpCanonical {
+  algorithm: string;
+  digits: number;
+  issuer: string;
+  keySize: number;
+  maxValidationAttempts: number;
+  periodSeconds: number;
+  qrSize: number;
+  skew: number;
+}
+
+export interface BaoMfaTotpMethodAttributes extends BaoMfaTotpCanonical {
+  /** The server-made UUID — what a Bao.MfaLoginEnforcement names in `mfaMethodIds`. */
+  methodId: string;
+  name: string;
+  /** `''` for root, `team-a/` below it. */
+  namespacePath: string;
+  digest: string;
+}
+
+const canonical = (input: BaoMfaTotpCanonical): BaoMfaTotpCanonical => ({
+  algorithm: input.algorithm,
+  digits: input.digits,
+  issuer: input.issuer,
+  keySize: input.keySize,
+  maxValidationAttempts: input.maxValidationAttempts,
+  periodSeconds: input.periodSeconds,
+  qrSize: input.qrSize,
+  skew: input.skew,
+});
+
+export const canonicalFromProps = (props: BaoMfaTotpMethodProps): BaoMfaTotpCanonical =>
+  canonical({
+    algorithm: props.algorithm ?? 'SHA1',
+    digits: props.digits ?? 6,
+    issuer: props.issuer,
+    keySize: props.keySize ?? 20,
+    maxValidationAttempts: props.maxValidationAttempts ?? 5,
+    periodSeconds: parseDuration(props.period ?? '30s') ?? -1,
+    qrSize: props.qrSize ?? 200,
+    skew: props.skew ?? 1,
+  });
+
+const num = (value: unknown) => (typeof value === 'number' && Number.isFinite(value) ? value : -1);
+const text = (value: unknown) => (typeof value === 'string' ? value : '');
+
+export const canonicalFromLive = (live: Record<string, unknown>): BaoMfaTotpCanonical =>
+  canonical({
+    algorithm: text(live['algorithm']),
+    digits: num(live['digits']),
+    issuer: text(live['issuer']),
+    keySize: num(live['key_size']),
+    maxValidationAttempts: num(live['max_validation_attempts']),
+    periodSeconds: ttlSeconds(live['period']) ?? -1,
+    qrSize: num(live['qr_size']),
+    skew: num(live['skew']),
+  });
+
+export const attributesOf = (
+  methodId: string,
+  live: Record<string, unknown>,
+): BaoMfaTotpMethodAttributes => {
+  const form = canonicalFromLive(live);
+  return {
+    ...form,
+    digest: sha256(JSON.stringify(form)),
+    methodId,
+    name: text(live['name']),
+    namespacePath: text(live['namespace_path']),
+  };
+};
+
+export const matches = (attributes: BaoMfaTotpMethodAttributes, props: BaoMfaTotpMethodProps) =>
+  attributes.digest === sha256(JSON.stringify(canonicalFromProps(props)));
+
+/** The upsert body — by `method_name`, never `method_id` (mfa-wire.ts). */
+export const writeBody = (props: BaoMfaTotpMethodProps): Record<string, unknown> => {
+  const form = canonicalFromProps(props);
+  return {
+    algorithm: form.algorithm,
+    digits: form.digits,
+    issuer: form.issuer,
+    key_size: form.keySize,
+    max_validation_attempts: form.maxValidationAttempts,
+    method_name: props.name,
+    period: props.period ?? '30s',
+    qr_size: form.qrSize,
+    skew: form.skew,
+  };
+};
+
+/**
+ * The diff's refusal for a changed name, or undefined when the name is unchanged. Never a
+ * `replace`: the ⛔ on a rename in mfa-totp.ts says why.
+ */
+export const renameProblem = (from: string, to: string): string | undefined =>
+  from === to
+    ? undefined
+    : `renaming from \`${from}\` would strand every enrolled secret. Declare the new method as a ` +
+      'second resource, list both ids on the enforcement, enrol, then remove the old one ' +
+      '(mfa-totp.ts).';
+
+export const problems = (props: BaoMfaTotpMethodProps): readonly string[] => {
+  const found: string[] = [];
+  const form = canonicalFromProps(props);
+  if (props.name.trim() === '') found.push('name is empty; it is the only key a declaration has');
+  if (props.issuer.trim() === '') found.push('issuer is empty; the server requires one');
+  if (form.periodSeconds <= 0)
+    found.push(`period \`${props.period ?? ''}\` must be a duration above zero`);
+  if (form.keySize <= 0) found.push('keySize must be above zero');
+  if (form.maxValidationAttempts < 1)
+    found.push('maxValidationAttempts must be at least 1 (0 reads back as 5)');
+  return found;
+};

package/src/openbao/mfa-totp.ts

@@ -0,0 +1,118 @@
+/**
+ * A TOTP login-MFA method — `identity/mfa/method/totp`, found by `method_name`. The method is
+ * policy only: issuer, period, digits. Its `methodId` is what a Bao.MfaLoginEnforcement names.
+ *
+ * ⛔ A RENAME IS REFUSED, NOT REPLACED. A new name is a new method with a new id, and every entity's
+ *   enrolled secret belongs to the OLD id (login_mfa.go validateTOTP reads `entity.MFASecrets[id]`).
+ *   The enforcement would follow the new id in the same deploy, and every enrolled admin would then
+ *   fail MFA — with nobody left able to log in and re-enrol them. The safe move is additive: declare
+ *   the new method as a SECOND resource, list both ids on the enforcement (any one method passes,
+ *   login_mfa.go:831-858), enrol everyone, then drop the old one.
+ * ⛔ DELETING THE METHOD DESTROYS EVERY ENROLLED SECRET FOR IT (mfa-wire.ts deleteTotp) — and with
+ *   openbao/openbao#4030, a deleted enforcement can come back after a restart still naming this id,
+ *   failing every login it matches. `retain` is the default for exactly that reason.
+ *
+ * ★ REPLACE SEMANTICS (REPLACE.md): never `replace`. `name` changed → the plan FAILS (above); any
+ *   other field is an in-place `update`, because the upsert keeps the id.
+ */
+import { Resource } from 'alchemy';
+import { isResolved } from 'alchemy/Diff';
+import * as Provider from 'alchemy/Provider';
+import * as Effect from 'effect/Effect';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import type { BaoError } from './bao-status.ts';
+import {
+  type BaoMfaTotpMethodAttributes,
+  type BaoMfaTotpMethodProps,
+  attributesOf,
+  matches,
+  problems,
+  renameProblem,
+  writeBody,
+} from './mfa-totp-form.ts';
+import { deleteTotp, findTotp, writeTotp } from './mfa-wire.ts';
+
+export type {
+  BaoMfaTotpMethodAttributes,
+  BaoMfaTotpMethodProps,
+  BaoTotpAlgorithm,
+} from './mfa-totp-form.ts';
+
+export interface BaoMfaTotpMethod extends Resource<
+  'Bao.MfaTotpMethod',
+  BaoMfaTotpMethodProps,
+  BaoMfaTotpMethodAttributes,
+  never,
+  HttpClient.HttpClient
+> {}
+
+export const BaoMfaTotpMethod = Resource<BaoMfaTotpMethod>('Bao.MfaTotpMethod', {
+  defaultRemovalPolicy: 'retain',
+});
+
+const refuse = (props: BaoMfaTotpMethodProps, message: string): Effect.Effect<never> =>
+  Effect.die(new Error(`Bao.MfaTotpMethod ${props.name}: ${message}`));
+
+export const readTotp = (
+  props: BaoMfaTotpMethodProps,
+): Effect.Effect<BaoMfaTotpMethodAttributes | undefined, BaoError, HttpClient.HttpClient> =>
+  Effect.map(findTotp(props.name), (found) =>
+    found === undefined ? undefined : attributesOf(found.id, found.live),
+  );
+
+export const planTotp = (
+  props: BaoMfaTotpMethodProps,
+): Effect.Effect<'noop' | 'update', BaoError, HttpClient.HttpClient> =>
+  Effect.gen(function* () {
+    if (problems(props).length > 0) return 'update';
+    const live = yield* readTotp(props);
+    return live !== undefined && matches(live, props) ? 'noop' : 'update';
+  });
+
+/** Upsert by name when live differs, then prove it by reading back. */
+export const reconcileTotp = (
+  props: BaoMfaTotpMethodProps,
+): Effect.Effect<BaoMfaTotpMethodAttributes, BaoError, HttpClient.HttpClient> =>
+  Effect.gen(function* () {
+    const bad = problems(props);
+    if (bad.length > 0) return yield* refuse(props, bad.join('; '));
+    const live = yield* readTotp(props);
+    if (live === undefined || !matches(live, props)) yield* writeTotp(writeBody(props));
+    const after = yield* readTotp(props);
+    if (after === undefined)
+      return yield* refuse(props, 'the write succeeded but no method has that name.');
+    if (!matches(after, props)) return yield* refuse(props, 'the method read back different.');
+    return after;
+  });
+
+export const BaoMfaTotpMethodProvider = () =>
+  Provider.effect(
+    BaoMfaTotpMethod,
+    Effect.succeed(
+      BaoMfaTotpMethod.Provider.of({
+        /** ⛔ The namespace's method listing is not a list of things this owns. */
+        list: () => Effect.succeed([]),
+
+        read: Effect.fn(function* ({ olds }) {
+          return yield* readTotp(olds);
+        }),
+
+        diff: Effect.fn(function* ({ news, output }) {
+          if (output === undefined || !isResolved(news)) return undefined;
+          const rename = renameProblem(output.name, news.name);
+          if (rename !== undefined) return yield* refuse(news, rename);
+          return { action: yield* planTotp(news) } as const;
+        }),
+
+        reconcile: Effect.fn(function* ({ news }) {
+          return yield* reconcileTotp(news);
+        }),
+
+        /** ⛔ Read the header first. Idempotent: an unknown id deletes as success. */
+        delete: Effect.fn(function* ({ output }) {
+          yield* deleteTotp(output.methodId);
+          return undefined;
+        }),
+      }),
+    ),
+  );

package/src/openbao/mfa-wire.ts

@@ -0,0 +1,117 @@
+/**
+ * The OpenBao calls behind login MFA: TOTP methods under identity/mfa/method/totp, login
+ * enforcements under identity/mfa/login-enforcement/<name>, and the auth table that turns a mount
+ * path into the accessor an enforcement names.
+ *
+ * ★ OpenBao 2.6.2 SHIPS LOGIN MFA — confirmed in source before any of this was written:
+ *   vault/identity/store.go:312-800 (mfaPaths) registers `mfa/method/totp`, `mfa/login-enforcement/
+ *   <name>` and their listings on the identity backend; vault/identity/mfa.go holds the handlers
+ *   and vault/login_mfa.go the storage.
+ * ★ A TOTP METHOD IS FOUND BY NAME, NOT ID. The id is a server-made UUID; `method_name` is the only
+ *   thing a declaration can know. An update without `method_id` UPSERTS by name within the request's
+ *   namespace (identity/mfa.go:159-230, MemDBMFAConfigByName keys on namespace + name), so the same
+ *   write both creates and updates. The listing (`key_info`, one entry per id, :63-69) answers the
+ *   methods of this namespace AND its parents (login_mfa.go:652-713), so the match also requires
+ *   this namespace's `namespace_path`.
+ * ⛔ THE NAME INDEX IGNORES THE TYPE, SO THIS LISTS EVERY TYPE. login_mfa.go's `name` index is
+ *   (namespace_id, name) across all methods (:1642-1655, :1818), and handleMFAMethodUpdateCommon
+ *   then sets `mConfig.Type = "totp"` on whatever it found (identity/mfa.go:228). A TOTP write under
+ *   the name of a Duo or Okta method would silently CONVERT that method — and every enforcement
+ *   naming its id would start demanding a TOTP code nobody is enrolled for. The per-type listing
+ *   (`.../method/totp?list=true`) cannot see the clash, so this reads the global one
+ *   (`identity/mfa/method?list=true`, store.go:335) and refuses a same-named method of
+ *   another type. ⚠️ The deploying token needs `list` on `identity/mfa/method`.
+ * ⚠️ AN UPDATE BY A STALE `method_id` IS A SILENT NO-OP: the handler returns nil for an unknown id
+ *   (identity/mfa.go:172-183), which HTTP answers 204. So this never writes by id.
+ */
+import * as Effect from 'effect/Effect';
+import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import { BaoEnv, baoCall, baoDelete, baoRead } from './bao-http.ts';
+import { envNamespace, namespacePath } from './bao-namespace.ts';
+import type { BaoError } from './bao-status.ts';
+import { mountPath } from './mount-form.ts';
+
+export const TOTP_PATH = 'identity/mfa/method/totp';
+/** Every MFA method of every type — the only listing that can see a name clash across types. */
+export const METHODS_PATH = 'identity/mfa/method';
+export const enforcementPath = (name: string): string => `identity/mfa/login-enforcement/${name}`;
+
+const record = (value: unknown): Record<string, unknown> | undefined =>
+  typeof value === 'object' && value !== null && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : undefined;
+
+/** This call's namespace as OpenBao writes `namespace_path`: `''` or `team-a/`. */
+export const ownNamespacePath: Effect.Effect<string> = Effect.gen(function* () {
+  const env = yield* BaoEnv;
+  return namespacePath(envNamespace(env));
+});
+
+export type TotpEntry = { readonly id: string; readonly live: Record<string, unknown> };
+
+/**
+ * The TOTP method named `name` in this namespace, or undefined. Dies when the name belongs to a
+ * method of ANOTHER type here — writing would convert it (the ⛔ above).
+ */
+export const findTotp = (
+  name: string,
+): Effect.Effect<TotpEntry | undefined, BaoError, HttpClient.HttpClient> =>
+  Effect.gen(function* () {
+    const listing = yield* baoRead(`${METHODS_PATH}?list=true`);
+    const info = record(listing?.['key_info']) ?? {};
+    const own = yield* ownNamespacePath;
+    for (const [id, raw] of Object.entries(info)) {
+      const live = record(raw);
+      if (live === undefined || live['name'] !== name || live['namespace_path'] !== own) continue;
+      if (live['type'] !== 'totp') {
+        return yield* Effect.die(
+          new Error(
+            `Bao.MfaTotpMethod ${name}: that name belongs to a ${String(live['type'])} method ` +
+              `(${id}) in this namespace, and a TOTP write would convert it. Pick another name.`,
+          ),
+        );
+      }
+      return { id, live };
+    }
+    return undefined;
+  });
+
+/** Create-or-update by `method_name` — never by id (the ⚠️ above). */
+export const writeTotp = (body: Readonly<Record<string, unknown>>) =>
+  Effect.asVoid(baoCall('write', 'POST', TOTP_PATH, body));
+
+/**
+ * ⛔ DESTROYS EVERY ENTITY'S ENROLLED SECRET FOR THIS METHOD (login_mfa.go:1965-1973 clears the TOTP
+ *   keys under the method id). OpenBao refuses it while an enforcement in memory still names the id
+ *   (:1914-1924) — a refusal this passes on.
+ */
+export const deleteTotp = (id: string) => baoDelete(`${TOTP_PATH}/${id}`);
+
+export const readEnforcement = (name: string) => baoRead(enforcementPath(name));
+
+export const writeEnforcement = (name: string, body: Readonly<Record<string, unknown>>) =>
+  Effect.asVoid(baoCall('write', 'POST', enforcementPath(name), body));
+
+/**
+ * Accessors for auth mount paths, from `GET sys/auth` (keys are `<path>/`). A path with no mount
+ * comes back in `missing`, never as a guess.
+ */
+export const authAccessors = (
+  paths: readonly string[],
+): Effect.Effect<
+  { readonly accessors: readonly string[]; readonly missing: readonly string[] },
+  BaoError,
+  HttpClient.HttpClient
+> =>
+  Effect.gen(function* () {
+    if (paths.length === 0) return { accessors: [], missing: [] };
+    const table = (yield* baoRead('sys/auth')) ?? {};
+    const accessors: string[] = [];
+    const missing: string[] = [];
+    for (const path of paths) {
+      const accessor = record(table[`${mountPath(path)}/`])?.['accessor'];
+      if (typeof accessor === 'string' && accessor !== '') accessors.push(accessor);
+      else missing.push(mountPath(path));
+    }
+    return { accessors, missing };
+  });

package/src/openbao/mfa.test.ts

@@ -0,0 +1,200 @@
+/**
+ * Login MFA against a fake: a TOTP method found by name in THIS namespace only, and an enforcement
+ * whose mount paths resolve to accessors and whose lists always go over as arrays. Ids and names are
+ * placeholders.
+ */
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import { type Reply, type Seen, run, withFake } from './fake-bao.ts';
+import { planEnforcement, reconcileEnforcement } from './mfa-enforcement.ts';
+import { planTotp, reconcileTotp } from './mfa-totp.ts';
+import { renameProblem } from './mfa-totp-form.ts';
+
+const ENV = (address: string) => ({ BAO_ADDR: address, BAO_NAMESPACE: 'team-a' });
+const TOTP = { issuer: 'vault-example', name: 'admin-totp' };
+const METHOD_ID = '00000000-0000-4000-8000-00000000000a';
+const stored = (namespacePath: string, extra: Record<string, unknown> = {}) => ({
+  algorithm: 'SHA1',
+  digits: 6,
+  id: METHOD_ID,
+  issuer: 'vault-example',
+  key_size: 20,
+  max_validation_attempts: 5,
+  name: 'admin-totp',
+  namespace_path: namespacePath,
+  period: 30,
+  qr_size: 200,
+  skew: 1,
+  type: 'totp',
+  ...extra,
+});
+const listing = (...entries: Record<string, unknown>[]): Reply =>
+  entries.length === 0
+    ? { json: { errors: [] }, status: 404 }
+    : {
+        json: {
+          data: {
+            key_info: Object.fromEntries(entries.map((e, i) => [`id-${String(i)}`, e])),
+            keys: [],
+          },
+        },
+        status: 200,
+      };
+
+/** Listing replies in order (the last repeats); every write answers 200. */
+const totpFake = (...lists: Reply[]) => {
+  let reads = 0;
+  return (seen: Seen): Reply => {
+    if (seen.method !== 'GET') return { json: { data: { method_id: METHOD_ID } }, status: 200 };
+    const reply = lists[Math.min(reads, lists.length - 1)] ?? listing();
+    reads += 1;
+    return reply;
+  };
+};
+const writes = (seen: Seen[]) => seen.filter((each) => each.method !== 'GET');
+
+describe('Bao.MfaTotpMethod', () => {
+  it('upserts by method_name when absent, and returns the id it read back', async () => {
+    await withFake(totpFake(listing(), listing(stored('team-a/'))), async (bao) => {
+      const attributes = await run(ENV(bao.address), reconcileTotp(TOTP));
+      assert.equal(attributes.methodId, 'id-0');
+      const [write] = writes(bao.seen);
+      assert.equal(write?.path, '/v1/identity/mfa/method/totp');
+      const body = JSON.parse(write?.body ?? '{}') as Record<string, unknown>;
+      assert.equal(body['method_name'], 'admin-totp');
+      assert.equal(body['method_id'], undefined);
+      assert.equal(body['period'], '30s');
+    });
+  });
+
+  it('plans noop and writes nothing when this namespace already has it', async () => {
+    await withFake(totpFake(listing(stored('team-a/'))), async (bao) => {
+      assert.equal(await run(ENV(bao.address), planTotp(TOTP)), 'noop');
+      await run(ENV(bao.address), reconcileTotp(TOTP));
+      assert.equal(writes(bao.seen).length, 0);
+    });
+  });
+
+  it("ignores a same-named method in a parent namespace — it is not this namespace's", async () => {
+    await withFake(
+      totpFake(listing(stored('')), listing(stored(''), stored('team-a/'))),
+      async (bao) => {
+        await run(ENV(bao.address), reconcileTotp(TOTP));
+        assert.equal(writes(bao.seen).length, 1);
+      },
+    );
+  });
+
+  it('refuses a rename at plan time — a new id would strand every enrolled secret', () => {
+    assert.equal(renameProblem('admin-totp', 'admin-totp'), undefined);
+    assert.match(renameProblem('admin-totp', 'admin-otp') ?? '', /strand every enrolled secret/);
+  });
+
+  it('refuses a name another method type holds here — a TOTP write would convert it', async () => {
+    await withFake(totpFake(listing(stored('team-a/', { type: 'duo' }))), async (bao) => {
+      await assert.rejects(run(ENV(bao.address), reconcileTotp(TOTP)), /belongs to a duo method/);
+      assert.equal(writes(bao.seen).length, 0);
+      // ★ The GLOBAL listing — the per-type one cannot see a Duo method at all.
+      assert.equal(bao.seen[0]?.path, '/v1/identity/mfa/method?list=true');
+    });
+  });
+
+  it('plans update on drift, and refuses a bad declaration before any call', async () => {
+    await withFake(totpFake(listing(stored('team-a/', { digits: 8 }))), async (bao) => {
+      assert.equal(await run(ENV(bao.address), planTotp(TOTP)), 'update');
+    });
+    await withFake(totpFake(listing()), async (bao) => {
+      await assert.rejects(
+        run(ENV(bao.address), reconcileTotp({ ...TOTP, issuer: '' })),
+        /issuer is empty/,
+      );
+      assert.equal(bao.seen.length, 0);
+    });
+  });
+});
+
+const AUTH_TABLE: Reply = {
+  json: {
+    data: {
+      'oidc/': { accessor: 'auth_oidc_1', type: 'oidc' },
+      'token/': { accessor: 'auth_token_1', type: 'token' },
+    },
+  },
+  status: 200,
+};
+const ENFORCE = { authMethodPaths: ['oidc'], mfaMethodIds: [METHOD_ID], name: 'admin-mfa' };
+const enforcementLive = (accessors: string[]) => ({
+  json: {
+    data: {
+      auth_method_accessors: accessors,
+      auth_method_types: [],
+      id: 'enf-1',
+      identity_entity_ids: [],
+      identity_group_ids: [],
+      mfa_method_ids: [METHOD_ID],
+      name: 'admin-mfa',
+      namespace_path: 'team-a/',
+    },
+  },
+  status: 200,
+});
+
+/** sys/auth answers the table; the enforcement answers `states` in order; writes answer 204. */
+const enforcementFake = (...states: Reply[]) => {
+  let reads = 0;
+  return (seen: Seen): Reply => {
+    if (seen.path === '/v1/sys/auth') return AUTH_TABLE;
+    if (seen.method !== 'GET') return { status: 204 };
+    const reply = states[Math.min(reads, states.length - 1)] ?? {
+      json: { errors: [] },
+      status: 404,
+    };
+    reads += 1;
+    return reply;
+  };
+};
+
+describe('Bao.MfaLoginEnforcement', () => {
+  it('resolves mount paths to accessors and sends every list as an array', async () => {
+    const absent = { json: { errors: [] }, status: 404 };
+    await withFake(enforcementFake(absent, enforcementLive(['auth_oidc_1'])), async (bao) => {
+      const attributes = await run(ENV(bao.address), reconcileEnforcement(ENFORCE));
+      assert.equal(attributes.enforcementId, 'enf-1');
+      const [write] = writes(bao.seen);
+      assert.equal(write?.path, '/v1/identity/mfa/login-enforcement/admin-mfa');
+      assert.deepEqual(JSON.parse(write?.body ?? '{}'), {
+        auth_method_accessors: ['auth_oidc_1'],
+        auth_method_types: [],
+        identity_entity_ids: [],
+        identity_group_ids: [],
+        mfa_method_ids: [METHOD_ID],
+      });
+    });
+  });
+
+  it('plans update when live carries a target the declaration does not', async () => {
+    await withFake(
+      enforcementFake(enforcementLive(['auth_oidc_1', 'auth_token_1'])),
+      async (bao) => {
+        assert.equal(await run(ENV(bao.address), planEnforcement(ENFORCE)), 'update');
+      },
+    );
+    await withFake(enforcementFake(enforcementLive(['auth_oidc_1'])), async (bao) => {
+      assert.equal(await run(ENV(bao.address), planEnforcement(ENFORCE)), 'noop');
+    });
+  });
+
+  it('refuses a path with no mount, and an enforcement with no target, before writing', async () => {
+    await withFake(enforcementFake(), async (bao) => {
+      await assert.rejects(
+        run(ENV(bao.address), reconcileEnforcement({ ...ENFORCE, authMethodPaths: ['jwt-admin'] })),
+        /no auth mount at jwt-admin/,
+      );
+      await assert.rejects(
+        run(ENV(bao.address), reconcileEnforcement({ ...ENFORCE, authMethodPaths: [] })),
+        /enforces NOTHING/,
+      );
+      assert.equal(writes(bao.seen).length, 0);
+    });
+  });
+});

package/src/openbao/mount-form.ts

@@ -1,7 +1,8 @@
 import { sha256 } from './digest.ts';
+import { trimTrailingSlashes } from './mount-path.ts';
 
 /** Mount path without a trailing slash — props and `sys/mounts/<path>` use this shape. */
-export const mountPath = (path: string) => path.replace(/\/+$/, '');
+export const mountPath = (path: string) => trimTrailingSlashes(path);
 
 const DURATION = /^(\d+)([smhd])$/;
 
@@ -46,6 +47,13 @@ export interface BaoMountProps {
   maxLeaseTtl?: string;
   /** KV only — sent as `options.version` on enable, as `-version=2` was. Immutable after create. */
   version?: 1 | 2;
+  /**
+   * The path this mount lives at NOW, when `path` is where it should move to. Moves it with
+   * `sys/remount`, keeping every secret. Without it, a changed `path` fails the plan — see
+   * mount-move.ts. ⛔ Every lease under the old path is revoked, and policies are not rewritten.
+   * Harmless to leave declared after the move: once state holds `path`, it is ignored.
+   */
+  remountFrom?: string;
 }
 
 export interface BaoMountAttributes {