@open-mercato/enterprise 0.6.4-develop.4371.1.8f3030407e → 0.6.4

package/dist/modules/security/api/enforcement/_shared.js

@@ -1,8 +1,10 @@
 import { NextResponse } from "next/server";
 import { Organization, Tenant } from "@open-mercato/core/modules/directory/data/entities";
-import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { CrudHttpError, forbidden } from "@open-mercato/shared/lib/crud/errors";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { enforceTenantSelection, resolveIsSuperAdmin } from "@open-mercato/core/modules/auth/lib/tenantAccess";
+import { EnforcementScope } from "../../data/entities.js";
 import { localizeSecurityApiBody, securityApiError } from "../i18n.js";
 async function resolveEnforcementContext(req) {
   const auth = await getAuthFromRequest(req);
@@ -24,6 +26,64 @@ async function resolveEnforcementContext(req) {
     enforcementService: container.resolve("mfaEnforcementService")
   };
 }
+function normalizeNullableString(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+}
+function normalizeOrganizationList(values) {
+  if (values === null || values === void 0) return null;
+  if (!Array.isArray(values)) return null;
+  const result = [];
+  for (const value of values) {
+    if (typeof value !== "string") continue;
+    const trimmed = value.trim();
+    if (trimmed) result.push(trimmed);
+  }
+  return result;
+}
+async function resolveActorContext(ctx) {
+  const isSuperAdmin = await resolveIsSuperAdmin({ auth: ctx.auth, container: ctx.container });
+  return {
+    tenantId: normalizeNullableString(ctx.auth.tenantId),
+    isSuperAdmin
+  };
+}
+async function assertActorOwnsOrganization(ctx, organizationId) {
+  const rbacService = ctx.container.resolve("rbacService");
+  const acl = await rbacService.loadAcl(ctx.auth.sub, {
+    tenantId: normalizeNullableString(ctx.auth.tenantId),
+    organizationId: normalizeNullableString(ctx.auth.orgId)
+  });
+  const organizations = normalizeOrganizationList(acl?.organizations);
+  if (organizations === null || organizations.includes("__all__")) return;
+  if (!organizations.includes(organizationId)) {
+    throw forbidden("Not authorized to target this organization.");
+  }
+}
+async function assertActorOwnsEnforcementScope(ctx, scope, scopeId) {
+  if (scope === EnforcementScope.PLATFORM) {
+    const isSuperAdmin2 = await resolveIsSuperAdmin({ auth: ctx.auth, container: ctx.container });
+    if (!isSuperAdmin2) {
+      throw forbidden("Platform scope requires platform administrator privileges.");
+    }
+    return;
+  }
+  if (scope === EnforcementScope.TENANT) {
+    await enforceTenantSelection({ auth: ctx.auth, container: ctx.container }, scopeId);
+    return;
+  }
+  const normalizedScopeId = normalizeNullableString(scopeId);
+  if (!normalizedScopeId) {
+    throw new CrudHttpError(400, { error: "organisation scopeId must use '<tenantId>:<organizationId>' format" });
+  }
+  const [tenantId, organizationId] = normalizedScopeId.split(":");
+  if (!tenantId || !organizationId) {
+    throw new CrudHttpError(400, { error: "organisation scopeId must use '<tenantId>:<organizationId>' format" });
+  }
+  await enforceTenantSelection({ auth: ctx.auth, container: ctx.container }, tenantId);
+  const isSuperAdmin = await resolveIsSuperAdmin({ auth: ctx.auth, container: ctx.container });
+  if (isSuperAdmin) return;
+  await assertActorOwnsOrganization(ctx, organizationId);
+}
 async function mapEnforcementError(error) {
   if (error instanceof CrudHttpError) {
     return NextResponse.json(await localizeSecurityApiBody(error.body), { status: error.status });
@@ -92,8 +152,10 @@ function isMfaEnforcementServiceError(error) {
   return error instanceof Error && error.name === "MfaEnforcementServiceError" && typeof error.statusCode === "number";
 }
 export {
+  assertActorOwnsEnforcementScope,
   attachPolicyScopeNames,
   mapEnforcementError,
+  resolveActorContext,
   resolveEnforcementContext,
   toPolicyResponse
 };

package/dist/modules/security/api/enforcement/_shared.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/security/api/enforcement/_shared.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { Organization, Tenant } from '@open-mercato/core/modules/directory/data/entities'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { MfaEnforcementPolicy } from '../../data/entities'\nimport type { MfaEnforcementServiceError, MfaEnforcementService } from '../../services/MfaEnforcementService'\nimport { localizeSecurityApiBody, securityApiError } from '../i18n'\n\ntype RequestContainer = Awaited<ReturnType<typeof createRequestContainer>>\ntype Auth = NonNullable<Awaited<ReturnType<typeof getAuthFromRequest>>>\n\nexport type EnforcementRequestContext = {\n  auth: Auth\n  container: RequestContainer\n  commandContext: CommandRuntimeContext\n  enforcementService: MfaEnforcementService\n}\n\nexport async function resolveEnforcementContext(req: Request): Promise<EnforcementRequestContext | NextResponse> {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub) {\n    return securityApiError(401, 'Unauthorized')\n  }\n\n  const container = await createRequestContainer()\n  return {\n    auth,\n    container,\n    commandContext: {\n      container,\n      auth,\n      organizationScope: null,\n      selectedOrganizationId: auth.orgId ?? null,\n      organizationIds: auth.orgId ? [auth.orgId] : null,\n      request: req,\n    },\n    enforcementService: container.resolve<MfaEnforcementService>('mfaEnforcementService'),\n  }\n}\n\nexport async function mapEnforcementError(error: unknown): Promise<NextResponse> {\n  if (error instanceof CrudHttpError) {\n    return NextResponse.json(await localizeSecurityApiBody(error.body), { status: error.status })\n  }\n  if (isMfaEnforcementServiceError(error)) {\n    return securityApiError(error.statusCode, error.message)\n  }\n  console.error('security.enforcement.route failure', error)\n  return securityApiError(500, 'Failed to process enforcement request.')\n}\n\nexport function toPolicyResponse(policy: MfaEnforcementPolicy): {\n  id: string\n  scope: string\n  tenantId: string | null\n  tenantName: string | null\n  organizationId: string | null\n  organizationName: string | null\n  isEnforced: boolean\n  allowedMethods: string[] | null\n  enforcementDeadline: string | null\n  enforcedBy: string\n  createdAt: string\n  updatedAt: string\n} {\n  return {\n    id: policy.id,\n    scope: policy.scope,\n    tenantId: policy.tenantId ?? null,\n    tenantName: null,\n    organizationId: policy.organizationId ?? null,\n    organizationName: null,\n    isEnforced: policy.isEnforced,\n    allowedMethods: policy.allowedMethods ?? null,\n    enforcementDeadline: policy.enforcementDeadline ? policy.enforcementDeadline.toISOString() : null,\n    enforcedBy: policy.enforcedBy,\n    createdAt: policy.createdAt.toISOString(),\n    updatedAt: policy.updatedAt.toISOString(),\n  }\n}\n\nexport async function attachPolicyScopeNames(\n  container: RequestContainer,\n  policies: MfaEnforcementPolicy[],\n): Promise<Array<ReturnType<typeof toPolicyResponse>>> {\n  if (policies.length === 0) return []\n\n  const em = container.resolve<EntityManager>('em')\n  const tenantIds = Array.from(\n    new Set(\n      policies\n        .map((policy) => policy.tenantId ?? null)\n        .filter((tenantId): tenantId is string => typeof tenantId === 'string' && tenantId.length > 0),\n    ),\n  )\n  const organizationIds = Array.from(\n    new Set(\n      policies\n        .map((policy) => policy.organizationId ?? null)\n        .filter((organizationId): organizationId is string => typeof organizationId === 'string' && organizationId.length > 0),\n    ),\n  )\n\n  const [tenants, organizations] = await Promise.all([\n    tenantIds.length\n      ? em.find(Tenant, { id: { $in: tenantIds }, deletedAt: null })\n      : Promise.resolve([]),\n    organizationIds.length\n      ? em.find(Organization, { id: { $in: organizationIds }, deletedAt: null })\n      : Promise.resolve([]),\n  ])\n\n  const tenantMap = tenants.reduce<Record<string, string>>((acc, tenant) => {\n    const tenantId = tenant?.id ? String(tenant.id) : null\n    if (!tenantId) return acc\n    acc[tenantId] = typeof tenant.name === 'string' && tenant.name.length > 0 ? tenant.name : tenantId\n    return acc\n  }, {})\n  const organizationMap = organizations.reduce<Record<string, string>>((acc, organization) => {\n    const organizationId = organization?.id ? String(organization.id) : null\n    if (!organizationId) return acc\n    acc[organizationId] = typeof organization.name === 'string' && organization.name.length > 0\n      ? organization.name\n      : organizationId\n    return acc\n  }, {})\n\n  return policies.map((policy) => {\n    const response = toPolicyResponse(policy)\n    return {\n      ...response,\n      tenantName: response.tenantId ? tenantMap[response.tenantId] ?? response.tenantId : null,\n      organizationName: response.organizationId\n        ? organizationMap[response.organizationId] ?? response.organizationId\n        : null,\n    }\n  })\n}\n\nfunction isMfaEnforcementServiceError(error: unknown): error is MfaEnforcementServiceError {\n  return error instanceof Error\n    && error.name === 'MfaEnforcementServiceError'\n    && typeof (error as Partial<MfaEnforcementServiceError>).statusCode === 'number'\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAG7B,SAAS,cAAc,cAAc;AACrC,SAAS,qBAAqB;AAC9B,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAGvC,SAAS,yBAAyB,wBAAwB;AAY1D,eAAsB,0BAA0B,KAAiE;AAC/G,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,KAAK;AACd,WAAO,iBAAiB,KAAK,cAAc;AAAA,EAC7C;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,gBAAgB;AAAA,MACd;AAAA,MACA;AAAA,MACA,mBAAmB;AAAA,MACnB,wBAAwB,KAAK,SAAS;AAAA,MACtC,iBAAiB,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAC7C,SAAS;AAAA,IACX;AAAA,IACA,oBAAoB,UAAU,QAA+B,uBAAuB;AAAA,EACtF;AACF;AAEA,eAAsB,oBAAoB,OAAuC;AAC/E,MAAI,iBAAiB,eAAe;AAClC,WAAO,aAAa,KAAK,MAAM,wBAAwB,MAAM,IAAI,GAAG,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,EAC9F;AACA,MAAI,6BAA6B,KAAK,GAAG;AACvC,WAAO,iBAAiB,MAAM,YAAY,MAAM,OAAO;AAAA,EACzD;AACA,UAAQ,MAAM,sCAAsC,KAAK;AACzD,SAAO,iBAAiB,KAAK,wCAAwC;AACvE;AAEO,SAAS,iBAAiB,QAa/B;AACA,SAAO;AAAA,IACL,IAAI,OAAO;AAAA,IACX,OAAO,OAAO;AAAA,IACd,UAAU,OAAO,YAAY;AAAA,IAC7B,YAAY;AAAA,IACZ,gBAAgB,OAAO,kBAAkB;AAAA,IACzC,kBAAkB;AAAA,IAClB,YAAY,OAAO;AAAA,IACnB,gBAAgB,OAAO,kBAAkB;AAAA,IACzC,qBAAqB,OAAO,sBAAsB,OAAO,oBAAoB,YAAY,IAAI;AAAA,IAC7F,YAAY,OAAO;AAAA,IACnB,WAAW,OAAO,UAAU,YAAY;AAAA,IACxC,WAAW,OAAO,UAAU,YAAY;AAAA,EAC1C;AACF;AAEA,eAAsB,uBACpB,WACA,UACqD;AACrD,MAAI,SAAS,WAAW,EAAG,QAAO,CAAC;AAEnC,QAAM,KAAK,UAAU,QAAuB,IAAI;AAChD,QAAM,YAAY,MAAM;AAAA,IACtB,IAAI;AAAA,MACF,SACG,IAAI,CAAC,WAAW,OAAO,YAAY,IAAI,EACvC,OAAO,CAAC,aAAiC,OAAO,aAAa,YAAY,SAAS,SAAS,CAAC;AAAA,IACjG;AAAA,EACF;AACA,QAAM,kBAAkB,MAAM;AAAA,IAC5B,IAAI;AAAA,MACF,SACG,IAAI,CAAC,WAAW,OAAO,kBAAkB,IAAI,EAC7C,OAAO,CAAC,mBAA6C,OAAO,mBAAmB,YAAY,eAAe,SAAS,CAAC;AAAA,IACzH;AAAA,EACF;AAEA,QAAM,CAAC,SAAS,aAAa,IAAI,MAAM,QAAQ,IAAI;AAAA,IACjD,UAAU,SACN,GAAG,KAAK,QAAQ,EAAE,IAAI,EAAE,KAAK,UAAU,GAAG,WAAW,KAAK,CAAC,IAC3D,QAAQ,QAAQ,CAAC,CAAC;AAAA,IACtB,gBAAgB,SACZ,GAAG,KAAK,cAAc,EAAE,IAAI,EAAE,KAAK,gBAAgB,GAAG,WAAW,KAAK,CAAC,IACvE,QAAQ,QAAQ,CAAC,CAAC;AAAA,EACxB,CAAC;AAED,QAAM,YAAY,QAAQ,OAA+B,CAAC,KAAK,WAAW;AACxE,UAAM,WAAW,QAAQ,KAAK,OAAO,OAAO,EAAE,IAAI;AAClD,QAAI,CAAC,SAAU,QAAO;AACtB,QAAI,QAAQ,IAAI,OAAO,OAAO,SAAS,YAAY,OAAO,KAAK,SAAS,IAAI,OAAO,OAAO;AAC1F,WAAO;AAAA,EACT,GAAG,CAAC,CAAC;AACL,QAAM,kBAAkB,cAAc,OAA+B,CAAC,KAAK,iBAAiB;AAC1F,UAAM,iBAAiB,cAAc,KAAK,OAAO,aAAa,EAAE,IAAI;AACpE,QAAI,CAAC,eAAgB,QAAO;AAC5B,QAAI,cAAc,IAAI,OAAO,aAAa,SAAS,YAAY,aAAa,KAAK,SAAS,IACtF,aAAa,OACb;AACJ,WAAO;AAAA,EACT,GAAG,CAAC,CAAC;AAEL,SAAO,SAAS,IAAI,CAAC,WAAW;AAC9B,UAAM,WAAW,iBAAiB,MAAM;AACxC,WAAO;AAAA,MACL,GAAG;AAAA,MACH,YAAY,SAAS,WAAW,UAAU,SAAS,QAAQ,KAAK,SAAS,WAAW;AAAA,MACpF,kBAAkB,SAAS,iBACvB,gBAAgB,SAAS,cAAc,KAAK,SAAS,iBACrD;AAAA,IACN;AAAA,EACF,CAAC;AACH;AAEA,SAAS,6BAA6B,OAAqD;AACzF,SAAO,iBAAiB,SACnB,MAAM,SAAS,gCACf,OAAQ,MAA8C,eAAe;AAC5E;",
-  "names": []
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { Organization, Tenant } from '@open-mercato/core/modules/directory/data/entities'\nimport { CrudHttpError, forbidden } from '@open-mercato/shared/lib/crud/errors'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { enforceTenantSelection, resolveIsSuperAdmin } from '@open-mercato/core/modules/auth/lib/tenantAccess'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { EnforcementScope, type MfaEnforcementPolicy } from '../../data/entities'\nimport type { MfaEnforcementServiceError, MfaEnforcementService } from '../../services/MfaEnforcementService'\nimport { localizeSecurityApiBody, securityApiError } from '../i18n'\n\ntype RequestContainer = Awaited<ReturnType<typeof createRequestContainer>>\ntype Auth = NonNullable<Awaited<ReturnType<typeof getAuthFromRequest>>>\n\nexport type EnforcementActorContext = {\n  tenantId: string | null\n  isSuperAdmin: boolean\n}\n\nexport type EnforcementRequestContext = {\n  auth: Auth\n  container: RequestContainer\n  commandContext: CommandRuntimeContext\n  enforcementService: MfaEnforcementService\n}\n\nexport async function resolveEnforcementContext(req: Request): Promise<EnforcementRequestContext | NextResponse> {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub) {\n    return securityApiError(401, 'Unauthorized')\n  }\n\n  const container = await createRequestContainer()\n  return {\n    auth,\n    container,\n    commandContext: {\n      container,\n      auth,\n      organizationScope: null,\n      selectedOrganizationId: auth.orgId ?? null,\n      organizationIds: auth.orgId ? [auth.orgId] : null,\n      request: req,\n    },\n    enforcementService: container.resolve<MfaEnforcementService>('mfaEnforcementService'),\n  }\n}\n\nfunction normalizeNullableString(value: unknown): string | null {\n  return typeof value === 'string' && value.trim().length > 0 ? value.trim() : null\n}\n\nfunction normalizeOrganizationList(values: unknown): string[] | null {\n  if (values === null || values === undefined) return null\n  if (!Array.isArray(values)) return null\n  const result: string[] = []\n  for (const value of values) {\n    if (typeof value !== 'string') continue\n    const trimmed = value.trim()\n    if (trimmed) result.push(trimmed)\n  }\n  return result\n}\n\nexport async function resolveActorContext(ctx: EnforcementRequestContext): Promise<EnforcementActorContext> {\n  const isSuperAdmin = await resolveIsSuperAdmin({ auth: ctx.auth, container: ctx.container })\n  return {\n    tenantId: normalizeNullableString(ctx.auth.tenantId),\n    isSuperAdmin,\n  }\n}\n\nasync function assertActorOwnsOrganization(\n  ctx: EnforcementRequestContext,\n  organizationId: string,\n): Promise<void> {\n  const rbacService = ctx.container.resolve<RbacService>('rbacService')\n  const acl = await rbacService.loadAcl(ctx.auth.sub, {\n    tenantId: normalizeNullableString(ctx.auth.tenantId),\n    organizationId: normalizeNullableString(ctx.auth.orgId),\n  })\n  const organizations = normalizeOrganizationList(acl?.organizations)\n  if (organizations === null || organizations.includes('__all__')) return\n  if (!organizations.includes(organizationId)) {\n    throw forbidden('Not authorized to target this organization.')\n  }\n}\n\nexport async function assertActorOwnsEnforcementScope(\n  ctx: EnforcementRequestContext,\n  scope: EnforcementScope,\n  scopeId: string | null | undefined,\n): Promise<void> {\n  if (scope === EnforcementScope.PLATFORM) {\n    const isSuperAdmin = await resolveIsSuperAdmin({ auth: ctx.auth, container: ctx.container })\n    if (!isSuperAdmin) {\n      throw forbidden('Platform scope requires platform administrator privileges.')\n    }\n    return\n  }\n\n  if (scope === EnforcementScope.TENANT) {\n    await enforceTenantSelection({ auth: ctx.auth, container: ctx.container }, scopeId)\n    return\n  }\n\n  const normalizedScopeId = normalizeNullableString(scopeId)\n  if (!normalizedScopeId) {\n    throw new CrudHttpError(400, { error: \"organisation scopeId must use '<tenantId>:<organizationId>' format\" })\n  }\n  const [tenantId, organizationId] = normalizedScopeId.split(':')\n  if (!tenantId || !organizationId) {\n    throw new CrudHttpError(400, { error: \"organisation scopeId must use '<tenantId>:<organizationId>' format\" })\n  }\n\n  await enforceTenantSelection({ auth: ctx.auth, container: ctx.container }, tenantId)\n\n  const isSuperAdmin = await resolveIsSuperAdmin({ auth: ctx.auth, container: ctx.container })\n  if (isSuperAdmin) return\n  await assertActorOwnsOrganization(ctx, organizationId)\n}\n\nexport async function mapEnforcementError(error: unknown): Promise<NextResponse> {\n  if (error instanceof CrudHttpError) {\n    return NextResponse.json(await localizeSecurityApiBody(error.body), { status: error.status })\n  }\n  if (isMfaEnforcementServiceError(error)) {\n    return securityApiError(error.statusCode, error.message)\n  }\n  console.error('security.enforcement.route failure', error)\n  return securityApiError(500, 'Failed to process enforcement request.')\n}\n\nexport function toPolicyResponse(policy: MfaEnforcementPolicy): {\n  id: string\n  scope: string\n  tenantId: string | null\n  tenantName: string | null\n  organizationId: string | null\n  organizationName: string | null\n  isEnforced: boolean\n  allowedMethods: string[] | null\n  enforcementDeadline: string | null\n  enforcedBy: string\n  createdAt: string\n  updatedAt: string\n} {\n  return {\n    id: policy.id,\n    scope: policy.scope,\n    tenantId: policy.tenantId ?? null,\n    tenantName: null,\n    organizationId: policy.organizationId ?? null,\n    organizationName: null,\n    isEnforced: policy.isEnforced,\n    allowedMethods: policy.allowedMethods ?? null,\n    enforcementDeadline: policy.enforcementDeadline ? policy.enforcementDeadline.toISOString() : null,\n    enforcedBy: policy.enforcedBy,\n    createdAt: policy.createdAt.toISOString(),\n    updatedAt: policy.updatedAt.toISOString(),\n  }\n}\n\nexport async function attachPolicyScopeNames(\n  container: RequestContainer,\n  policies: MfaEnforcementPolicy[],\n): Promise<Array<ReturnType<typeof toPolicyResponse>>> {\n  if (policies.length === 0) return []\n\n  const em = container.resolve<EntityManager>('em')\n  const tenantIds = Array.from(\n    new Set(\n      policies\n        .map((policy) => policy.tenantId ?? null)\n        .filter((tenantId): tenantId is string => typeof tenantId === 'string' && tenantId.length > 0),\n    ),\n  )\n  const organizationIds = Array.from(\n    new Set(\n      policies\n        .map((policy) => policy.organizationId ?? null)\n        .filter((organizationId): organizationId is string => typeof organizationId === 'string' && organizationId.length > 0),\n    ),\n  )\n\n  const [tenants, organizations] = await Promise.all([\n    tenantIds.length\n      ? em.find(Tenant, { id: { $in: tenantIds }, deletedAt: null })\n      : Promise.resolve([]),\n    organizationIds.length\n      ? em.find(Organization, { id: { $in: organizationIds }, deletedAt: null })\n      : Promise.resolve([]),\n  ])\n\n  const tenantMap = tenants.reduce<Record<string, string>>((acc, tenant) => {\n    const tenantId = tenant?.id ? String(tenant.id) : null\n    if (!tenantId) return acc\n    acc[tenantId] = typeof tenant.name === 'string' && tenant.name.length > 0 ? tenant.name : tenantId\n    return acc\n  }, {})\n  const organizationMap = organizations.reduce<Record<string, string>>((acc, organization) => {\n    const organizationId = organization?.id ? String(organization.id) : null\n    if (!organizationId) return acc\n    acc[organizationId] = typeof organization.name === 'string' && organization.name.length > 0\n      ? organization.name\n      : organizationId\n    return acc\n  }, {})\n\n  return policies.map((policy) => {\n    const response = toPolicyResponse(policy)\n    return {\n      ...response,\n      tenantName: response.tenantId ? tenantMap[response.tenantId] ?? response.tenantId : null,\n      organizationName: response.organizationId\n        ? organizationMap[response.organizationId] ?? response.organizationId\n        : null,\n    }\n  })\n}\n\nfunction isMfaEnforcementServiceError(error: unknown): error is MfaEnforcementServiceError {\n  return error instanceof Error\n    && error.name === 'MfaEnforcementServiceError'\n    && typeof (error as Partial<MfaEnforcementServiceError>).statusCode === 'number'\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAG7B,SAAS,cAAc,cAAc;AACrC,SAAS,eAAe,iBAAiB;AACzC,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,wBAAwB,2BAA2B;AAE5D,SAAS,wBAAmD;AAE5D,SAAS,yBAAyB,wBAAwB;AAiB1D,eAAsB,0BAA0B,KAAiE;AAC/G,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,KAAK;AACd,WAAO,iBAAiB,KAAK,cAAc;AAAA,EAC7C;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,gBAAgB;AAAA,MACd;AAAA,MACA;AAAA,MACA,mBAAmB;AAAA,MACnB,wBAAwB,KAAK,SAAS;AAAA,MACtC,iBAAiB,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAC7C,SAAS;AAAA,IACX;AAAA,IACA,oBAAoB,UAAU,QAA+B,uBAAuB;AAAA,EACtF;AACF;AAEA,SAAS,wBAAwB,OAA+B;AAC9D,SAAO,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,IAAI,MAAM,KAAK,IAAI;AAC/E;AAEA,SAAS,0BAA0B,QAAkC;AACnE,MAAI,WAAW,QAAQ,WAAW,OAAW,QAAO;AACpD,MAAI,CAAC,MAAM,QAAQ,MAAM,EAAG,QAAO;AACnC,QAAM,SAAmB,CAAC;AAC1B,aAAW,SAAS,QAAQ;AAC1B,QAAI,OAAO,UAAU,SAAU;AAC/B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,QAAS,QAAO,KAAK,OAAO;AAAA,EAClC;AACA,SAAO;AACT;AAEA,eAAsB,oBAAoB,KAAkE;AAC1G,QAAM,eAAe,MAAM,oBAAoB,EAAE,MAAM,IAAI,MAAM,WAAW,IAAI,UAAU,CAAC;AAC3F,SAAO;AAAA,IACL,UAAU,wBAAwB,IAAI,KAAK,QAAQ;AAAA,IACnD;AAAA,EACF;AACF;AAEA,eAAe,4BACb,KACA,gBACe;AACf,QAAM,cAAc,IAAI,UAAU,QAAqB,aAAa;AACpE,QAAM,MAAM,MAAM,YAAY,QAAQ,IAAI,KAAK,KAAK;AAAA,IAClD,UAAU,wBAAwB,IAAI,KAAK,QAAQ;AAAA,IACnD,gBAAgB,wBAAwB,IAAI,KAAK,KAAK;AAAA,EACxD,CAAC;AACD,QAAM,gBAAgB,0BAA0B,KAAK,aAAa;AAClE,MAAI,kBAAkB,QAAQ,cAAc,SAAS,SAAS,EAAG;AACjE,MAAI,CAAC,cAAc,SAAS,cAAc,GAAG;AAC3C,UAAM,UAAU,6CAA6C;AAAA,EAC/D;AACF;AAEA,eAAsB,gCACpB,KACA,OACA,SACe;AACf,MAAI,UAAU,iBAAiB,UAAU;AACvC,UAAMA,gBAAe,MAAM,oBAAoB,EAAE,MAAM,IAAI,MAAM,WAAW,IAAI,UAAU,CAAC;AAC3F,QAAI,CAACA,eAAc;AACjB,YAAM,UAAU,4DAA4D;AAAA,IAC9E;AACA;AAAA,EACF;AAEA,MAAI,UAAU,iBAAiB,QAAQ;AACrC,UAAM,uBAAuB,EAAE,MAAM,IAAI,MAAM,WAAW,IAAI,UAAU,GAAG,OAAO;AAClF;AAAA,EACF;AAEA,QAAM,oBAAoB,wBAAwB,OAAO;AACzD,MAAI,CAAC,mBAAmB;AACtB,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,qEAAqE,CAAC;AAAA,EAC9G;AACA,QAAM,CAAC,UAAU,cAAc,IAAI,kBAAkB,MAAM,GAAG;AAC9D,MAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,qEAAqE,CAAC;AAAA,EAC9G;AAEA,QAAM,uBAAuB,EAAE,MAAM,IAAI,MAAM,WAAW,IAAI,UAAU,GAAG,QAAQ;AAEnF,QAAM,eAAe,MAAM,oBAAoB,EAAE,MAAM,IAAI,MAAM,WAAW,IAAI,UAAU,CAAC;AAC3F,MAAI,aAAc;AAClB,QAAM,4BAA4B,KAAK,cAAc;AACvD;AAEA,eAAsB,oBAAoB,OAAuC;AAC/E,MAAI,iBAAiB,eAAe;AAClC,WAAO,aAAa,KAAK,MAAM,wBAAwB,MAAM,IAAI,GAAG,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,EAC9F;AACA,MAAI,6BAA6B,KAAK,GAAG;AACvC,WAAO,iBAAiB,MAAM,YAAY,MAAM,OAAO;AAAA,EACzD;AACA,UAAQ,MAAM,sCAAsC,KAAK;AACzD,SAAO,iBAAiB,KAAK,wCAAwC;AACvE;AAEO,SAAS,iBAAiB,QAa/B;AACA,SAAO;AAAA,IACL,IAAI,OAAO;AAAA,IACX,OAAO,OAAO;AAAA,IACd,UAAU,OAAO,YAAY;AAAA,IAC7B,YAAY;AAAA,IACZ,gBAAgB,OAAO,kBAAkB;AAAA,IACzC,kBAAkB;AAAA,IAClB,YAAY,OAAO;AAAA,IACnB,gBAAgB,OAAO,kBAAkB;AAAA,IACzC,qBAAqB,OAAO,sBAAsB,OAAO,oBAAoB,YAAY,IAAI;AAAA,IAC7F,YAAY,OAAO;AAAA,IACnB,WAAW,OAAO,UAAU,YAAY;AAAA,IACxC,WAAW,OAAO,UAAU,YAAY;AAAA,EAC1C;AACF;AAEA,eAAsB,uBACpB,WACA,UACqD;AACrD,MAAI,SAAS,WAAW,EAAG,QAAO,CAAC;AAEnC,QAAM,KAAK,UAAU,QAAuB,IAAI;AAChD,QAAM,YAAY,MAAM;AAAA,IACtB,IAAI;AAAA,MACF,SACG,IAAI,CAAC,WAAW,OAAO,YAAY,IAAI,EACvC,OAAO,CAAC,aAAiC,OAAO,aAAa,YAAY,SAAS,SAAS,CAAC;AAAA,IACjG;AAAA,EACF;AACA,QAAM,kBAAkB,MAAM;AAAA,IAC5B,IAAI;AAAA,MACF,SACG,IAAI,CAAC,WAAW,OAAO,kBAAkB,IAAI,EAC7C,OAAO,CAAC,mBAA6C,OAAO,mBAAmB,YAAY,eAAe,SAAS,CAAC;AAAA,IACzH;AAAA,EACF;AAEA,QAAM,CAAC,SAAS,aAAa,IAAI,MAAM,QAAQ,IAAI;AAAA,IACjD,UAAU,SACN,GAAG,KAAK,QAAQ,EAAE,IAAI,EAAE,KAAK,UAAU,GAAG,WAAW,KAAK,CAAC,IAC3D,QAAQ,QAAQ,CAAC,CAAC;AAAA,IACtB,gBAAgB,SACZ,GAAG,KAAK,cAAc,EAAE,IAAI,EAAE,KAAK,gBAAgB,GAAG,WAAW,KAAK,CAAC,IACvE,QAAQ,QAAQ,CAAC,CAAC;AAAA,EACxB,CAAC;AAED,QAAM,YAAY,QAAQ,OAA+B,CAAC,KAAK,WAAW;AACxE,UAAM,WAAW,QAAQ,KAAK,OAAO,OAAO,EAAE,IAAI;AAClD,QAAI,CAAC,SAAU,QAAO;AACtB,QAAI,QAAQ,IAAI,OAAO,OAAO,SAAS,YAAY,OAAO,KAAK,SAAS,IAAI,OAAO,OAAO;AAC1F,WAAO;AAAA,EACT,GAAG,CAAC,CAAC;AACL,QAAM,kBAAkB,cAAc,OAA+B,CAAC,KAAK,iBAAiB;AAC1F,UAAM,iBAAiB,cAAc,KAAK,OAAO,aAAa,EAAE,IAAI;AACpE,QAAI,CAAC,eAAgB,QAAO;AAC5B,QAAI,cAAc,IAAI,OAAO,aAAa,SAAS,YAAY,aAAa,KAAK,SAAS,IACtF,aAAa,OACb;AACJ,WAAO;AAAA,EACT,GAAG,CAAC,CAAC;AAEL,SAAO,SAAS,IAAI,CAAC,WAAW;AAC9B,UAAM,WAAW,iBAAiB,MAAM;AACxC,WAAO;AAAA,MACL,GAAG;AAAA,MACH,YAAY,SAAS,WAAW,UAAU,SAAS,QAAQ,KAAK,SAAS,WAAW;AAAA,MACpF,kBAAkB,SAAS,iBACvB,gBAAgB,SAAS,cAAc,KAAK,SAAS,iBACrD;AAAA,IACN;AAAA,EACF,CAAC;AACH;AAEA,SAAS,6BAA6B,OAAqD;AACzF,SAAO,iBAAiB,SACnB,MAAM,SAAS,gCACf,OAAQ,MAA8C,eAAe;AAC5E;",
+  "names": ["isSuperAdmin"]
 }

package/dist/modules/security/api/enforcement/compliance/route.js

@@ -3,7 +3,12 @@ import { z } from "zod";
 import { EnforcementScope } from "../../../data/entities.js";
 import { buildSecurityOpenApi, securityErrorSchema } from "../../openapi.js";
 import { securityApiError } from "../../i18n.js";
-import { mapEnforcementError, resolveEnforcementContext } from "../_shared.js";
+import {
+  assertActorOwnsEnforcementScope,
+  mapEnforcementError,
+  resolveActorContext,
+  resolveEnforcementContext
+} from "../_shared.js";
 const complianceQuerySchema = z.object({
   scope: z.nativeEnum(EnforcementScope).default(EnforcementScope.PLATFORM),
   scopeId: z.string().optional()
@@ -31,9 +36,12 @@ async function GET(req) {
     return securityApiError(400, "Invalid query parameters", { issues: parsedQuery.error.issues });
   }
   try {
+    await assertActorOwnsEnforcementScope(context, parsedQuery.data.scope, parsedQuery.data.scopeId);
+    const actor = await resolveActorContext(context);
     const report = await context.enforcementService.getComplianceReport(
       parsedQuery.data.scope,
-      parsedQuery.data.scopeId
+      parsedQuery.data.scopeId,
+      actor
     );
     return NextResponse.json({
       scope: parsedQuery.data.scope,
@@ -55,7 +63,8 @@ const openApi = buildSecurityOpenApi({
       ],
       errors: [
         { status: 400, description: "Invalid query parameters", schema: securityErrorSchema },
-        { status: 401, description: "Unauthorized", schema: securityErrorSchema }
+        { status: 401, description: "Unauthorized", schema: securityErrorSchema },
+        { status: 403, description: "Not authorized for the requested scope", schema: securityErrorSchema }
       ]
     }
   }

package/dist/modules/security/api/enforcement/compliance/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/security/api/enforcement/compliance/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { EnforcementScope } from '../../../data/entities'\nimport { buildSecurityOpenApi, securityErrorSchema } from '../../openapi'\nimport { securityApiError } from '../../i18n'\nimport { mapEnforcementError, resolveEnforcementContext } from '../_shared'\n\nconst complianceQuerySchema = z.object({\n  scope: z.nativeEnum(EnforcementScope).default(EnforcementScope.PLATFORM),\n  scopeId: z.string().optional(),\n})\n\nconst complianceResponseSchema = z.object({\n  scope: z.nativeEnum(EnforcementScope),\n  scopeId: z.string().nullable(),\n  total: z.number().int().nonnegative(),\n  enrolled: z.number().int().nonnegative(),\n  pending: z.number().int().nonnegative(),\n  overdue: z.number().int().nonnegative(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['security.admin.manage'] },\n}\n\nexport async function GET(req: Request) {\n  const context = await resolveEnforcementContext(req)\n  if (context instanceof NextResponse) return context\n\n  const url = new URL(req.url)\n  const parsedQuery = complianceQuerySchema.safeParse({\n    scope: url.searchParams.get('scope') ?? undefined,\n    scopeId: url.searchParams.get('scopeId') ?? undefined,\n  })\n  if (!parsedQuery.success) {\n    return securityApiError(400, 'Invalid query parameters', { issues: parsedQuery.error.issues })\n  }\n\n  try {\n    const report = await context.enforcementService.getComplianceReport(\n      parsedQuery.data.scope,\n      parsedQuery.data.scopeId,\n    )\n    return NextResponse.json({\n      scope: parsedQuery.data.scope,\n      scopeId: parsedQuery.data.scopeId ?? null,\n      ...report,\n    })\n  } catch (error) {\n    return await mapEnforcementError(error)\n  }\n}\n\nexport const openApi = buildSecurityOpenApi({\n  summary: 'Enforcement compliance routes',\n  methods: {\n    GET: {\n      summary: 'Get compliance summary for enforcement scope',\n      query: complianceQuerySchema,\n      responses: [\n        { status: 200, description: 'Compliance summary', schema: complianceResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid query parameters', schema: securityErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: securityErrorSchema },\n      ],\n    },\n  },\n})\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,wBAAwB;AACjC,SAAS,sBAAsB,2BAA2B;AAC1D,SAAS,wBAAwB;AACjC,SAAS,qBAAqB,iCAAiC;AAE/D,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,OAAO,EAAE,WAAW,gBAAgB,EAAE,QAAQ,iBAAiB,QAAQ;AAAA,EACvE,SAAS,EAAE,OAAO,EAAE,SAAS;AAC/B,CAAC;AAED,MAAM,2BAA2B,EAAE,OAAO;AAAA,EACxC,OAAO,EAAE,WAAW,gBAAgB;AAAA,EACpC,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACpC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACvC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACtC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AACxC,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AACvE;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,UAAU,MAAM,0BAA0B,GAAG;AACnD,MAAI,mBAAmB,aAAc,QAAO;AAE5C,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,cAAc,sBAAsB,UAAU;AAAA,IAClD,OAAO,IAAI,aAAa,IAAI,OAAO,KAAK;AAAA,IACxC,SAAS,IAAI,aAAa,IAAI,SAAS,KAAK;AAAA,EAC9C,CAAC;AACD,MAAI,CAAC,YAAY,SAAS;AACxB,WAAO,iBAAiB,KAAK,4BAA4B,EAAE,QAAQ,YAAY,MAAM,OAAO,CAAC;AAAA,EAC/F;AAEA,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ,mBAAmB;AAAA,MAC9C,YAAY,KAAK;AAAA,MACjB,YAAY,KAAK;AAAA,IACnB;AACA,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,YAAY,KAAK;AAAA,MACxB,SAAS,YAAY,KAAK,WAAW;AAAA,MACrC,GAAG;AAAA,IACL,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,oBAAoB,KAAK;AAAA,EACxC;AACF;AAEO,MAAM,UAAU,qBAAqB;AAAA,EAC1C,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,yBAAyB;AAAA,MACrF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,MAC1E;AAAA,IACF;AAAA,EACF;AACF,CAAC;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { EnforcementScope } from '../../../data/entities'\nimport { buildSecurityOpenApi, securityErrorSchema } from '../../openapi'\nimport { securityApiError } from '../../i18n'\nimport {\n  assertActorOwnsEnforcementScope,\n  mapEnforcementError,\n  resolveActorContext,\n  resolveEnforcementContext,\n} from '../_shared'\n\nconst complianceQuerySchema = z.object({\n  scope: z.nativeEnum(EnforcementScope).default(EnforcementScope.PLATFORM),\n  scopeId: z.string().optional(),\n})\n\nconst complianceResponseSchema = z.object({\n  scope: z.nativeEnum(EnforcementScope),\n  scopeId: z.string().nullable(),\n  total: z.number().int().nonnegative(),\n  enrolled: z.number().int().nonnegative(),\n  pending: z.number().int().nonnegative(),\n  overdue: z.number().int().nonnegative(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['security.admin.manage'] },\n}\n\nexport async function GET(req: Request) {\n  const context = await resolveEnforcementContext(req)\n  if (context instanceof NextResponse) return context\n\n  const url = new URL(req.url)\n  const parsedQuery = complianceQuerySchema.safeParse({\n    scope: url.searchParams.get('scope') ?? undefined,\n    scopeId: url.searchParams.get('scopeId') ?? undefined,\n  })\n  if (!parsedQuery.success) {\n    return securityApiError(400, 'Invalid query parameters', { issues: parsedQuery.error.issues })\n  }\n\n  try {\n    await assertActorOwnsEnforcementScope(context, parsedQuery.data.scope, parsedQuery.data.scopeId)\n    const actor = await resolveActorContext(context)\n    const report = await context.enforcementService.getComplianceReport(\n      parsedQuery.data.scope,\n      parsedQuery.data.scopeId,\n      actor,\n    )\n    return NextResponse.json({\n      scope: parsedQuery.data.scope,\n      scopeId: parsedQuery.data.scopeId ?? null,\n      ...report,\n    })\n  } catch (error) {\n    return await mapEnforcementError(error)\n  }\n}\n\nexport const openApi = buildSecurityOpenApi({\n  summary: 'Enforcement compliance routes',\n  methods: {\n    GET: {\n      summary: 'Get compliance summary for enforcement scope',\n      query: complianceQuerySchema,\n      responses: [\n        { status: 200, description: 'Compliance summary', schema: complianceResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid query parameters', schema: securityErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: securityErrorSchema },\n        { status: 403, description: 'Not authorized for the requested scope', schema: securityErrorSchema },\n      ],\n    },\n  },\n})\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,wBAAwB;AACjC,SAAS,sBAAsB,2BAA2B;AAC1D,SAAS,wBAAwB;AACjC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,OAAO,EAAE,WAAW,gBAAgB,EAAE,QAAQ,iBAAiB,QAAQ;AAAA,EACvE,SAAS,EAAE,OAAO,EAAE,SAAS;AAC/B,CAAC;AAED,MAAM,2BAA2B,EAAE,OAAO;AAAA,EACxC,OAAO,EAAE,WAAW,gBAAgB;AAAA,EACpC,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACpC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACvC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACtC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AACxC,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AACvE;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,UAAU,MAAM,0BAA0B,GAAG;AACnD,MAAI,mBAAmB,aAAc,QAAO;AAE5C,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,cAAc,sBAAsB,UAAU;AAAA,IAClD,OAAO,IAAI,aAAa,IAAI,OAAO,KAAK;AAAA,IACxC,SAAS,IAAI,aAAa,IAAI,SAAS,KAAK;AAAA,EAC9C,CAAC;AACD,MAAI,CAAC,YAAY,SAAS;AACxB,WAAO,iBAAiB,KAAK,4BAA4B,EAAE,QAAQ,YAAY,MAAM,OAAO,CAAC;AAAA,EAC/F;AAEA,MAAI;AACF,UAAM,gCAAgC,SAAS,YAAY,KAAK,OAAO,YAAY,KAAK,OAAO;AAC/F,UAAM,QAAQ,MAAM,oBAAoB,OAAO;AAC/C,UAAM,SAAS,MAAM,QAAQ,mBAAmB;AAAA,MAC9C,YAAY,KAAK;AAAA,MACjB,YAAY,KAAK;AAAA,MACjB;AAAA,IACF;AACA,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,YAAY,KAAK;AAAA,MACxB,SAAS,YAAY,KAAK,WAAW;AAAA,MACrC,GAAG;AAAA,IACL,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,oBAAoB,KAAK;AAAA,EACxC;AACF;AAEO,MAAM,UAAU,qBAAqB;AAAA,EAC1C,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,yBAAyB;AAAA,MACrF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,0CAA0C,QAAQ,oBAAoB;AAAA,MACpG;AAAA,IACF;AAAA,EACF;AACF,CAAC;",
   "names": []
 }

package/dist/modules/security/api/enforcement/route.js

@@ -4,7 +4,13 @@ import { enforcementPolicySchema } from "../../data/validators.js";
 import { EnforcementScope } from "../../data/entities.js";
 import { buildSecurityOpenApi, securityErrorSchema } from "../openapi.js";
 import { securityApiError } from "../i18n.js";
-import { attachPolicyScopeNames, mapEnforcementError, resolveEnforcementContext } from "./_shared.js";
+import {
+  assertActorOwnsEnforcementScope,
+  attachPolicyScopeNames,
+  mapEnforcementError,
+  resolveActorContext,
+  resolveEnforcementContext
+} from "./_shared.js";
 const enforcementPolicyResponseSchema = z.object({
   id: z.string().uuid(),
   scope: z.nativeEnum(EnforcementScope),
@@ -43,7 +49,8 @@ async function GET(req) {
     if (!parsedQuery.success) {
       return securityApiError(400, "Invalid query parameters", { issues: parsedQuery.error.issues });
     }
-    const policies = await context.enforcementService.listPolicies(parsedQuery.data);
+    const actor = await resolveActorContext(context);
+    const policies = await context.enforcementService.listPolicies(parsedQuery.data, actor);
     return NextResponse.json({
       items: await attachPolicyScopeNames(context.container, policies)
     });
@@ -65,6 +72,11 @@ async function POST(req) {
     return securityApiError(400, "Invalid payload", { issues: parsedBody.error.issues });
   }
   try {
+    await assertActorOwnsEnforcementScope(
+      context,
+      parsedBody.data.scope,
+      scopeIdFromPolicyInput(parsedBody.data)
+    );
     const commandBus = context.container.resolve("commandBus");
     const { result } = await commandBus.execute("security.enforcement.create", {
       input: parsedBody.data,
@@ -75,6 +87,16 @@ async function POST(req) {
     return await mapEnforcementError(error);
   }
 }
+function scopeIdFromPolicyInput(data) {
+  if (data.scope === EnforcementScope.TENANT) {
+    return data.tenantId ?? null;
+  }
+  if (data.scope === EnforcementScope.ORGANISATION) {
+    if (!data.tenantId || !data.organizationId) return null;
+    return `${data.tenantId}:${data.organizationId}`;
+  }
+  return null;
+}
 const openApi = buildSecurityOpenApi({
   summary: "Enforcement policy routes",
   methods: {
@@ -101,6 +123,7 @@ const openApi = buildSecurityOpenApi({
       errors: [
         { status: 400, description: "Invalid payload", schema: securityErrorSchema },
         { status: 401, description: "Unauthorized", schema: securityErrorSchema },
+        { status: 403, description: "Not authorized for the requested scope", schema: securityErrorSchema },
         { status: 409, description: "Conflict", schema: securityErrorSchema }
       ]
     }

package/dist/modules/security/api/enforcement/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/security/api/enforcement/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport { enforcementPolicySchema } from '../../data/validators'\nimport { EnforcementScope } from '../../data/entities'\nimport { buildSecurityOpenApi, securityErrorSchema } from '../openapi'\nimport { securityApiError } from '../i18n'\nimport { attachPolicyScopeNames, mapEnforcementError, resolveEnforcementContext } from './_shared'\n\nconst enforcementPolicyResponseSchema = z.object({\n  id: z.string().uuid(),\n  scope: z.nativeEnum(EnforcementScope),\n  tenantId: z.string().uuid().nullable(),\n  tenantName: z.string().nullable(),\n  organizationId: z.string().uuid().nullable(),\n  organizationName: z.string().nullable(),\n  isEnforced: z.boolean(),\n  allowedMethods: z.array(z.string()).nullable(),\n  enforcementDeadline: z.string().nullable(),\n  enforcedBy: z.string().uuid(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n})\n\nconst enforcementPolicyListResponseSchema = z.object({\n  items: z.array(enforcementPolicyResponseSchema),\n})\n\nconst createEnforcementPolicyResponseSchema = z.object({\n  id: z.string().uuid(),\n})\n\nconst listQuerySchema = z.object({\n  scope: z.nativeEnum(EnforcementScope).optional(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['security.admin.manage'] },\n  POST: { requireAuth: true, requireFeatures: ['security.admin.manage'] },\n}\n\nexport async function GET(req: Request) {\n  const context = await resolveEnforcementContext(req)\n  if (context instanceof NextResponse) return context\n\n  try {\n    const url = new URL(req.url)\n    const parsedQuery = listQuerySchema.safeParse({\n      scope: url.searchParams.get('scope') ?? undefined,\n    })\n    if (!parsedQuery.success) {\n      return securityApiError(400, 'Invalid query parameters', { issues: parsedQuery.error.issues })\n    }\n\n    const policies = await context.enforcementService.listPolicies(parsedQuery.data)\n    return NextResponse.json({\n      items: await attachPolicyScopeNames(context.container, policies),\n    })\n  } catch (error) {\n    return await mapEnforcementError(error)\n  }\n}\n\nexport async function POST(req: Request) {\n  const context = await resolveEnforcementContext(req)\n  if (context instanceof NextResponse) return context\n\n  let rawBody: unknown\n  try {\n    rawBody = await req.json()\n  } catch {\n    rawBody = {}\n  }\n\n  const parsedBody = enforcementPolicySchema.safeParse(rawBody)\n  if (!parsedBody.success) {\n    return securityApiError(400, 'Invalid payload', { issues: parsedBody.error.issues })\n  }\n\n  try {\n    const commandBus = context.container.resolve<CommandBus>('commandBus')\n    const { result } = await commandBus.execute('security.enforcement.create', {\n      input: parsedBody.data,\n      ctx: context.commandContext,\n    })\n    return NextResponse.json(result, { status: 201 })\n  } catch (error) {\n    return await mapEnforcementError(error)\n  }\n}\n\nexport const openApi = buildSecurityOpenApi({\n  summary: 'Enforcement policy routes',\n  methods: {\n    GET: {\n      summary: 'List enforcement policies',\n      query: listQuerySchema,\n      responses: [\n        { status: 200, description: 'Enforcement policies', schema: enforcementPolicyListResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid query parameters', schema: securityErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: securityErrorSchema },\n      ],\n    },\n    POST: {\n      summary: 'Create enforcement policy',\n      requestBody: {\n        contentType: 'application/json',\n        schema: enforcementPolicySchema,\n      },\n      responses: [\n        { status: 201, description: 'Policy created', schema: createEnforcementPolicyResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid payload', schema: securityErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: securityErrorSchema },\n        { status: 409, description: 'Conflict', schema: securityErrorSchema },\n      ],\n    },\n  },\n})\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,+BAA+B;AACxC,SAAS,wBAAwB;AACjC,SAAS,sBAAsB,2BAA2B;AAC1D,SAAS,wBAAwB;AACjC,SAAS,wBAAwB,qBAAqB,iCAAiC;AAEvF,MAAM,kCAAkC,EAAE,OAAO;AAAA,EAC/C,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,OAAO,EAAE,WAAW,gBAAgB;AAAA,EACpC,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,kBAAkB,EAAE,OAAO,EAAE,SAAS;AAAA,EACtC,YAAY,EAAE,QAAQ;AAAA,EACtB,gBAAgB,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EAC7C,qBAAqB,EAAE,OAAO,EAAE,SAAS;AAAA,EACzC,YAAY,EAAE,OAAO,EAAE,KAAK;AAAA,EAC5B,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAED,MAAM,sCAAsC,EAAE,OAAO;AAAA,EACnD,OAAO,EAAE,MAAM,+BAA+B;AAChD,CAAC;AAED,MAAM,wCAAwC,EAAE,OAAO;AAAA,EACrD,IAAI,EAAE,OAAO,EAAE,KAAK;AACtB,CAAC;AAED,MAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,OAAO,EAAE,WAAW,gBAAgB,EAAE,SAAS;AACjD,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AAAA,EACrE,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AACxE;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,UAAU,MAAM,0BAA0B,GAAG;AACnD,MAAI,mBAAmB,aAAc,QAAO;AAE5C,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,cAAc,gBAAgB,UAAU;AAAA,MAC5C,OAAO,IAAI,aAAa,IAAI,OAAO,KAAK;AAAA,IAC1C,CAAC;AACD,QAAI,CAAC,YAAY,SAAS;AACxB,aAAO,iBAAiB,KAAK,4BAA4B,EAAE,QAAQ,YAAY,MAAM,OAAO,CAAC;AAAA,IAC/F;AAEA,UAAM,WAAW,MAAM,QAAQ,mBAAmB,aAAa,YAAY,IAAI;AAC/E,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,MAAM,uBAAuB,QAAQ,WAAW,QAAQ;AAAA,IACjE,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,oBAAoB,KAAK;AAAA,EACxC;AACF;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,UAAU,MAAM,0BAA0B,GAAG;AACnD,MAAI,mBAAmB,aAAc,QAAO;AAE5C,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,IAAI,KAAK;AAAA,EAC3B,QAAQ;AACN,cAAU,CAAC;AAAA,EACb;AAEA,QAAM,aAAa,wBAAwB,UAAU,OAAO;AAC5D,MAAI,CAAC,WAAW,SAAS;AACvB,WAAO,iBAAiB,KAAK,mBAAmB,EAAE,QAAQ,WAAW,MAAM,OAAO,CAAC;AAAA,EACrF;AAEA,MAAI;AACF,UAAM,aAAa,QAAQ,UAAU,QAAoB,YAAY;AACrE,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW,QAAQ,+BAA+B;AAAA,MACzE,OAAO,WAAW;AAAA,MAClB,KAAK,QAAQ;AAAA,IACf,CAAC;AACD,WAAO,aAAa,KAAK,QAAQ,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClD,SAAS,OAAO;AACd,WAAO,MAAM,oBAAoB,KAAK;AAAA,EACxC;AACF;AAEO,MAAM,UAAU,qBAAqB;AAAA,EAC1C,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,oCAAoC;AAAA,MAClG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,MAC1E;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,sCAAsC;AAAA,MAC9F;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,oBAAoB;AAAA,QAC3E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,YAAY,QAAQ,oBAAoB;AAAA,MACtE;AAAA,IACF;AAAA,EACF;AACF,CAAC;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport { enforcementPolicySchema } from '../../data/validators'\nimport { EnforcementScope } from '../../data/entities'\nimport { buildSecurityOpenApi, securityErrorSchema } from '../openapi'\nimport { securityApiError } from '../i18n'\nimport {\n  assertActorOwnsEnforcementScope,\n  attachPolicyScopeNames,\n  mapEnforcementError,\n  resolveActorContext,\n  resolveEnforcementContext,\n} from './_shared'\n\nconst enforcementPolicyResponseSchema = z.object({\n  id: z.string().uuid(),\n  scope: z.nativeEnum(EnforcementScope),\n  tenantId: z.string().uuid().nullable(),\n  tenantName: z.string().nullable(),\n  organizationId: z.string().uuid().nullable(),\n  organizationName: z.string().nullable(),\n  isEnforced: z.boolean(),\n  allowedMethods: z.array(z.string()).nullable(),\n  enforcementDeadline: z.string().nullable(),\n  enforcedBy: z.string().uuid(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n})\n\nconst enforcementPolicyListResponseSchema = z.object({\n  items: z.array(enforcementPolicyResponseSchema),\n})\n\nconst createEnforcementPolicyResponseSchema = z.object({\n  id: z.string().uuid(),\n})\n\nconst listQuerySchema = z.object({\n  scope: z.nativeEnum(EnforcementScope).optional(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['security.admin.manage'] },\n  POST: { requireAuth: true, requireFeatures: ['security.admin.manage'] },\n}\n\nexport async function GET(req: Request) {\n  const context = await resolveEnforcementContext(req)\n  if (context instanceof NextResponse) return context\n\n  try {\n    const url = new URL(req.url)\n    const parsedQuery = listQuerySchema.safeParse({\n      scope: url.searchParams.get('scope') ?? undefined,\n    })\n    if (!parsedQuery.success) {\n      return securityApiError(400, 'Invalid query parameters', { issues: parsedQuery.error.issues })\n    }\n\n    const actor = await resolveActorContext(context)\n    const policies = await context.enforcementService.listPolicies(parsedQuery.data, actor)\n    return NextResponse.json({\n      items: await attachPolicyScopeNames(context.container, policies),\n    })\n  } catch (error) {\n    return await mapEnforcementError(error)\n  }\n}\n\nexport async function POST(req: Request) {\n  const context = await resolveEnforcementContext(req)\n  if (context instanceof NextResponse) return context\n\n  let rawBody: unknown\n  try {\n    rawBody = await req.json()\n  } catch {\n    rawBody = {}\n  }\n\n  const parsedBody = enforcementPolicySchema.safeParse(rawBody)\n  if (!parsedBody.success) {\n    return securityApiError(400, 'Invalid payload', { issues: parsedBody.error.issues })\n  }\n\n  try {\n    await assertActorOwnsEnforcementScope(\n      context,\n      parsedBody.data.scope,\n      scopeIdFromPolicyInput(parsedBody.data),\n    )\n    const commandBus = context.container.resolve<CommandBus>('commandBus')\n    const { result } = await commandBus.execute('security.enforcement.create', {\n      input: parsedBody.data,\n      ctx: context.commandContext,\n    })\n    return NextResponse.json(result, { status: 201 })\n  } catch (error) {\n    return await mapEnforcementError(error)\n  }\n}\n\nfunction scopeIdFromPolicyInput(data: {\n  scope: EnforcementScope\n  tenantId?: string | null\n  organizationId?: string | null\n}): string | null {\n  if (data.scope === EnforcementScope.TENANT) {\n    return data.tenantId ?? null\n  }\n  if (data.scope === EnforcementScope.ORGANISATION) {\n    if (!data.tenantId || !data.organizationId) return null\n    return `${data.tenantId}:${data.organizationId}`\n  }\n  return null\n}\n\nexport const openApi = buildSecurityOpenApi({\n  summary: 'Enforcement policy routes',\n  methods: {\n    GET: {\n      summary: 'List enforcement policies',\n      query: listQuerySchema,\n      responses: [\n        { status: 200, description: 'Enforcement policies', schema: enforcementPolicyListResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid query parameters', schema: securityErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: securityErrorSchema },\n      ],\n    },\n    POST: {\n      summary: 'Create enforcement policy',\n      requestBody: {\n        contentType: 'application/json',\n        schema: enforcementPolicySchema,\n      },\n      responses: [\n        { status: 201, description: 'Policy created', schema: createEnforcementPolicyResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid payload', schema: securityErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: securityErrorSchema },\n        { status: 403, description: 'Not authorized for the requested scope', schema: securityErrorSchema },\n        { status: 409, description: 'Conflict', schema: securityErrorSchema },\n      ],\n    },\n  },\n})\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,+BAA+B;AACxC,SAAS,wBAAwB;AACjC,SAAS,sBAAsB,2BAA2B;AAC1D,SAAS,wBAAwB;AACjC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,kCAAkC,EAAE,OAAO;AAAA,EAC/C,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,OAAO,EAAE,WAAW,gBAAgB;AAAA,EACpC,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,kBAAkB,EAAE,OAAO,EAAE,SAAS;AAAA,EACtC,YAAY,EAAE,QAAQ;AAAA,EACtB,gBAAgB,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EAC7C,qBAAqB,EAAE,OAAO,EAAE,SAAS;AAAA,EACzC,YAAY,EAAE,OAAO,EAAE,KAAK;AAAA,EAC5B,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAED,MAAM,sCAAsC,EAAE,OAAO;AAAA,EACnD,OAAO,EAAE,MAAM,+BAA+B;AAChD,CAAC;AAED,MAAM,wCAAwC,EAAE,OAAO;AAAA,EACrD,IAAI,EAAE,OAAO,EAAE,KAAK;AACtB,CAAC;AAED,MAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,OAAO,EAAE,WAAW,gBAAgB,EAAE,SAAS;AACjD,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AAAA,EACrE,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AACxE;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,UAAU,MAAM,0BAA0B,GAAG;AACnD,MAAI,mBAAmB,aAAc,QAAO;AAE5C,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,cAAc,gBAAgB,UAAU;AAAA,MAC5C,OAAO,IAAI,aAAa,IAAI,OAAO,KAAK;AAAA,IAC1C,CAAC;AACD,QAAI,CAAC,YAAY,SAAS;AACxB,aAAO,iBAAiB,KAAK,4BAA4B,EAAE,QAAQ,YAAY,MAAM,OAAO,CAAC;AAAA,IAC/F;AAEA,UAAM,QAAQ,MAAM,oBAAoB,OAAO;AAC/C,UAAM,WAAW,MAAM,QAAQ,mBAAmB,aAAa,YAAY,MAAM,KAAK;AACtF,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,MAAM,uBAAuB,QAAQ,WAAW,QAAQ;AAAA,IACjE,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,oBAAoB,KAAK;AAAA,EACxC;AACF;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,UAAU,MAAM,0BAA0B,GAAG;AACnD,MAAI,mBAAmB,aAAc,QAAO;AAE5C,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,IAAI,KAAK;AAAA,EAC3B,QAAQ;AACN,cAAU,CAAC;AAAA,EACb;AAEA,QAAM,aAAa,wBAAwB,UAAU,OAAO;AAC5D,MAAI,CAAC,WAAW,SAAS;AACvB,WAAO,iBAAiB,KAAK,mBAAmB,EAAE,QAAQ,WAAW,MAAM,OAAO,CAAC;AAAA,EACrF;AAEA,MAAI;AACF,UAAM;AAAA,MACJ;AAAA,MACA,WAAW,KAAK;AAAA,MAChB,uBAAuB,WAAW,IAAI;AAAA,IACxC;AACA,UAAM,aAAa,QAAQ,UAAU,QAAoB,YAAY;AACrE,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW,QAAQ,+BAA+B;AAAA,MACzE,OAAO,WAAW;AAAA,MAClB,KAAK,QAAQ;AAAA,IACf,CAAC;AACD,WAAO,aAAa,KAAK,QAAQ,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClD,SAAS,OAAO;AACd,WAAO,MAAM,oBAAoB,KAAK;AAAA,EACxC;AACF;AAEA,SAAS,uBAAuB,MAId;AAChB,MAAI,KAAK,UAAU,iBAAiB,QAAQ;AAC1C,WAAO,KAAK,YAAY;AAAA,EAC1B;AACA,MAAI,KAAK,UAAU,iBAAiB,cAAc;AAChD,QAAI,CAAC,KAAK,YAAY,CAAC,KAAK,eAAgB,QAAO;AACnD,WAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,cAAc;AAAA,EAChD;AACA,SAAO;AACT;AAEO,MAAM,UAAU,qBAAqB;AAAA,EAC1C,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,oCAAoC;AAAA,MAClG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,MAC1E;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,sCAAsC;AAAA,MAC9F;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,oBAAoB;AAAA,QAC3E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,0CAA0C,QAAQ,oBAAoB;AAAA,QAClG,EAAE,QAAQ,KAAK,aAAa,YAAY,QAAQ,oBAAoB;AAAA,MACtE;AAAA,IACF;AAAA,EACF;AACF,CAAC;",
   "names": []
 }

package/dist/modules/security/api/mfa/prepare/route.js

@@ -12,7 +12,7 @@ const responseSchema = z.object({
   clientData: z.record(z.string(), z.unknown()).optional()
 });
 const metadata = {
-  POST: { requireAuth: true }
+  POST: { requireAuth: true, rateLimit: { points: 20, duration: 60, keyPrefix: "security_mfa_prepare" } }
 };
 async function POST(req) {
   const context = await resolveMfaRequestContext(req);

package/dist/modules/security/api/mfa/prepare/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/security/api/mfa/prepare/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { buildSecurityOpenApi, securityErrorSchema } from '../../openapi'\nimport { securityApiError } from '../../i18n'\nimport { mapMfaError, readJsonRecord, readString, resolveMfaRequestContext } from '../_shared'\n\nconst requestSchema = z.object({\n  challengeId: z.string().min(1),\n  methodType: z.string().min(1),\n})\n\nconst responseSchema = z.object({\n  ok: z.literal(true),\n  clientData: z.record(z.string(), z.unknown()).optional(),\n})\n\nexport const metadata = {\n  POST: { requireAuth: true },\n}\n\nexport async function POST(req: Request) {\n  const context = await resolveMfaRequestContext(req)\n  if (context instanceof NextResponse) return context\n\n  if (context.auth.mfa_pending !== true) {\n    return securityApiError(403, 'MFA pending token is required.')\n  }\n\n  const body = await readJsonRecord(req)\n  const challengeId = readString(body.challengeId)\n  const methodType = readString(body.methodType)\n  if (!challengeId || !methodType) {\n    return securityApiError(400, 'challengeId and methodType are required.')\n  }\n\n  try {\n    const prepared = await context.mfaVerificationService.prepareChallenge(challengeId, methodType, { request: req })\n    return NextResponse.json({ ok: true, ...(prepared.clientData ? { clientData: prepared.clientData } : {}) })\n  } catch (error) {\n    return await mapMfaError(error)\n  }\n}\n\nexport const openApi = buildSecurityOpenApi({\n  summary: 'MFA challenge prepare routes',\n  methods: {\n    POST: {\n      summary: 'Prepare MFA challenge payload for selected method',\n      requestBody: {\n        contentType: 'application/json',\n        schema: requestSchema,\n      },\n      responses: [{ status: 200, description: 'MFA challenge prepared', schema: responseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid payload', schema: securityErrorSchema },\n        { status: 403, description: 'Pending MFA context required', schema: securityErrorSchema },\n      ],\n    },\n  },\n})\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,sBAAsB,2BAA2B;AAC1D,SAAS,wBAAwB;AACjC,SAAS,aAAa,gBAAgB,YAAY,gCAAgC;AAElF,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC;AAC9B,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AACzD,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,KAAK;AAC5B;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,UAAU,MAAM,yBAAyB,GAAG;AAClD,MAAI,mBAAmB,aAAc,QAAO;AAE5C,MAAI,QAAQ,KAAK,gBAAgB,MAAM;AACrC,WAAO,iBAAiB,KAAK,gCAAgC;AAAA,EAC/D;AAEA,QAAM,OAAO,MAAM,eAAe,GAAG;AACrC,QAAM,cAAc,WAAW,KAAK,WAAW;AAC/C,QAAM,aAAa,WAAW,KAAK,UAAU;AAC7C,MAAI,CAAC,eAAe,CAAC,YAAY;AAC/B,WAAO,iBAAiB,KAAK,0CAA0C;AAAA,EACzE;AAEA,MAAI;AACF,UAAM,WAAW,MAAM,QAAQ,uBAAuB,iBAAiB,aAAa,YAAY,EAAE,SAAS,IAAI,CAAC;AAChH,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,GAAI,SAAS,aAAa,EAAE,YAAY,SAAS,WAAW,IAAI,CAAC,EAAG,CAAC;AAAA,EAC5G,SAAS,OAAO;AACd,WAAO,MAAM,YAAY,KAAK;AAAA,EAChC;AACF;AAEO,MAAM,UAAU,qBAAqB;AAAA,EAC1C,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,eAAe,CAAC;AAAA,MAC1F,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,oBAAoB;AAAA,QAC3E,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,oBAAoB;AAAA,MAC1F;AAAA,IACF;AAAA,EACF;AACF,CAAC;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { buildSecurityOpenApi, securityErrorSchema } from '../../openapi'\nimport { securityApiError } from '../../i18n'\nimport { mapMfaError, readJsonRecord, readString, resolveMfaRequestContext } from '../_shared'\n\nconst requestSchema = z.object({\n  challengeId: z.string().min(1),\n  methodType: z.string().min(1),\n})\n\nconst responseSchema = z.object({\n  ok: z.literal(true),\n  clientData: z.record(z.string(), z.unknown()).optional(),\n})\n\nexport const metadata = {\n  POST: { requireAuth: true, rateLimit: { points: 20, duration: 60, keyPrefix: 'security_mfa_prepare' } },\n}\n\nexport async function POST(req: Request) {\n  const context = await resolveMfaRequestContext(req)\n  if (context instanceof NextResponse) return context\n\n  if (context.auth.mfa_pending !== true) {\n    return securityApiError(403, 'MFA pending token is required.')\n  }\n\n  const body = await readJsonRecord(req)\n  const challengeId = readString(body.challengeId)\n  const methodType = readString(body.methodType)\n  if (!challengeId || !methodType) {\n    return securityApiError(400, 'challengeId and methodType are required.')\n  }\n\n  try {\n    const prepared = await context.mfaVerificationService.prepareChallenge(challengeId, methodType, { request: req })\n    return NextResponse.json({ ok: true, ...(prepared.clientData ? { clientData: prepared.clientData } : {}) })\n  } catch (error) {\n    return await mapMfaError(error)\n  }\n}\n\nexport const openApi = buildSecurityOpenApi({\n  summary: 'MFA challenge prepare routes',\n  methods: {\n    POST: {\n      summary: 'Prepare MFA challenge payload for selected method',\n      requestBody: {\n        contentType: 'application/json',\n        schema: requestSchema,\n      },\n      responses: [{ status: 200, description: 'MFA challenge prepared', schema: responseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid payload', schema: securityErrorSchema },\n        { status: 403, description: 'Pending MFA context required', schema: securityErrorSchema },\n      ],\n    },\n  },\n})\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,sBAAsB,2BAA2B;AAC1D,SAAS,wBAAwB;AACjC,SAAS,aAAa,gBAAgB,YAAY,gCAAgC;AAElF,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC;AAC9B,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AACzD,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,WAAW,EAAE,QAAQ,IAAI,UAAU,IAAI,WAAW,uBAAuB,EAAE;AACxG;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,UAAU,MAAM,yBAAyB,GAAG;AAClD,MAAI,mBAAmB,aAAc,QAAO;AAE5C,MAAI,QAAQ,KAAK,gBAAgB,MAAM;AACrC,WAAO,iBAAiB,KAAK,gCAAgC;AAAA,EAC/D;AAEA,QAAM,OAAO,MAAM,eAAe,GAAG;AACrC,QAAM,cAAc,WAAW,KAAK,WAAW;AAC/C,QAAM,aAAa,WAAW,KAAK,UAAU;AAC7C,MAAI,CAAC,eAAe,CAAC,YAAY;AAC/B,WAAO,iBAAiB,KAAK,0CAA0C;AAAA,EACzE;AAEA,MAAI;AACF,UAAM,WAAW,MAAM,QAAQ,uBAAuB,iBAAiB,aAAa,YAAY,EAAE,SAAS,IAAI,CAAC;AAChH,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,GAAI,SAAS,aAAa,EAAE,YAAY,SAAS,WAAW,IAAI,CAAC,EAAG,CAAC;AAAA,EAC5G,SAAS,OAAO;AACd,WAAO,MAAM,YAAY,KAAK;AAAA,EAChC;AACF;AAEO,MAAM,UAAU,qBAAqB;AAAA,EAC1C,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,eAAe,CAAC;AAAA,MAC1F,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,oBAAoB;AAAA,QAC3E,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,oBAAoB;AAAA,MAC1F;AAAA,IACF;AAAA,EACF;AACF,CAAC;",
   "names": []
 }

package/dist/modules/security/api/mfa/recovery/route.js

@@ -12,7 +12,7 @@ const responseSchema = z.object({
   redirect: z.string()
 });
 const metadata = {
-  POST: { requireAuth: true }
+  POST: { requireAuth: true, rateLimit: { points: 10, duration: 60, keyPrefix: "security_mfa_recovery" } }
 };
 async function POST(req) {
   const context = await resolveMfaRequestContext(req);

package/dist/modules/security/api/mfa/recovery/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/security/api/mfa/recovery/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { buildSecurityOpenApi, securityErrorSchema } from '../../openapi'\nimport { securityApiError } from '../../i18n'\nimport { issueVerifiedMfaToken, mapMfaError, readJsonRecord, readString, resolveMfaRequestContext, setAuthCookie } from '../_shared'\n\nconst requestSchema = z.object({\n  code: z.string().min(1),\n})\n\nconst responseSchema = z.object({\n  ok: z.literal(true),\n  token: z.string(),\n  redirect: z.string(),\n})\n\nexport const metadata = {\n  POST: { requireAuth: true },\n}\n\nexport async function POST(req: Request) {\n  const context = await resolveMfaRequestContext(req)\n  if (context instanceof NextResponse) return context\n\n  if (context.auth.mfa_pending !== true) {\n    return securityApiError(403, 'MFA pending token is required.')\n  }\n\n  const body = await readJsonRecord(req)\n  const code = readString(body.code)\n  if (!code) {\n    return securityApiError(400, 'code is required.')\n  }\n\n  try {\n    const verified = await context.mfaVerificationService.verifyRecoveryCode(context.auth.sub, code)\n    if (!verified) {\n      return securityApiError(401, 'Invalid recovery code.')\n    }\n\n    const methods = await context.mfaService.getUserMethods(context.auth.sub)\n    const token = issueVerifiedMfaToken(context.auth, methods.map((method) => method.type))\n    const response = NextResponse.json({ ok: true, token, redirect: '/backend' })\n    setAuthCookie(response, token)\n    return response\n  } catch (error) {\n    return await mapMfaError(error)\n  }\n}\n\nexport const openApi = buildSecurityOpenApi({\n  summary: 'MFA recovery routes',\n  methods: {\n    POST: {\n      summary: 'Verify MFA recovery code during login flow',\n      requestBody: {\n        contentType: 'application/json',\n        schema: requestSchema,\n      },\n      responses: [{ status: 200, description: 'Recovery challenge verified', schema: responseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid payload', schema: securityErrorSchema },\n        { status: 401, description: 'Invalid recovery code', schema: securityErrorSchema },\n        { status: 403, description: 'Pending MFA context required', schema: securityErrorSchema },\n      ],\n    },\n  },\n})\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,sBAAsB,2BAA2B;AAC1D,SAAS,wBAAwB;AACjC,SAAS,uBAAuB,aAAa,gBAAgB,YAAY,0BAA0B,qBAAqB;AAExH,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AACxB,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,OAAO,EAAE,OAAO;AAAA,EAChB,UAAU,EAAE,OAAO;AACrB,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,KAAK;AAC5B;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,UAAU,MAAM,yBAAyB,GAAG;AAClD,MAAI,mBAAmB,aAAc,QAAO;AAE5C,MAAI,QAAQ,KAAK,gBAAgB,MAAM;AACrC,WAAO,iBAAiB,KAAK,gCAAgC;AAAA,EAC/D;AAEA,QAAM,OAAO,MAAM,eAAe,GAAG;AACrC,QAAM,OAAO,WAAW,KAAK,IAAI;AACjC,MAAI,CAAC,MAAM;AACT,WAAO,iBAAiB,KAAK,mBAAmB;AAAA,EAClD;AAEA,MAAI;AACF,UAAM,WAAW,MAAM,QAAQ,uBAAuB,mBAAmB,QAAQ,KAAK,KAAK,IAAI;AAC/F,QAAI,CAAC,UAAU;AACb,aAAO,iBAAiB,KAAK,wBAAwB;AAAA,IACvD;AAEA,UAAM,UAAU,MAAM,QAAQ,WAAW,eAAe,QAAQ,KAAK,GAAG;AACxE,UAAM,QAAQ,sBAAsB,QAAQ,MAAM,QAAQ,IAAI,CAAC,WAAW,OAAO,IAAI,CAAC;AACtF,UAAM,WAAW,aAAa,KAAK,EAAE,IAAI,MAAM,OAAO,UAAU,WAAW,CAAC;AAC5E,kBAAc,UAAU,KAAK;AAC7B,WAAO;AAAA,EACT,SAAS,OAAO;AACd,WAAO,MAAM,YAAY,KAAK;AAAA,EAChC;AACF;AAEO,MAAM,UAAU,qBAAqB;AAAA,EAC1C,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,+BAA+B,QAAQ,eAAe,CAAC;AAAA,MAC/F,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,oBAAoB;AAAA,QAC3E,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,oBAAoB;AAAA,MAC1F;AAAA,IACF;AAAA,EACF;AACF,CAAC;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { buildSecurityOpenApi, securityErrorSchema } from '../../openapi'\nimport { securityApiError } from '../../i18n'\nimport { issueVerifiedMfaToken, mapMfaError, readJsonRecord, readString, resolveMfaRequestContext, setAuthCookie } from '../_shared'\n\nconst requestSchema = z.object({\n  code: z.string().min(1),\n})\n\nconst responseSchema = z.object({\n  ok: z.literal(true),\n  token: z.string(),\n  redirect: z.string(),\n})\n\nexport const metadata = {\n  POST: { requireAuth: true, rateLimit: { points: 10, duration: 60, keyPrefix: 'security_mfa_recovery' } },\n}\n\nexport async function POST(req: Request) {\n  const context = await resolveMfaRequestContext(req)\n  if (context instanceof NextResponse) return context\n\n  if (context.auth.mfa_pending !== true) {\n    return securityApiError(403, 'MFA pending token is required.')\n  }\n\n  const body = await readJsonRecord(req)\n  const code = readString(body.code)\n  if (!code) {\n    return securityApiError(400, 'code is required.')\n  }\n\n  try {\n    const verified = await context.mfaVerificationService.verifyRecoveryCode(context.auth.sub, code)\n    if (!verified) {\n      return securityApiError(401, 'Invalid recovery code.')\n    }\n\n    const methods = await context.mfaService.getUserMethods(context.auth.sub)\n    const token = issueVerifiedMfaToken(context.auth, methods.map((method) => method.type))\n    const response = NextResponse.json({ ok: true, token, redirect: '/backend' })\n    setAuthCookie(response, token)\n    return response\n  } catch (error) {\n    return await mapMfaError(error)\n  }\n}\n\nexport const openApi = buildSecurityOpenApi({\n  summary: 'MFA recovery routes',\n  methods: {\n    POST: {\n      summary: 'Verify MFA recovery code during login flow',\n      requestBody: {\n        contentType: 'application/json',\n        schema: requestSchema,\n      },\n      responses: [{ status: 200, description: 'Recovery challenge verified', schema: responseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid payload', schema: securityErrorSchema },\n        { status: 401, description: 'Invalid recovery code', schema: securityErrorSchema },\n        { status: 403, description: 'Pending MFA context required', schema: securityErrorSchema },\n      ],\n    },\n  },\n})\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,sBAAsB,2BAA2B;AAC1D,SAAS,wBAAwB;AACjC,SAAS,uBAAuB,aAAa,gBAAgB,YAAY,0BAA0B,qBAAqB;AAExH,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AACxB,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,OAAO,EAAE,OAAO;AAAA,EAChB,UAAU,EAAE,OAAO;AACrB,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,WAAW,EAAE,QAAQ,IAAI,UAAU,IAAI,WAAW,wBAAwB,EAAE;AACzG;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,UAAU,MAAM,yBAAyB,GAAG;AAClD,MAAI,mBAAmB,aAAc,QAAO;AAE5C,MAAI,QAAQ,KAAK,gBAAgB,MAAM;AACrC,WAAO,iBAAiB,KAAK,gCAAgC;AAAA,EAC/D;AAEA,QAAM,OAAO,MAAM,eAAe,GAAG;AACrC,QAAM,OAAO,WAAW,KAAK,IAAI;AACjC,MAAI,CAAC,MAAM;AACT,WAAO,iBAAiB,KAAK,mBAAmB;AAAA,EAClD;AAEA,MAAI;AACF,UAAM,WAAW,MAAM,QAAQ,uBAAuB,mBAAmB,QAAQ,KAAK,KAAK,IAAI;AAC/F,QAAI,CAAC,UAAU;AACb,aAAO,iBAAiB,KAAK,wBAAwB;AAAA,IACvD;AAEA,UAAM,UAAU,MAAM,QAAQ,WAAW,eAAe,QAAQ,KAAK,GAAG;AACxE,UAAM,QAAQ,sBAAsB,QAAQ,MAAM,QAAQ,IAAI,CAAC,WAAW,OAAO,IAAI,CAAC;AACtF,UAAM,WAAW,aAAa,KAAK,EAAE,IAAI,MAAM,OAAO,UAAU,WAAW,CAAC;AAC5E,kBAAc,UAAU,KAAK;AAC7B,WAAO;AAAA,EACT,SAAS,OAAO;AACd,WAAO,MAAM,YAAY,KAAK;AAAA,EAChC;AACF;AAEO,MAAM,UAAU,qBAAqB;AAAA,EAC1C,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,+BAA+B,QAAQ,eAAe,CAAC;AAAA,MAC/F,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,oBAAoB;AAAA,QAC3E,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,oBAAoB;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,oBAAoB;AAAA,MAC1F;AAAA,IACF;AAAA,EACF;AACF,CAAC;",
   "names": []
 }

package/dist/modules/security/api/mfa/verify/route.js

@@ -14,7 +14,7 @@ const responseSchema = z.object({
   redirect: z.string()
 });
 const metadata = {
-  POST: { requireAuth: true }
+  POST: { requireAuth: true, rateLimit: { points: 10, duration: 60, keyPrefix: "security_mfa_verify" } }
 };
 async function POST(req) {
   const context = await resolveMfaRequestContext(req);

package/dist/modules/security/api/mfa/verify/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/security/api/mfa/verify/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { buildSecurityOpenApi, securityErrorSchema } from '../../openapi'\nimport { securityApiError } from '../../i18n'\nimport { issueVerifiedMfaToken, mapMfaError, readJsonRecord, readString, resolveMfaRequestContext, setAuthCookie } from '../_shared'\n\nconst requestSchema = z.object({\n  challengeId: z.string().min(1),\n  methodType: z.string().min(1),\n  payload: z.record(z.string(), z.unknown()).default({}),\n})\n\nconst responseSchema = z.object({\n  ok: z.literal(true),\n  token: z.string(),\n  redirect: z.string(),\n})\n\nexport const metadata = {\n  POST: { requireAuth: true },\n}\n\nexport async function POST(req: Request) {\n  const context = await resolveMfaRequestContext(req)\n  if (context instanceof NextResponse) return context\n\n  if (context.auth.mfa_pending !== true) {\n    return securityApiError(403, 'MFA pending token is required.')\n  }\n\n  const body = await readJsonRecord(req)\n  const challengeId = readString(body.challengeId)\n  const methodType = readString(body.methodType)\n  const payload = body.payload && typeof body.payload === 'object' ? body.payload : {}\n  if (!challengeId || !methodType) {\n    return securityApiError(400, 'challengeId and methodType are required.')\n  }\n\n  try {\n    const verified = await context.mfaVerificationService.verifyChallenge(challengeId, methodType, payload, { request: req })\n    if (!verified) {\n      return securityApiError(401, 'Invalid MFA verification code.')\n    }\n\n    const methods = await context.mfaService.getUserMethods(context.auth.sub)\n    const token = issueVerifiedMfaToken(context.auth, methods.map((method) => method.type))\n    const response = NextResponse.json({ ok: true, token, redirect: '/backend' })\n    setAuthCookie(response, token)\n    return response\n  } catch (error) {\n    return await mapMfaError(error)\n  }\n}\n\nexport const openApi = buildSecurityOpenApi({\n  summary: 'MFA challenge verify routes',\n  methods: {\n    POST: {\n      summary: 'Verify MFA challenge during login flow',\n      requestBody: {\n        contentType: 'application/json',\n        schema: requestSchema,\n      },\n      responses: [{ status: 200, description: 'MFA challenge verified', schema: responseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid payload', schema: securityErrorSchema },\n        { status: 401, description: 'Invalid challenge response', schema: securityErrorSchema },\n        { status: 403, description: 'Pending MFA context required', schema: securityErrorSchema },\n      ],\n    },\n  },\n})\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,sBAAsB,2BAA2B;AAC1D,SAAS,wBAAwB;AACjC,SAAS,uBAAuB,aAAa,gBAAgB,YAAY,0BAA0B,qBAAqB;AAExH,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC5B,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,OAAO,EAAE,OAAO;AAAA,EAChB,UAAU,EAAE,OAAO;AACrB,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,KAAK;AAC5B;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,UAAU,MAAM,yBAAyB,GAAG;AAClD,MAAI,mBAAmB,aAAc,QAAO;AAE5C,MAAI,QAAQ,KAAK,gBAAgB,MAAM;AACrC,WAAO,iBAAiB,KAAK,gCAAgC;AAAA,EAC/D;AAEA,QAAM,OAAO,MAAM,eAAe,GAAG;AACrC,QAAM,cAAc,WAAW,KAAK,WAAW;AAC/C,QAAM,aAAa,WAAW,KAAK,UAAU;AAC7C,QAAM,UAAU,KAAK,WAAW,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU,CAAC;AACnF,MAAI,CAAC,eAAe,CAAC,YAAY;AAC/B,WAAO,iBAAiB,KAAK,0CAA0C;AAAA,EACzE;AAEA,MAAI;AACF,UAAM,WAAW,MAAM,QAAQ,uBAAuB,gBAAgB,aAAa,YAAY,SAAS,EAAE,SAAS,IAAI,CAAC;AACxH,QAAI,CAAC,UAAU;AACb,aAAO,iBAAiB,KAAK,gCAAgC;AAAA,IAC/D;AAEA,UAAM,UAAU,MAAM,QAAQ,WAAW,eAAe,QAAQ,KAAK,GAAG;AACxE,UAAM,QAAQ,sBAAsB,QAAQ,MAAM,QAAQ,IAAI,CAAC,WAAW,OAAO,IAAI,CAAC;AACtF,UAAM,WAAW,aAAa,KAAK,EAAE,IAAI,MAAM,OAAO,UAAU,WAAW,CAAC;AAC5E,kBAAc,UAAU,KAAK;AAC7B,WAAO;AAAA,EACT,SAAS,OAAO;AACd,WAAO,MAAM,YAAY,KAAK;AAAA,EAChC;AACF;AAEO,MAAM,UAAU,qBAAqB;AAAA,EAC1C,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,eAAe,CAAC;AAAA,MAC1F,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,oBAAoB;AAAA,QAC3E,EAAE,QAAQ,KAAK,aAAa,8BAA8B,QAAQ,oBAAoB;AAAA,QACtF,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,oBAAoB;AAAA,MAC1F;AAAA,IACF;AAAA,EACF;AACF,CAAC;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { buildSecurityOpenApi, securityErrorSchema } from '../../openapi'\nimport { securityApiError } from '../../i18n'\nimport { issueVerifiedMfaToken, mapMfaError, readJsonRecord, readString, resolveMfaRequestContext, setAuthCookie } from '../_shared'\n\nconst requestSchema = z.object({\n  challengeId: z.string().min(1),\n  methodType: z.string().min(1),\n  payload: z.record(z.string(), z.unknown()).default({}),\n})\n\nconst responseSchema = z.object({\n  ok: z.literal(true),\n  token: z.string(),\n  redirect: z.string(),\n})\n\nexport const metadata = {\n  POST: { requireAuth: true, rateLimit: { points: 10, duration: 60, keyPrefix: 'security_mfa_verify' } },\n}\n\nexport async function POST(req: Request) {\n  const context = await resolveMfaRequestContext(req)\n  if (context instanceof NextResponse) return context\n\n  if (context.auth.mfa_pending !== true) {\n    return securityApiError(403, 'MFA pending token is required.')\n  }\n\n  const body = await readJsonRecord(req)\n  const challengeId = readString(body.challengeId)\n  const methodType = readString(body.methodType)\n  const payload = body.payload && typeof body.payload === 'object' ? body.payload : {}\n  if (!challengeId || !methodType) {\n    return securityApiError(400, 'challengeId and methodType are required.')\n  }\n\n  try {\n    const verified = await context.mfaVerificationService.verifyChallenge(challengeId, methodType, payload, { request: req })\n    if (!verified) {\n      return securityApiError(401, 'Invalid MFA verification code.')\n    }\n\n    const methods = await context.mfaService.getUserMethods(context.auth.sub)\n    const token = issueVerifiedMfaToken(context.auth, methods.map((method) => method.type))\n    const response = NextResponse.json({ ok: true, token, redirect: '/backend' })\n    setAuthCookie(response, token)\n    return response\n  } catch (error) {\n    return await mapMfaError(error)\n  }\n}\n\nexport const openApi = buildSecurityOpenApi({\n  summary: 'MFA challenge verify routes',\n  methods: {\n    POST: {\n      summary: 'Verify MFA challenge during login flow',\n      requestBody: {\n        contentType: 'application/json',\n        schema: requestSchema,\n      },\n      responses: [{ status: 200, description: 'MFA challenge verified', schema: responseSchema }],\n      errors: [\n        { status: 400, description: 'Invalid payload', schema: securityErrorSchema },\n        { status: 401, description: 'Invalid challenge response', schema: securityErrorSchema },\n        { status: 403, description: 'Pending MFA context required', schema: securityErrorSchema },\n      ],\n    },\n  },\n})\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,sBAAsB,2BAA2B;AAC1D,SAAS,wBAAwB;AACjC,SAAS,uBAAuB,aAAa,gBAAgB,YAAY,0BAA0B,qBAAqB;AAExH,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC5B,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,OAAO,EAAE,OAAO;AAAA,EAChB,UAAU,EAAE,OAAO;AACrB,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,WAAW,EAAE,QAAQ,IAAI,UAAU,IAAI,WAAW,sBAAsB,EAAE;AACvG;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,UAAU,MAAM,yBAAyB,GAAG;AAClD,MAAI,mBAAmB,aAAc,QAAO;AAE5C,MAAI,QAAQ,KAAK,gBAAgB,MAAM;AACrC,WAAO,iBAAiB,KAAK,gCAAgC;AAAA,EAC/D;AAEA,QAAM,OAAO,MAAM,eAAe,GAAG;AACrC,QAAM,cAAc,WAAW,KAAK,WAAW;AAC/C,QAAM,aAAa,WAAW,KAAK,UAAU;AAC7C,QAAM,UAAU,KAAK,WAAW,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU,CAAC;AACnF,MAAI,CAAC,eAAe,CAAC,YAAY;AAC/B,WAAO,iBAAiB,KAAK,0CAA0C;AAAA,EACzE;AAEA,MAAI;AACF,UAAM,WAAW,MAAM,QAAQ,uBAAuB,gBAAgB,aAAa,YAAY,SAAS,EAAE,SAAS,IAAI,CAAC;AACxH,QAAI,CAAC,UAAU;AACb,aAAO,iBAAiB,KAAK,gCAAgC;AAAA,IAC/D;AAEA,UAAM,UAAU,MAAM,QAAQ,WAAW,eAAe,QAAQ,KAAK,GAAG;AACxE,UAAM,QAAQ,sBAAsB,QAAQ,MAAM,QAAQ,IAAI,CAAC,WAAW,OAAO,IAAI,CAAC;AACtF,UAAM,WAAW,aAAa,KAAK,EAAE,IAAI,MAAM,OAAO,UAAU,WAAW,CAAC;AAC5E,kBAAc,UAAU,KAAK;AAC7B,WAAO;AAAA,EACT,SAAS,OAAO;AACd,WAAO,MAAM,YAAY,KAAK;AAAA,EAChC;AACF;AAEO,MAAM,UAAU,qBAAqB;AAAA,EAC1C,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,eAAe,CAAC;AAAA,MAC1F,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,oBAAoB;AAAA,QAC3E,EAAE,QAAQ,KAAK,aAAa,8BAA8B,QAAQ,oBAAoB;AAAA,QACtF,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,oBAAoB;AAAA,MAC1F;AAAA,IACF;AAAA,EACF;AACF,CAAC;",
   "names": []
 }

package/dist/modules/security/api/users/[id]/mfa/reset/route.js

@@ -2,7 +2,11 @@ import { NextResponse } from "next/server";
 import { z } from "zod";
 import { buildSecurityOpenApi, securityErrorSchema } from "../../../../openapi.js";
 import { securityApiError } from "../../../../i18n.js";
-import { mapSecurityUsersError, resolveSecurityUsersContext } from "../../../_shared.js";
+import {
+  assertActorCanAccessSecurityUserTarget,
+  mapSecurityUsersError,
+  resolveSecurityUsersContext
+} from "../../../_shared.js";
 import { requireSudo } from "../../../../../lib/sudo-middleware.js";
 const paramsSchema = z.object({
   id: z.string().uuid()
@@ -34,6 +38,7 @@ async function POST(req, routeContext) {
     return securityApiError(400, "Invalid payload", { issues: parsedBody.error.issues });
   }
   try {
+    await assertActorCanAccessSecurityUserTarget(context, parsedParams.data.id);
     await requireSudo(req, "security.admin.mfa.reset");
     const commandBus = context.container.resolve("commandBus");
     const { result } = await commandBus.execute("security.admin.mfa.reset", {

package/dist/modules/security/api/users/[id]/mfa/reset/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../../src/modules/security/api/users/%5Bid%5D/mfa/reset/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport { buildSecurityOpenApi, securityErrorSchema } from '../../../../openapi'\nimport { securityApiError } from '../../../../i18n'\nimport { mapSecurityUsersError, resolveSecurityUsersContext } from '../../../_shared'\nimport { requireSudo } from '../../../../../lib/sudo-middleware'\n\nconst paramsSchema = z.object({\n  id: z.string().uuid(),\n})\n\nconst bodySchema = z.object({\n  reason: z.string().min(1),\n})\n\nconst okResponseSchema = z.object({\n  ok: z.literal(true),\n})\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['security.admin.manage'] },\n}\n\nexport async function POST(req: Request, routeContext: { params: Promise<{ id: string }> }) {\n  const context = await resolveSecurityUsersContext(req)\n  if (context instanceof NextResponse) return context\n\n  const parsedParams = paramsSchema.safeParse(await routeContext.params)\n  if (!parsedParams.success) {\n    return securityApiError(400, 'Invalid user id.', { issues: parsedParams.error.issues })\n  }\n\n  let rawBody: unknown\n  try {\n    rawBody = await req.json()\n  } catch {\n    rawBody = {}\n  }\n\n  const parsedBody = bodySchema.safeParse(rawBody)\n  if (!parsedBody.success) {\n    return securityApiError(400, 'Invalid payload', { issues: parsedBody.error.issues })\n  }\n\n  try {\n    await requireSudo(req, 'security.admin.mfa.reset')\n    const commandBus = context.container.resolve<CommandBus>('commandBus')\n    const { result } = await commandBus.execute('security.admin.mfa.reset', {\n      input: {\n        userId: parsedParams.data.id,\n        reason: parsedBody.data.reason,\n      },\n      ctx: context.commandContext,\n    })\n    return NextResponse.json(result)\n  } catch (error) {\n    return await mapSecurityUsersError(error)\n  }\n}\n\nexport const openApi = buildSecurityOpenApi({\n  summary: 'Admin user MFA reset routes',\n  methods: {\n    POST: {\n      summary: 'Reset MFA for user',\n      pathParams: paramsSchema,\n      requestBody: {\n        contentType: 'application/json',\n        schema: bodySchema,\n      },\n      responses: [\n        { status: 200, description: 'MFA reset completed', schema: okResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid input', schema: securityErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: securityErrorSchema },\n        { status: 403, description: 'Sudo required', schema: securityErrorSchema },\n        { status: 404, description: 'User not found', schema: securityErrorSchema },\n      ],\n    },\n  },\n})\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,sBAAsB,2BAA2B;AAC1D,SAAS,wBAAwB;AACjC,SAAS,uBAAuB,mCAAmC;AACnE,SAAS,mBAAmB;AAE5B,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,IAAI,EAAE,OAAO,EAAE,KAAK;AACtB,CAAC;AAED,MAAM,aAAa,EAAE,OAAO;AAAA,EAC1B,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC;AAC1B,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,IAAI,EAAE,QAAQ,IAAI;AACpB,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AACxE;AAEA,eAAsB,KAAK,KAAc,cAAmD;AAC1F,QAAM,UAAU,MAAM,4BAA4B,GAAG;AACrD,MAAI,mBAAmB,aAAc,QAAO;AAE5C,QAAM,eAAe,aAAa,UAAU,MAAM,aAAa,MAAM;AACrE,MAAI,CAAC,aAAa,SAAS;AACzB,WAAO,iBAAiB,KAAK,oBAAoB,EAAE,QAAQ,aAAa,MAAM,OAAO,CAAC;AAAA,EACxF;AAEA,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,IAAI,KAAK;AAAA,EAC3B,QAAQ;AACN,cAAU,CAAC;AAAA,EACb;AAEA,QAAM,aAAa,WAAW,UAAU,OAAO;AAC/C,MAAI,CAAC,WAAW,SAAS;AACvB,WAAO,iBAAiB,KAAK,mBAAmB,EAAE,QAAQ,WAAW,MAAM,OAAO,CAAC;AAAA,EACrF;AAEA,MAAI;AACF,UAAM,YAAY,KAAK,0BAA0B;AACjD,UAAM,aAAa,QAAQ,UAAU,QAAoB,YAAY;AACrE,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW,QAAQ,4BAA4B;AAAA,MACtE,OAAO;AAAA,QACL,QAAQ,aAAa,KAAK;AAAA,QAC1B,QAAQ,WAAW,KAAK;AAAA,MAC1B;AAAA,MACA,KAAK,QAAQ;AAAA,IACf,CAAC;AACD,WAAO,aAAa,KAAK,MAAM;AAAA,EACjC,SAAS,OAAO;AACd,WAAO,MAAM,sBAAsB,KAAK;AAAA,EAC1C;AACF;AAEO,MAAM,UAAU,qBAAqB;AAAA,EAC1C,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,YAAY;AAAA,MACZ,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,iBAAiB;AAAA,MAC9E;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,oBAAoB;AAAA,MAC5E;AAAA,IACF;AAAA,EACF;AACF,CAAC;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport { buildSecurityOpenApi, securityErrorSchema } from '../../../../openapi'\nimport { securityApiError } from '../../../../i18n'\nimport {\n  assertActorCanAccessSecurityUserTarget,\n  mapSecurityUsersError,\n  resolveSecurityUsersContext,\n} from '../../../_shared'\nimport { requireSudo } from '../../../../../lib/sudo-middleware'\n\nconst paramsSchema = z.object({\n  id: z.string().uuid(),\n})\n\nconst bodySchema = z.object({\n  reason: z.string().min(1),\n})\n\nconst okResponseSchema = z.object({\n  ok: z.literal(true),\n})\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['security.admin.manage'] },\n}\n\nexport async function POST(req: Request, routeContext: { params: Promise<{ id: string }> }) {\n  const context = await resolveSecurityUsersContext(req)\n  if (context instanceof NextResponse) return context\n\n  const parsedParams = paramsSchema.safeParse(await routeContext.params)\n  if (!parsedParams.success) {\n    return securityApiError(400, 'Invalid user id.', { issues: parsedParams.error.issues })\n  }\n\n  let rawBody: unknown\n  try {\n    rawBody = await req.json()\n  } catch {\n    rawBody = {}\n  }\n\n  const parsedBody = bodySchema.safeParse(rawBody)\n  if (!parsedBody.success) {\n    return securityApiError(400, 'Invalid payload', { issues: parsedBody.error.issues })\n  }\n\n  try {\n    await assertActorCanAccessSecurityUserTarget(context, parsedParams.data.id)\n    await requireSudo(req, 'security.admin.mfa.reset')\n    const commandBus = context.container.resolve<CommandBus>('commandBus')\n    const { result } = await commandBus.execute('security.admin.mfa.reset', {\n      input: {\n        userId: parsedParams.data.id,\n        reason: parsedBody.data.reason,\n      },\n      ctx: context.commandContext,\n    })\n    return NextResponse.json(result)\n  } catch (error) {\n    return await mapSecurityUsersError(error)\n  }\n}\n\nexport const openApi = buildSecurityOpenApi({\n  summary: 'Admin user MFA reset routes',\n  methods: {\n    POST: {\n      summary: 'Reset MFA for user',\n      pathParams: paramsSchema,\n      requestBody: {\n        contentType: 'application/json',\n        schema: bodySchema,\n      },\n      responses: [\n        { status: 200, description: 'MFA reset completed', schema: okResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid input', schema: securityErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: securityErrorSchema },\n        { status: 403, description: 'Sudo required', schema: securityErrorSchema },\n        { status: 404, description: 'User not found', schema: securityErrorSchema },\n      ],\n    },\n  },\n})\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,sBAAsB,2BAA2B;AAC1D,SAAS,wBAAwB;AACjC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,mBAAmB;AAE5B,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,IAAI,EAAE,OAAO,EAAE,KAAK;AACtB,CAAC;AAED,MAAM,aAAa,EAAE,OAAO;AAAA,EAC1B,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC;AAC1B,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,IAAI,EAAE,QAAQ,IAAI;AACpB,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AACxE;AAEA,eAAsB,KAAK,KAAc,cAAmD;AAC1F,QAAM,UAAU,MAAM,4BAA4B,GAAG;AACrD,MAAI,mBAAmB,aAAc,QAAO;AAE5C,QAAM,eAAe,aAAa,UAAU,MAAM,aAAa,MAAM;AACrE,MAAI,CAAC,aAAa,SAAS;AACzB,WAAO,iBAAiB,KAAK,oBAAoB,EAAE,QAAQ,aAAa,MAAM,OAAO,CAAC;AAAA,EACxF;AAEA,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,IAAI,KAAK;AAAA,EAC3B,QAAQ;AACN,cAAU,CAAC;AAAA,EACb;AAEA,QAAM,aAAa,WAAW,UAAU,OAAO;AAC/C,MAAI,CAAC,WAAW,SAAS;AACvB,WAAO,iBAAiB,KAAK,mBAAmB,EAAE,QAAQ,WAAW,MAAM,OAAO,CAAC;AAAA,EACrF;AAEA,MAAI;AACF,UAAM,uCAAuC,SAAS,aAAa,KAAK,EAAE;AAC1E,UAAM,YAAY,KAAK,0BAA0B;AACjD,UAAM,aAAa,QAAQ,UAAU,QAAoB,YAAY;AACrE,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW,QAAQ,4BAA4B;AAAA,MACtE,OAAO;AAAA,QACL,QAAQ,aAAa,KAAK;AAAA,QAC1B,QAAQ,WAAW,KAAK;AAAA,MAC1B;AAAA,MACA,KAAK,QAAQ;AAAA,IACf,CAAC;AACD,WAAO,aAAa,KAAK,MAAM;AAAA,EACjC,SAAS,OAAO;AACd,WAAO,MAAM,sBAAsB,KAAK;AAAA,EAC1C;AACF;AAEO,MAAM,UAAU,qBAAqB;AAAA,EAC1C,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,YAAY;AAAA,MACZ,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,iBAAiB;AAAA,MAC9E;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,oBAAoB;AAAA,MAC5E;AAAA,IACF;AAAA,EACF;AACF,CAAC;",
   "names": []
 }

package/dist/modules/security/api/users/[id]/mfa/status/route.js

@@ -2,7 +2,12 @@ import { NextResponse } from "next/server";
 import { z } from "zod";
 import { buildSecurityOpenApi, securityErrorSchema } from "../../../../openapi.js";
 import { securityApiError } from "../../../../i18n.js";
-import { mapSecurityUsersError, resolveSecurityUsersContext } from "../../../_shared.js";
+import { resolveIsSuperAdmin } from "@open-mercato/core/modules/auth/lib/tenantAccess";
+import {
+  assertActorCanAccessSecurityUserTarget,
+  mapSecurityUsersError,
+  resolveSecurityUsersContext
+} from "../../../_shared.js";
 const paramsSchema = z.object({
   id: z.string().uuid()
 });
@@ -28,7 +33,12 @@ async function GET(req, routeContext) {
     return securityApiError(400, "Invalid user id.", { issues: parsedParams.error.issues });
   }
   try {
-    const status = await context.mfaAdminService.getUserMfaStatus(parsedParams.data.id);
+    await assertActorCanAccessSecurityUserTarget(context, parsedParams.data.id);
+    const isSuperAdmin = await resolveIsSuperAdmin({ auth: context.auth, container: context.container });
+    const status = await context.mfaAdminService.getUserMfaStatus(parsedParams.data.id, {
+      tenantId: context.auth.tenantId ?? null,
+      isSuperAdmin
+    });
     return NextResponse.json({
       ...status,
       methods: status.methods.map((method) => ({
@@ -52,6 +62,7 @@ const openApi = buildSecurityOpenApi({
       errors: [
         { status: 400, description: "Invalid user id", schema: securityErrorSchema },
         { status: 401, description: "Unauthorized", schema: securityErrorSchema },
+        { status: 403, description: "Not authorized to access this user", schema: securityErrorSchema },
         { status: 404, description: "User not found", schema: securityErrorSchema }
       ]
     }

package/dist/modules/security/api/users/[id]/mfa/status/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../../src/modules/security/api/users/%5Bid%5D/mfa/status/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { buildSecurityOpenApi, securityErrorSchema } from '../../../../openapi'\nimport { securityApiError } from '../../../../i18n'\nimport { mapSecurityUsersError, resolveSecurityUsersContext } from '../../../_shared'\n\nconst paramsSchema = z.object({\n  id: z.string().uuid(),\n})\n\nconst methodSchema = z.object({\n  type: z.string(),\n  label: z.string().optional(),\n  lastUsed: z.string().datetime().optional(),\n})\n\nconst statusResponseSchema = z.object({\n  enrolled: z.boolean(),\n  methods: z.array(methodSchema),\n  recoveryCodesRemaining: z.number().int().nonnegative(),\n  compliant: z.boolean(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['security.admin.manage'] },\n}\n\nexport async function GET(req: Request, routeContext: { params: Promise<{ id: string }> }) {\n  const context = await resolveSecurityUsersContext(req)\n  if (context instanceof NextResponse) return context\n\n  const parsedParams = paramsSchema.safeParse(await routeContext.params)\n  if (!parsedParams.success) {\n    return securityApiError(400, 'Invalid user id.', { issues: parsedParams.error.issues })\n  }\n\n  try {\n    const status = await context.mfaAdminService.getUserMfaStatus(parsedParams.data.id)\n    return NextResponse.json({\n      ...status,\n      methods: status.methods.map((method) => ({\n        ...method,\n        ...(method.lastUsed ? { lastUsed: method.lastUsed.toISOString() } : {}),\n      })),\n    })\n  } catch (error) {\n    return await mapSecurityUsersError(error)\n  }\n}\n\nexport const openApi = buildSecurityOpenApi({\n  summary: 'Admin user MFA status routes',\n  methods: {\n    GET: {\n      summary: 'Get MFA status for user',\n      pathParams: paramsSchema,\n      responses: [\n        { status: 200, description: 'MFA status', schema: statusResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid user id', schema: securityErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: securityErrorSchema },\n        { status: 404, description: 'User not found', schema: securityErrorSchema },\n      ],\n    },\n  },\n})\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,sBAAsB,2BAA2B;AAC1D,SAAS,wBAAwB;AACjC,SAAS,uBAAuB,mCAAmC;AAEnE,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,IAAI,EAAE,OAAO,EAAE,KAAK;AACtB,CAAC;AAED,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,MAAM,EAAE,OAAO;AAAA,EACf,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAC3C,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,UAAU,EAAE,QAAQ;AAAA,EACpB,SAAS,EAAE,MAAM,YAAY;AAAA,EAC7B,wBAAwB,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACrD,WAAW,EAAE,QAAQ;AACvB,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AACvE;AAEA,eAAsB,IAAI,KAAc,cAAmD;AACzF,QAAM,UAAU,MAAM,4BAA4B,GAAG;AACrD,MAAI,mBAAmB,aAAc,QAAO;AAE5C,QAAM,eAAe,aAAa,UAAU,MAAM,aAAa,MAAM;AACrE,MAAI,CAAC,aAAa,SAAS;AACzB,WAAO,iBAAiB,KAAK,oBAAoB,EAAE,QAAQ,aAAa,MAAM,OAAO,CAAC;AAAA,EACxF;AAEA,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ,gBAAgB,iBAAiB,aAAa,KAAK,EAAE;AAClF,WAAO,aAAa,KAAK;AAAA,MACvB,GAAG;AAAA,MACH,SAAS,OAAO,QAAQ,IAAI,CAAC,YAAY;AAAA,QACvC,GAAG;AAAA,QACH,GAAI,OAAO,WAAW,EAAE,UAAU,OAAO,SAAS,YAAY,EAAE,IAAI,CAAC;AAAA,MACvE,EAAE;AAAA,IACJ,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,sBAAsB,KAAK;AAAA,EAC1C;AACF;AAEO,MAAM,UAAU,qBAAqB;AAAA,EAC1C,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,YAAY;AAAA,MACZ,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,cAAc,QAAQ,qBAAqB;AAAA,MACzE;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,oBAAoB;AAAA,QAC3E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,oBAAoB;AAAA,MAC5E;AAAA,IACF;AAAA,EACF;AACF,CAAC;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { buildSecurityOpenApi, securityErrorSchema } from '../../../../openapi'\nimport { securityApiError } from '../../../../i18n'\nimport { resolveIsSuperAdmin } from '@open-mercato/core/modules/auth/lib/tenantAccess'\nimport {\n  assertActorCanAccessSecurityUserTarget,\n  mapSecurityUsersError,\n  resolveSecurityUsersContext,\n} from '../../../_shared'\n\nconst paramsSchema = z.object({\n  id: z.string().uuid(),\n})\n\nconst methodSchema = z.object({\n  type: z.string(),\n  label: z.string().optional(),\n  lastUsed: z.string().datetime().optional(),\n})\n\nconst statusResponseSchema = z.object({\n  enrolled: z.boolean(),\n  methods: z.array(methodSchema),\n  recoveryCodesRemaining: z.number().int().nonnegative(),\n  compliant: z.boolean(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['security.admin.manage'] },\n}\n\nexport async function GET(req: Request, routeContext: { params: Promise<{ id: string }> }) {\n  const context = await resolveSecurityUsersContext(req)\n  if (context instanceof NextResponse) return context\n\n  const parsedParams = paramsSchema.safeParse(await routeContext.params)\n  if (!parsedParams.success) {\n    return securityApiError(400, 'Invalid user id.', { issues: parsedParams.error.issues })\n  }\n\n  try {\n    await assertActorCanAccessSecurityUserTarget(context, parsedParams.data.id)\n    const isSuperAdmin = await resolveIsSuperAdmin({ auth: context.auth, container: context.container })\n    const status = await context.mfaAdminService.getUserMfaStatus(parsedParams.data.id, {\n      tenantId: context.auth.tenantId ?? null,\n      isSuperAdmin,\n    })\n    return NextResponse.json({\n      ...status,\n      methods: status.methods.map((method) => ({\n        ...method,\n        ...(method.lastUsed ? { lastUsed: method.lastUsed.toISOString() } : {}),\n      })),\n    })\n  } catch (error) {\n    return await mapSecurityUsersError(error)\n  }\n}\n\nexport const openApi = buildSecurityOpenApi({\n  summary: 'Admin user MFA status routes',\n  methods: {\n    GET: {\n      summary: 'Get MFA status for user',\n      pathParams: paramsSchema,\n      responses: [\n        { status: 200, description: 'MFA status', schema: statusResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid user id', schema: securityErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: securityErrorSchema },\n        { status: 403, description: 'Not authorized to access this user', schema: securityErrorSchema },\n        { status: 404, description: 'User not found', schema: securityErrorSchema },\n      ],\n    },\n  },\n})\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,sBAAsB,2BAA2B;AAC1D,SAAS,wBAAwB;AACjC,SAAS,2BAA2B;AACpC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,IAAI,EAAE,OAAO,EAAE,KAAK;AACtB,CAAC;AAED,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,MAAM,EAAE,OAAO;AAAA,EACf,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAC3C,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,UAAU,EAAE,QAAQ;AAAA,EACpB,SAAS,EAAE,MAAM,YAAY;AAAA,EAC7B,wBAAwB,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACrD,WAAW,EAAE,QAAQ;AACvB,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AACvE;AAEA,eAAsB,IAAI,KAAc,cAAmD;AACzF,QAAM,UAAU,MAAM,4BAA4B,GAAG;AACrD,MAAI,mBAAmB,aAAc,QAAO;AAE5C,QAAM,eAAe,aAAa,UAAU,MAAM,aAAa,MAAM;AACrE,MAAI,CAAC,aAAa,SAAS;AACzB,WAAO,iBAAiB,KAAK,oBAAoB,EAAE,QAAQ,aAAa,MAAM,OAAO,CAAC;AAAA,EACxF;AAEA,MAAI;AACF,UAAM,uCAAuC,SAAS,aAAa,KAAK,EAAE;AAC1E,UAAM,eAAe,MAAM,oBAAoB,EAAE,MAAM,QAAQ,MAAM,WAAW,QAAQ,UAAU,CAAC;AACnG,UAAM,SAAS,MAAM,QAAQ,gBAAgB,iBAAiB,aAAa,KAAK,IAAI;AAAA,MAClF,UAAU,QAAQ,KAAK,YAAY;AAAA,MACnC;AAAA,IACF,CAAC;AACD,WAAO,aAAa,KAAK;AAAA,MACvB,GAAG;AAAA,MACH,SAAS,OAAO,QAAQ,IAAI,CAAC,YAAY;AAAA,QACvC,GAAG;AAAA,QACH,GAAI,OAAO,WAAW,EAAE,UAAU,OAAO,SAAS,YAAY,EAAE,IAAI,CAAC;AAAA,MACvE,EAAE;AAAA,IACJ,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,sBAAsB,KAAK;AAAA,EAC1C;AACF;AAEO,MAAM,UAAU,qBAAqB;AAAA,EAC1C,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,YAAY;AAAA,MACZ,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,cAAc,QAAQ,qBAAqB;AAAA,MACzE;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,oBAAoB;AAAA,QAC3E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,oBAAoB;AAAA,QAC9F,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,oBAAoB;AAAA,MAC5E;AAAA,IACF;AAAA,EACF;AACF,CAAC;",
   "names": []
 }