@open-mercato/enterprise 0.6.5-develop.4863.1.169bfbb3a3 → 0.6.5-develop.4964.1.ae0edca575

package/dist/modules/security/services/MfaEnforcementService.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/security/services/MfaEnforcementService.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { User } from '@open-mercato/core/modules/auth/data/entities'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  EnforcementScope,\n  MfaEnforcementPolicy,\n  UserMfaMethod,\n} from '../data/entities'\nimport type {\n  EnforcementPolicyInput,\n  UpdateEnforcementPolicyInput,\n} from '../data/validators'\nimport { emitSecurityEvent } from '../events'\n\ntype EnforcementResult = {\n  enforced: boolean\n  policy?: MfaEnforcementPolicy\n}\n\ntype ComplianceReport = {\n  total: number\n  enrolled: number\n  pending: number\n  overdue: number\n}\n\ntype EnforcementPolicyListFilters = {\n  scope?: EnforcementScope\n}\n\ntype UserCompliance = {\n  compliant: boolean\n  deadline?: Date\n  enforced: boolean\n}\n\nexport function isEnforcementDeadlineOverdue(\n  deadline?: Date | null,\n  now = Date.now(),\n): boolean {\n  if (!(deadline instanceof Date)) return false\n  const deadlineTime = deadline.getTime()\n  if (Number.isNaN(deadlineTime)) return false\n  return deadlineTime <= now\n}\n\nexport class MfaEnforcementServiceError extends Error {\n  constructor(\n    message: string,\n    public readonly statusCode: number,\n  ) {\n    super(message)\n    this.name = 'MfaEnforcementServiceError'\n  }\n}\n\nexport class MfaEnforcementService {\n  constructor(private readonly em: EntityManager) {}\n\n  async isEnforced(tenantId: string, orgId?: string): Promise<EnforcementResult> {\n    const policy = await this.resolveEffectivePolicy(tenantId, orgId)\n    if (!policy || !policy.isEnforced) {\n      return { enforced: false, policy: policy ?? undefined }\n    }\n    return { enforced: true, policy }\n  }\n\n  async listPolicies(filters?: EnforcementPolicyListFilters): Promise<MfaEnforcementPolicy[]> {\n    return this.em.find(\n      MfaEnforcementPolicy,\n      {\n        deletedAt: null,\n        ...(filters?.scope ? { scope: filters.scope } : {}),\n      },\n      {\n        orderBy: { updatedAt: 'desc' },\n      },\n    )\n  }\n\n  async getComplianceReport(\n    scope: EnforcementScope,\n    scopeId?: string,\n  ): Promise<ComplianceReport> {\n    const { tenantId, organizationId } = this.resolveScopeFilters(scope, scopeId)\n    const users = await this.em.find(User, {\n      deletedAt: null,\n      ...(tenantId ? { tenantId } : {}),\n      ...(organizationId ? { organizationId } : {}),\n    })\n\n    const total = users.length\n    if (total === 0) {\n      return { total: 0, enrolled: 0, pending: 0, overdue: 0 }\n    }\n\n    const userIds = users.map((user) => user.id)\n    const policy = await this.findPolicyByScope(scope, tenantId, organizationId)\n    const methodFilter = this.buildAllowedMethodsFilter(policy?.allowedMethods ?? null)\n    const methods = await this.em.find(UserMfaMethod, {\n      userId: { $in: userIds },\n      isActive: true,\n      deletedAt: null,\n      ...methodFilter,\n    })\n\n    const enrolledUserIds = new Set(methods.map((method) => method.userId))\n    const enrolled = enrolledUserIds.size\n    const unenrolled = Math.max(0, total - enrolled)\n\n    const now = Date.now()\n    const overdue = isEnforcementDeadlineOverdue(policy?.enforcementDeadline, now) ? unenrolled : 0\n    const pending = Math.max(0, unenrolled - overdue)\n\n    return {\n      total,\n      enrolled,\n      pending,\n      overdue,\n    }\n  }\n\n  async createPolicy(\n    data: EnforcementPolicyInput,\n    adminId: string,\n  ): Promise<MfaEnforcementPolicy> {\n    const normalized = this.normalizePolicyInput(data)\n    const existing = await this.findPolicyByScope(\n      normalized.scope,\n      normalized.tenantId ?? undefined,\n      normalized.organizationId ?? undefined,\n    )\n\n    if (existing) {\n      existing.isEnforced = normalized.isEnforced\n      existing.allowedMethods = normalized.allowedMethods\n      existing.enforcementDeadline = normalized.enforcementDeadline\n      existing.enforcedBy = adminId\n      existing.updatedAt = new Date()\n      await this.em.flush()\n\n      await emitSecurityEvent('security.enforcement.updated', {\n        adminId,\n        policyId: existing.id,\n        scope: existing.scope,\n      })\n      await this.emitDeadlineReminderRequest(existing.id)\n      return existing\n    }\n\n    const now = new Date()\n    const policy = this.em.create(MfaEnforcementPolicy, {\n      scope: normalized.scope,\n      tenantId: normalized.tenantId,\n      organizationId: normalized.organizationId,\n      isEnforced: normalized.isEnforced,\n      allowedMethods: normalized.allowedMethods,\n      enforcementDeadline: normalized.enforcementDeadline,\n      enforcedBy: adminId,\n      createdAt: now,\n      updatedAt: now,\n    })\n    this.em.persist(policy)\n    await this.em.flush()\n\n    await emitSecurityEvent('security.enforcement.created', {\n      adminId,\n      policyId: policy.id,\n      scope: policy.scope,\n    })\n    await this.emitDeadlineReminderRequest(policy.id)\n    return policy\n  }\n\n  async updatePolicy(\n    id: string,\n    data: UpdateEnforcementPolicyInput,\n    adminId: string,\n  ): Promise<MfaEnforcementPolicy> {\n    const policy = await this.em.findOne(MfaEnforcementPolicy, {\n      id,\n      deletedAt: null,\n    })\n    if (!policy) {\n      throw new MfaEnforcementServiceError('Enforcement policy not found', 404)\n    }\n\n    const mergedInput = this.normalizePolicyInput({\n      scope: data.scope ?? policy.scope,\n      tenantId: data.tenantId ?? policy.tenantId ?? undefined,\n      organizationId: data.organizationId ?? policy.organizationId ?? undefined,\n      isEnforced: data.isEnforced ?? policy.isEnforced,\n      allowedMethods: data.allowedMethods ?? policy.allowedMethods ?? null,\n      enforcementDeadline:\n        data.enforcementDeadline === undefined\n          ? (policy.enforcementDeadline ?? null)\n          : data.enforcementDeadline,\n    })\n\n    if (\n      mergedInput.scope !== policy.scope ||\n      mergedInput.tenantId !== (policy.tenantId ?? null) ||\n      mergedInput.organizationId !== (policy.organizationId ?? null)\n    ) {\n      const conflict = await this.findPolicyByScope(\n        mergedInput.scope,\n        mergedInput.tenantId ?? undefined,\n        mergedInput.organizationId ?? undefined,\n      )\n      if (conflict && conflict.id !== policy.id) {\n        throw new MfaEnforcementServiceError('Enforcement policy already exists for this scope', 409)\n      }\n    }\n\n    policy.scope = mergedInput.scope\n    policy.tenantId = mergedInput.tenantId\n    policy.organizationId = mergedInput.organizationId\n    policy.isEnforced = mergedInput.isEnforced\n    policy.allowedMethods = mergedInput.allowedMethods\n    policy.enforcementDeadline = mergedInput.enforcementDeadline\n    policy.enforcedBy = adminId\n    policy.updatedAt = new Date()\n    await this.em.flush()\n\n    await emitSecurityEvent('security.enforcement.updated', {\n      adminId,\n      policyId: policy.id,\n      scope: policy.scope,\n    })\n    await this.emitDeadlineReminderRequest(policy.id)\n    return policy\n  }\n\n  async deletePolicy(id: string): Promise<void> {\n    const policy = await this.em.findOne(MfaEnforcementPolicy, {\n      id,\n      deletedAt: null,\n    })\n    if (!policy) {\n      throw new MfaEnforcementServiceError('Enforcement policy not found', 404)\n    }\n\n    const now = new Date()\n    policy.deletedAt = now\n    policy.updatedAt = now\n    await this.em.flush()\n  }\n\n  async checkUserCompliance(userId: string): Promise<UserCompliance> {\n    const policy = await this.getEffectivePolicyForUser(userId)\n    if (!policy || !policy.isEnforced) {\n      return { compliant: true, enforced: false }\n    }\n\n    const methodFilter = this.buildAllowedMethodsFilter(policy.allowedMethods ?? null)\n    const methodCount = await this.em.count(UserMfaMethod, {\n      userId,\n      isActive: true,\n      deletedAt: null,\n      ...methodFilter,\n    })\n\n    return {\n      compliant: methodCount > 0,\n      enforced: true,\n      deadline: policy.enforcementDeadline ?? undefined,\n    }\n  }\n\n  async getEffectivePolicyForUser(userId: string): Promise<MfaEnforcementPolicy | null> {\n    const user = await this.findUserById(userId)\n    if (!user?.tenantId) {\n      throw new MfaEnforcementServiceError('User not found', 404)\n    }\n\n    return this.resolveEffectivePolicy(user.tenantId, user.organizationId ?? undefined)\n  }\n\n  private async resolveEffectivePolicy(\n    tenantId: string,\n    orgId?: string,\n  ): Promise<MfaEnforcementPolicy | null> {\n    if (orgId) {\n      const organizationPolicy = await this.findPolicyByScope(\n        EnforcementScope.ORGANISATION,\n        tenantId,\n        orgId,\n      )\n      if (organizationPolicy) return organizationPolicy\n    }\n\n    const tenantPolicy = await this.findPolicyByScope(EnforcementScope.TENANT, tenantId, undefined)\n    if (tenantPolicy) return tenantPolicy\n\n    return this.findPolicyByScope(EnforcementScope.PLATFORM, undefined, undefined)\n  }\n\n  private async findPolicyByScope(\n    scope: EnforcementScope,\n    tenantId?: string,\n    organizationId?: string,\n  ): Promise<MfaEnforcementPolicy | null> {\n    return this.em.findOne(\n      MfaEnforcementPolicy,\n      {\n        scope,\n        tenantId: tenantId ?? null,\n        organizationId: organizationId ?? null,\n        deletedAt: null,\n      },\n      {\n        orderBy: { updatedAt: 'desc' },\n      },\n    )\n  }\n\n  private resolveScopeFilters(\n    scope: EnforcementScope,\n    scopeId?: string,\n  ): { tenantId?: string; organizationId?: string } {\n    if (scope === EnforcementScope.PLATFORM) {\n      return {}\n    }\n\n    if (!scopeId) {\n      throw new MfaEnforcementServiceError('scopeId is required for tenant and organisation scopes', 400)\n    }\n\n    if (scope === EnforcementScope.TENANT) {\n      return { tenantId: scopeId }\n    }\n\n    const [tenantId, organizationId] = scopeId.split(':')\n    if (!tenantId || !organizationId) {\n      throw new MfaEnforcementServiceError(\n        \"organisation scopeId must use '<tenantId>:<organizationId>' format\",\n        400,\n      )\n    }\n\n    return { tenantId, organizationId }\n  }\n\n  private normalizePolicyInput(data: {\n    scope: EnforcementScope\n    tenantId?: string | null\n    organizationId?: string | null\n    isEnforced?: boolean\n    allowedMethods?: string[] | null\n    enforcementDeadline?: Date | null\n  }): {\n    scope: EnforcementScope\n    tenantId: string | null\n    organizationId: string | null\n    isEnforced: boolean\n    allowedMethods: string[] | null\n    enforcementDeadline: Date | null\n  } {\n    const isEnforced = data.isEnforced ?? true\n    const allowedMethods = this.normalizeAllowedMethods(data.allowedMethods)\n    const enforcementDeadline = data.enforcementDeadline ?? null\n\n    if (data.scope === EnforcementScope.PLATFORM) {\n      return {\n        scope: data.scope,\n        tenantId: null,\n        organizationId: null,\n        isEnforced,\n        allowedMethods,\n        enforcementDeadline,\n      }\n    }\n\n    if (data.scope === EnforcementScope.TENANT) {\n      if (!data.tenantId) {\n        throw new MfaEnforcementServiceError('tenantId is required for tenant scope', 400)\n      }\n      return {\n        scope: data.scope,\n        tenantId: data.tenantId,\n        organizationId: null,\n        isEnforced,\n        allowedMethods,\n        enforcementDeadline,\n      }\n    }\n\n    if (!data.tenantId || !data.organizationId) {\n      throw new MfaEnforcementServiceError(\n        'tenantId and organizationId are required for organisation scope',\n        400,\n      )\n    }\n\n    return {\n      scope: data.scope,\n      tenantId: data.tenantId,\n      organizationId: data.organizationId,\n      isEnforced,\n      allowedMethods,\n      enforcementDeadline,\n    }\n  }\n\n  private normalizeAllowedMethods(allowedMethods?: string[] | null): string[] | null {\n    if (!allowedMethods || allowedMethods.length === 0) {\n      return null\n    }\n    return Array.from(new Set(allowedMethods.map((method) => method.trim()).filter(Boolean)))\n  }\n\n  private buildAllowedMethodsFilter(\n    allowedMethods?: string[] | null,\n  ): { type?: { $in: string[] } } {\n    if (!allowedMethods || allowedMethods.length === 0) {\n      return {}\n    }\n    return { type: { $in: allowedMethods } }\n  }\n\n  private async findUserById(userId: string): Promise<User | null> {\n    return findOneWithDecryption(this.em, User, { id: userId, deletedAt: null }, undefined, {})\n  }\n\n  private async emitDeadlineReminderRequest(policyId: string): Promise<void> {\n    await emitSecurityEvent('security.enforcement.deadline_reminder_requested', {\n      policyId,\n    })\n  }\n}\n\nexport default MfaEnforcementService\n"],
-  "mappings": "AACA,SAAS,YAAY;AACrB,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAKP,SAAS,yBAAyB;AAwB3B,SAAS,6BACd,UACA,MAAM,KAAK,IAAI,GACN;AACT,MAAI,EAAE,oBAAoB,MAAO,QAAO;AACxC,QAAM,eAAe,SAAS,QAAQ;AACtC,MAAI,OAAO,MAAM,YAAY,EAAG,QAAO;AACvC,SAAO,gBAAgB;AACzB;AAEO,MAAM,mCAAmC,MAAM;AAAA,EACpD,YACE,SACgB,YAChB;AACA,UAAM,OAAO;AAFG;AAGhB,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,sBAAsB;AAAA,EACjC,YAA6B,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAEjD,MAAM,WAAW,UAAkB,OAA4C;AAC7E,UAAM,SAAS,MAAM,KAAK,uBAAuB,UAAU,KAAK;AAChE,QAAI,CAAC,UAAU,CAAC,OAAO,YAAY;AACjC,aAAO,EAAE,UAAU,OAAO,QAAQ,UAAU,OAAU;AAAA,IACxD;AACA,WAAO,EAAE,UAAU,MAAM,OAAO;AAAA,EAClC;AAAA,EAEA,MAAM,aAAa,SAAyE;AAC1F,WAAO,KAAK,GAAG;AAAA,MACb;AAAA,MACA;AAAA,QACE,WAAW;AAAA,QACX,GAAI,SAAS,QAAQ,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,MACnD;AAAA,MACA;AAAA,QACE,SAAS,EAAE,WAAW,OAAO;AAAA,MAC/B;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,oBACJ,OACA,SAC2B;AAC3B,UAAM,EAAE,UAAU,eAAe,IAAI,KAAK,oBAAoB,OAAO,OAAO;AAC5E,UAAM,QAAQ,MAAM,KAAK,GAAG,KAAK,MAAM;AAAA,MACrC,WAAW;AAAA,MACX,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,MAC/B,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;AAAA,IAC7C,CAAC;AAED,UAAM,QAAQ,MAAM;AACpB,QAAI,UAAU,GAAG;AACf,aAAO,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,EAAE;AAAA,IACzD;AAEA,UAAM,UAAU,MAAM,IAAI,CAAC,SAAS,KAAK,EAAE;AAC3C,UAAM,SAAS,MAAM,KAAK,kBAAkB,OAAO,UAAU,cAAc;AAC3E,UAAM,eAAe,KAAK,0BAA0B,QAAQ,kBAAkB,IAAI;AAClF,UAAM,UAAU,MAAM,KAAK,GAAG,KAAK,eAAe;AAAA,MAChD,QAAQ,EAAE,KAAK,QAAQ;AAAA,MACvB,UAAU;AAAA,MACV,WAAW;AAAA,MACX,GAAG;AAAA,IACL,CAAC;AAED,UAAM,kBAAkB,IAAI,IAAI,QAAQ,IAAI,CAAC,WAAW,OAAO,MAAM,CAAC;AACtE,UAAM,WAAW,gBAAgB;AACjC,UAAM,aAAa,KAAK,IAAI,GAAG,QAAQ,QAAQ;AAE/C,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,UAAU,6BAA6B,QAAQ,qBAAqB,GAAG,IAAI,aAAa;AAC9F,UAAM,UAAU,KAAK,IAAI,GAAG,aAAa,OAAO;AAEhD,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,aACJ,MACA,SAC+B;AAC/B,UAAM,aAAa,KAAK,qBAAqB,IAAI;AACjD,UAAM,WAAW,MAAM,KAAK;AAAA,MAC1B,WAAW;AAAA,MACX,WAAW,YAAY;AAAA,MACvB,WAAW,kBAAkB;AAAA,IAC/B;AAEA,QAAI,UAAU;AACZ,eAAS,aAAa,WAAW;AACjC,eAAS,iBAAiB,WAAW;AACrC,eAAS,sBAAsB,WAAW;AAC1C,eAAS,aAAa;AACtB,eAAS,YAAY,oBAAI,KAAK;AAC9B,YAAM,KAAK,GAAG,MAAM;AAEpB,YAAM,kBAAkB,gCAAgC;AAAA,QACtD;AAAA,QACA,UAAU,SAAS;AAAA,QACnB,OAAO,SAAS;AAAA,MAClB,CAAC;AACD,YAAM,KAAK,4BAA4B,SAAS,EAAE;AAClD,aAAO;AAAA,IACT;AAEA,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,SAAS,KAAK,GAAG,OAAO,sBAAsB;AAAA,MAClD,OAAO,WAAW;AAAA,MAClB,UAAU,WAAW;AAAA,MACrB,gBAAgB,WAAW;AAAA,MAC3B,YAAY,WAAW;AAAA,MACvB,gBAAgB,WAAW;AAAA,MAC3B,qBAAqB,WAAW;AAAA,MAChC,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,WAAW;AAAA,IACb,CAAC;AACD,SAAK,GAAG,QAAQ,MAAM;AACtB,UAAM,KAAK,GAAG,MAAM;AAEpB,UAAM,kBAAkB,gCAAgC;AAAA,MACtD;AAAA,MACA,UAAU,OAAO;AAAA,MACjB,OAAO,OAAO;AAAA,IAChB,CAAC;AACD,UAAM,KAAK,4BAA4B,OAAO,EAAE;AAChD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,aACJ,IACA,MACA,SAC+B;AAC/B,UAAM,SAAS,MAAM,KAAK,GAAG,QAAQ,sBAAsB;AAAA,MACzD;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,2BAA2B,gCAAgC,GAAG;AAAA,IAC1E;AAEA,UAAM,cAAc,KAAK,qBAAqB;AAAA,MAC5C,OAAO,KAAK,SAAS,OAAO;AAAA,MAC5B,UAAU,KAAK,YAAY,OAAO,YAAY;AAAA,MAC9C,gBAAgB,KAAK,kBAAkB,OAAO,kBAAkB;AAAA,MAChE,YAAY,KAAK,cAAc,OAAO;AAAA,MACtC,gBAAgB,KAAK,kBAAkB,OAAO,kBAAkB;AAAA,MAChE,qBACE,KAAK,wBAAwB,SACxB,OAAO,uBAAuB,OAC/B,KAAK;AAAA,IACb,CAAC;AAED,QACE,YAAY,UAAU,OAAO,SAC7B,YAAY,cAAc,OAAO,YAAY,SAC7C,YAAY,oBAAoB,OAAO,kBAAkB,OACzD;AACA,YAAM,WAAW,MAAM,KAAK;AAAA,QAC1B,YAAY;AAAA,QACZ,YAAY,YAAY;AAAA,QACxB,YAAY,kBAAkB;AAAA,MAChC;AACA,UAAI,YAAY,SAAS,OAAO,OAAO,IAAI;AACzC,cAAM,IAAI,2BAA2B,oDAAoD,GAAG;AAAA,MAC9F;AAAA,IACF;AAEA,WAAO,QAAQ,YAAY;AAC3B,WAAO,WAAW,YAAY;AAC9B,WAAO,iBAAiB,YAAY;AACpC,WAAO,aAAa,YAAY;AAChC,WAAO,iBAAiB,YAAY;AACpC,WAAO,sBAAsB,YAAY;AACzC,WAAO,aAAa;AACpB,WAAO,YAAY,oBAAI,KAAK;AAC5B,UAAM,KAAK,GAAG,MAAM;AAEpB,UAAM,kBAAkB,gCAAgC;AAAA,MACtD;AAAA,MACA,UAAU,OAAO;AAAA,MACjB,OAAO,OAAO;AAAA,IAChB,CAAC;AACD,UAAM,KAAK,4BAA4B,OAAO,EAAE;AAChD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,aAAa,IAA2B;AAC5C,UAAM,SAAS,MAAM,KAAK,GAAG,QAAQ,sBAAsB;AAAA,MACzD;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,2BAA2B,gCAAgC,GAAG;AAAA,IAC1E;AAEA,UAAM,MAAM,oBAAI,KAAK;AACrB,WAAO,YAAY;AACnB,WAAO,YAAY;AACnB,UAAM,KAAK,GAAG,MAAM;AAAA,EACtB;AAAA,EAEA,MAAM,oBAAoB,QAAyC;AACjE,UAAM,SAAS,MAAM,KAAK,0BAA0B,MAAM;AAC1D,QAAI,CAAC,UAAU,CAAC,OAAO,YAAY;AACjC,aAAO,EAAE,WAAW,MAAM,UAAU,MAAM;AAAA,IAC5C;AAEA,UAAM,eAAe,KAAK,0BAA0B,OAAO,kBAAkB,IAAI;AACjF,UAAM,cAAc,MAAM,KAAK,GAAG,MAAM,eAAe;AAAA,MACrD;AAAA,MACA,UAAU;AAAA,MACV,WAAW;AAAA,MACX,GAAG;AAAA,IACL,CAAC;AAED,WAAO;AAAA,MACL,WAAW,cAAc;AAAA,MACzB,UAAU;AAAA,MACV,UAAU,OAAO,uBAAuB;AAAA,IAC1C;AAAA,EACF;AAAA,EAEA,MAAM,0BAA0B,QAAsD;AACpF,UAAM,OAAO,MAAM,KAAK,aAAa,MAAM;AAC3C,QAAI,CAAC,MAAM,UAAU;AACnB,YAAM,IAAI,2BAA2B,kBAAkB,GAAG;AAAA,IAC5D;AAEA,WAAO,KAAK,uBAAuB,KAAK,UAAU,KAAK,kBAAkB,MAAS;AAAA,EACpF;AAAA,EAEA,MAAc,uBACZ,UACA,OACsC;AACtC,QAAI,OAAO;AACT,YAAM,qBAAqB,MAAM,KAAK;AAAA,QACpC,iBAAiB;AAAA,QACjB;AAAA,QACA;AAAA,MACF;AACA,UAAI,mBAAoB,QAAO;AAAA,IACjC;AAEA,UAAM,eAAe,MAAM,KAAK,kBAAkB,iBAAiB,QAAQ,UAAU,MAAS;AAC9F,QAAI,aAAc,QAAO;AAEzB,WAAO,KAAK,kBAAkB,iBAAiB,UAAU,QAAW,MAAS;AAAA,EAC/E;AAAA,EAEA,MAAc,kBACZ,OACA,UACA,gBACsC;AACtC,WAAO,KAAK,GAAG;AAAA,MACb;AAAA,MACA;AAAA,QACE;AAAA,QACA,UAAU,YAAY;AAAA,QACtB,gBAAgB,kBAAkB;AAAA,QAClC,WAAW;AAAA,MACb;AAAA,MACA;AAAA,QACE,SAAS,EAAE,WAAW,OAAO;AAAA,MAC/B;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,oBACN,OACA,SACgD;AAChD,QAAI,UAAU,iBAAiB,UAAU;AACvC,aAAO,CAAC;AAAA,IACV;AAEA,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,2BAA2B,0DAA0D,GAAG;AAAA,IACpG;AAEA,QAAI,UAAU,iBAAiB,QAAQ;AACrC,aAAO,EAAE,UAAU,QAAQ;AAAA,IAC7B;AAEA,UAAM,CAAC,UAAU,cAAc,IAAI,QAAQ,MAAM,GAAG;AACpD,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,WAAO,EAAE,UAAU,eAAe;AAAA,EACpC;AAAA,EAEQ,qBAAqB,MAc3B;AACA,UAAM,aAAa,KAAK,cAAc;AACtC,UAAM,iBAAiB,KAAK,wBAAwB,KAAK,cAAc;AACvE,UAAM,sBAAsB,KAAK,uBAAuB;AAExD,QAAI,KAAK,UAAU,iBAAiB,UAAU;AAC5C,aAAO;AAAA,QACL,OAAO,KAAK;AAAA,QACZ,UAAU;AAAA,QACV,gBAAgB;AAAA,QAChB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,QAAI,KAAK,UAAU,iBAAiB,QAAQ;AAC1C,UAAI,CAAC,KAAK,UAAU;AAClB,cAAM,IAAI,2BAA2B,yCAAyC,GAAG;AAAA,MACnF;AACA,aAAO;AAAA,QACL,OAAO,KAAK;AAAA,QACZ,UAAU,KAAK;AAAA,QACf,gBAAgB;AAAA,QAChB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,KAAK,YAAY,CAAC,KAAK,gBAAgB;AAC1C,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,MACL,OAAO,KAAK;AAAA,MACZ,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,wBAAwB,gBAAmD;AACjF,QAAI,CAAC,kBAAkB,eAAe,WAAW,GAAG;AAClD,aAAO;AAAA,IACT;AACA,WAAO,MAAM,KAAK,IAAI,IAAI,eAAe,IAAI,CAAC,WAAW,OAAO,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC,CAAC;AAAA,EAC1F;AAAA,EAEQ,0BACN,gBAC8B;AAC9B,QAAI,CAAC,kBAAkB,eAAe,WAAW,GAAG;AAClD,aAAO,CAAC;AAAA,IACV;AACA,WAAO,EAAE,MAAM,EAAE,KAAK,eAAe,EAAE;AAAA,EACzC;AAAA,EAEA,MAAc,aAAa,QAAsC;AAC/D,WAAO,sBAAsB,KAAK,IAAI,MAAM,EAAE,IAAI,QAAQ,WAAW,KAAK,GAAG,QAAW,CAAC,CAAC;AAAA,EAC5F;AAAA,EAEA,MAAc,4BAA4B,UAAiC;AACzE,UAAM,kBAAkB,oDAAoD;AAAA,MAC1E;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAEA,IAAO,gCAAQ;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { User } from '@open-mercato/core/modules/auth/data/entities'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  EnforcementScope,\n  MfaEnforcementPolicy,\n  UserMfaMethod,\n} from '../data/entities'\nimport type {\n  EnforcementPolicyInput,\n  UpdateEnforcementPolicyInput,\n} from '../data/validators'\nimport { emitSecurityEvent } from '../events'\n\ntype EnforcementResult = {\n  enforced: boolean\n  policy?: MfaEnforcementPolicy\n}\n\ntype ComplianceReport = {\n  total: number\n  enrolled: number\n  pending: number\n  overdue: number\n}\n\ntype EnforcementPolicyListFilters = {\n  scope?: EnforcementScope\n}\n\nexport type EnforcementActorContext = {\n  tenantId: string | null\n  isSuperAdmin: boolean\n}\n\ntype UserCompliance = {\n  compliant: boolean\n  deadline?: Date\n  enforced: boolean\n}\n\nexport function isEnforcementDeadlineOverdue(\n  deadline?: Date | null,\n  now = Date.now(),\n): boolean {\n  if (!(deadline instanceof Date)) return false\n  const deadlineTime = deadline.getTime()\n  if (Number.isNaN(deadlineTime)) return false\n  return deadlineTime <= now\n}\n\nexport class MfaEnforcementServiceError extends Error {\n  constructor(\n    message: string,\n    public readonly statusCode: number,\n  ) {\n    super(message)\n    this.name = 'MfaEnforcementServiceError'\n  }\n}\n\nexport class MfaEnforcementService {\n  constructor(private readonly em: EntityManager) {}\n\n  async isEnforced(tenantId: string, orgId?: string): Promise<EnforcementResult> {\n    const policy = await this.resolveEffectivePolicy(tenantId, orgId)\n    if (!policy || !policy.isEnforced) {\n      return { enforced: false, policy: policy ?? undefined }\n    }\n    return { enforced: true, policy }\n  }\n\n  async getPolicyById(id: string): Promise<MfaEnforcementPolicy | null> {\n    return this.em.findOne(MfaEnforcementPolicy, { id, deletedAt: null })\n  }\n\n  async listPolicies(\n    filters?: EnforcementPolicyListFilters,\n    actor?: EnforcementActorContext,\n  ): Promise<MfaEnforcementPolicy[]> {\n    const tenantConstraint = actor && !actor.isSuperAdmin ? { tenantId: actor.tenantId } : {}\n    return this.em.find(\n      MfaEnforcementPolicy,\n      {\n        deletedAt: null,\n        ...(filters?.scope ? { scope: filters.scope } : {}),\n        ...tenantConstraint,\n      },\n      {\n        orderBy: { updatedAt: 'desc' },\n      },\n    )\n  }\n\n  async getComplianceReport(\n    scope: EnforcementScope,\n    scopeId?: string,\n    actor?: EnforcementActorContext,\n  ): Promise<ComplianceReport> {\n    const { tenantId, organizationId } = this.resolveScopeFilters(scope, scopeId)\n    this.assertActorOwnsScopeFilters(actor, scope, tenantId)\n    const users = await this.em.find(User, {\n      deletedAt: null,\n      ...(tenantId ? { tenantId } : {}),\n      ...(organizationId ? { organizationId } : {}),\n    })\n\n    const total = users.length\n    if (total === 0) {\n      return { total: 0, enrolled: 0, pending: 0, overdue: 0 }\n    }\n\n    const userIds = users.map((user) => user.id)\n    const policy = await this.findPolicyByScope(scope, tenantId, organizationId)\n    const methodFilter = this.buildAllowedMethodsFilter(policy?.allowedMethods ?? null)\n    const methods = await this.em.find(UserMfaMethod, {\n      userId: { $in: userIds },\n      isActive: true,\n      deletedAt: null,\n      ...methodFilter,\n    })\n\n    const enrolledUserIds = new Set(methods.map((method) => method.userId))\n    const enrolled = enrolledUserIds.size\n    const unenrolled = Math.max(0, total - enrolled)\n\n    const now = Date.now()\n    const overdue = isEnforcementDeadlineOverdue(policy?.enforcementDeadline, now) ? unenrolled : 0\n    const pending = Math.max(0, unenrolled - overdue)\n\n    return {\n      total,\n      enrolled,\n      pending,\n      overdue,\n    }\n  }\n\n  async createPolicy(\n    data: EnforcementPolicyInput,\n    adminId: string,\n    actor?: EnforcementActorContext,\n  ): Promise<MfaEnforcementPolicy> {\n    const normalized = this.normalizePolicyInput(data)\n    this.assertActorOwnsScopeFilters(actor, normalized.scope, normalized.tenantId)\n    const existing = await this.findPolicyByScope(\n      normalized.scope,\n      normalized.tenantId ?? undefined,\n      normalized.organizationId ?? undefined,\n    )\n\n    if (existing) {\n      existing.isEnforced = normalized.isEnforced\n      existing.allowedMethods = normalized.allowedMethods\n      existing.enforcementDeadline = normalized.enforcementDeadline\n      existing.enforcedBy = adminId\n      existing.updatedAt = new Date()\n      await this.em.flush()\n\n      await emitSecurityEvent('security.enforcement.updated', {\n        adminId,\n        policyId: existing.id,\n        scope: existing.scope,\n      })\n      await this.emitDeadlineReminderRequest(existing.id)\n      return existing\n    }\n\n    const now = new Date()\n    const policy = this.em.create(MfaEnforcementPolicy, {\n      scope: normalized.scope,\n      tenantId: normalized.tenantId,\n      organizationId: normalized.organizationId,\n      isEnforced: normalized.isEnforced,\n      allowedMethods: normalized.allowedMethods,\n      enforcementDeadline: normalized.enforcementDeadline,\n      enforcedBy: adminId,\n      createdAt: now,\n      updatedAt: now,\n    })\n    this.em.persist(policy)\n    await this.em.flush()\n\n    await emitSecurityEvent('security.enforcement.created', {\n      adminId,\n      policyId: policy.id,\n      scope: policy.scope,\n    })\n    await this.emitDeadlineReminderRequest(policy.id)\n    return policy\n  }\n\n  async updatePolicy(\n    id: string,\n    data: UpdateEnforcementPolicyInput,\n    adminId: string,\n    actor?: EnforcementActorContext,\n  ): Promise<MfaEnforcementPolicy> {\n    const policy = await this.em.findOne(MfaEnforcementPolicy, {\n      id,\n      deletedAt: null,\n    })\n    if (!policy) {\n      throw new MfaEnforcementServiceError('Enforcement policy not found', 404)\n    }\n    this.assertActorOwnsScopeFilters(actor, policy.scope, policy.tenantId ?? null)\n\n    const mergedInput = this.normalizePolicyInput({\n      scope: data.scope ?? policy.scope,\n      tenantId: data.tenantId ?? policy.tenantId ?? undefined,\n      organizationId: data.organizationId ?? policy.organizationId ?? undefined,\n      isEnforced: data.isEnforced ?? policy.isEnforced,\n      allowedMethods: data.allowedMethods ?? policy.allowedMethods ?? null,\n      enforcementDeadline:\n        data.enforcementDeadline === undefined\n          ? (policy.enforcementDeadline ?? null)\n          : data.enforcementDeadline,\n    })\n\n    this.assertActorOwnsScopeFilters(actor, mergedInput.scope, mergedInput.tenantId)\n\n    if (\n      mergedInput.scope !== policy.scope ||\n      mergedInput.tenantId !== (policy.tenantId ?? null) ||\n      mergedInput.organizationId !== (policy.organizationId ?? null)\n    ) {\n      const conflict = await this.findPolicyByScope(\n        mergedInput.scope,\n        mergedInput.tenantId ?? undefined,\n        mergedInput.organizationId ?? undefined,\n      )\n      if (conflict && conflict.id !== policy.id) {\n        throw new MfaEnforcementServiceError('Enforcement policy already exists for this scope', 409)\n      }\n    }\n\n    policy.scope = mergedInput.scope\n    policy.tenantId = mergedInput.tenantId\n    policy.organizationId = mergedInput.organizationId\n    policy.isEnforced = mergedInput.isEnforced\n    policy.allowedMethods = mergedInput.allowedMethods\n    policy.enforcementDeadline = mergedInput.enforcementDeadline\n    policy.enforcedBy = adminId\n    policy.updatedAt = new Date()\n    await this.em.flush()\n\n    await emitSecurityEvent('security.enforcement.updated', {\n      adminId,\n      policyId: policy.id,\n      scope: policy.scope,\n    })\n    await this.emitDeadlineReminderRequest(policy.id)\n    return policy\n  }\n\n  async deletePolicy(id: string, actor?: EnforcementActorContext): Promise<void> {\n    const policy = await this.em.findOne(MfaEnforcementPolicy, {\n      id,\n      deletedAt: null,\n    })\n    if (!policy) {\n      throw new MfaEnforcementServiceError('Enforcement policy not found', 404)\n    }\n    this.assertActorOwnsScopeFilters(actor, policy.scope, policy.tenantId ?? null)\n\n    const now = new Date()\n    policy.deletedAt = now\n    policy.updatedAt = now\n    await this.em.flush()\n  }\n\n  async checkUserCompliance(userId: string): Promise<UserCompliance> {\n    const policy = await this.getEffectivePolicyForUser(userId)\n    if (!policy || !policy.isEnforced) {\n      return { compliant: true, enforced: false }\n    }\n\n    const methodFilter = this.buildAllowedMethodsFilter(policy.allowedMethods ?? null)\n    const methodCount = await this.em.count(UserMfaMethod, {\n      userId,\n      isActive: true,\n      deletedAt: null,\n      ...methodFilter,\n    })\n\n    return {\n      compliant: methodCount > 0,\n      enforced: true,\n      deadline: policy.enforcementDeadline ?? undefined,\n    }\n  }\n\n  async getEffectivePolicyForUser(userId: string): Promise<MfaEnforcementPolicy | null> {\n    const user = await this.findUserById(userId)\n    if (!user?.tenantId) {\n      throw new MfaEnforcementServiceError('User not found', 404)\n    }\n\n    return this.resolveEffectivePolicy(user.tenantId, user.organizationId ?? undefined)\n  }\n\n  private async resolveEffectivePolicy(\n    tenantId: string,\n    orgId?: string,\n  ): Promise<MfaEnforcementPolicy | null> {\n    if (orgId) {\n      const organizationPolicy = await this.findPolicyByScope(\n        EnforcementScope.ORGANISATION,\n        tenantId,\n        orgId,\n      )\n      if (organizationPolicy) return organizationPolicy\n    }\n\n    const tenantPolicy = await this.findPolicyByScope(EnforcementScope.TENANT, tenantId, undefined)\n    if (tenantPolicy) return tenantPolicy\n\n    return this.findPolicyByScope(EnforcementScope.PLATFORM, undefined, undefined)\n  }\n\n  private async findPolicyByScope(\n    scope: EnforcementScope,\n    tenantId?: string,\n    organizationId?: string,\n  ): Promise<MfaEnforcementPolicy | null> {\n    return this.em.findOne(\n      MfaEnforcementPolicy,\n      {\n        scope,\n        tenantId: tenantId ?? null,\n        organizationId: organizationId ?? null,\n        deletedAt: null,\n      },\n      {\n        orderBy: { updatedAt: 'desc' },\n      },\n    )\n  }\n\n  private assertActorOwnsScopeFilters(\n    actor: EnforcementActorContext | undefined,\n    scope: EnforcementScope,\n    tenantId: string | null | undefined,\n  ): void {\n    if (!actor || actor.isSuperAdmin) return\n    if (scope === EnforcementScope.PLATFORM) {\n      throw new MfaEnforcementServiceError(\n        'Platform scope requires platform administrator privileges.',\n        403,\n      )\n    }\n    if (!tenantId || tenantId !== actor.tenantId) {\n      throw new MfaEnforcementServiceError('Not authorized for the requested scope.', 403)\n    }\n  }\n\n  private resolveScopeFilters(\n    scope: EnforcementScope,\n    scopeId?: string,\n  ): { tenantId?: string; organizationId?: string } {\n    if (scope === EnforcementScope.PLATFORM) {\n      return {}\n    }\n\n    if (!scopeId) {\n      throw new MfaEnforcementServiceError('scopeId is required for tenant and organisation scopes', 400)\n    }\n\n    if (scope === EnforcementScope.TENANT) {\n      return { tenantId: scopeId }\n    }\n\n    const [tenantId, organizationId] = scopeId.split(':')\n    if (!tenantId || !organizationId) {\n      throw new MfaEnforcementServiceError(\n        \"organisation scopeId must use '<tenantId>:<organizationId>' format\",\n        400,\n      )\n    }\n\n    return { tenantId, organizationId }\n  }\n\n  private normalizePolicyInput(data: {\n    scope: EnforcementScope\n    tenantId?: string | null\n    organizationId?: string | null\n    isEnforced?: boolean\n    allowedMethods?: string[] | null\n    enforcementDeadline?: Date | null\n  }): {\n    scope: EnforcementScope\n    tenantId: string | null\n    organizationId: string | null\n    isEnforced: boolean\n    allowedMethods: string[] | null\n    enforcementDeadline: Date | null\n  } {\n    const isEnforced = data.isEnforced ?? true\n    const allowedMethods = this.normalizeAllowedMethods(data.allowedMethods)\n    const enforcementDeadline = data.enforcementDeadline ?? null\n\n    if (data.scope === EnforcementScope.PLATFORM) {\n      return {\n        scope: data.scope,\n        tenantId: null,\n        organizationId: null,\n        isEnforced,\n        allowedMethods,\n        enforcementDeadline,\n      }\n    }\n\n    if (data.scope === EnforcementScope.TENANT) {\n      if (!data.tenantId) {\n        throw new MfaEnforcementServiceError('tenantId is required for tenant scope', 400)\n      }\n      return {\n        scope: data.scope,\n        tenantId: data.tenantId,\n        organizationId: null,\n        isEnforced,\n        allowedMethods,\n        enforcementDeadline,\n      }\n    }\n\n    if (!data.tenantId || !data.organizationId) {\n      throw new MfaEnforcementServiceError(\n        'tenantId and organizationId are required for organisation scope',\n        400,\n      )\n    }\n\n    return {\n      scope: data.scope,\n      tenantId: data.tenantId,\n      organizationId: data.organizationId,\n      isEnforced,\n      allowedMethods,\n      enforcementDeadline,\n    }\n  }\n\n  private normalizeAllowedMethods(allowedMethods?: string[] | null): string[] | null {\n    if (!allowedMethods || allowedMethods.length === 0) {\n      return null\n    }\n    return Array.from(new Set(allowedMethods.map((method) => method.trim()).filter(Boolean)))\n  }\n\n  private buildAllowedMethodsFilter(\n    allowedMethods?: string[] | null,\n  ): { type?: { $in: string[] } } {\n    if (!allowedMethods || allowedMethods.length === 0) {\n      return {}\n    }\n    return { type: { $in: allowedMethods } }\n  }\n\n  private async findUserById(userId: string): Promise<User | null> {\n    return findOneWithDecryption(this.em, User, { id: userId, deletedAt: null }, undefined, {})\n  }\n\n  private async emitDeadlineReminderRequest(policyId: string): Promise<void> {\n    await emitSecurityEvent('security.enforcement.deadline_reminder_requested', {\n      policyId,\n    })\n  }\n}\n\nexport default MfaEnforcementService\n"],
+  "mappings": "AACA,SAAS,YAAY;AACrB,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAKP,SAAS,yBAAyB;AA6B3B,SAAS,6BACd,UACA,MAAM,KAAK,IAAI,GACN;AACT,MAAI,EAAE,oBAAoB,MAAO,QAAO;AACxC,QAAM,eAAe,SAAS,QAAQ;AACtC,MAAI,OAAO,MAAM,YAAY,EAAG,QAAO;AACvC,SAAO,gBAAgB;AACzB;AAEO,MAAM,mCAAmC,MAAM;AAAA,EACpD,YACE,SACgB,YAChB;AACA,UAAM,OAAO;AAFG;AAGhB,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,sBAAsB;AAAA,EACjC,YAA6B,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAEjD,MAAM,WAAW,UAAkB,OAA4C;AAC7E,UAAM,SAAS,MAAM,KAAK,uBAAuB,UAAU,KAAK;AAChE,QAAI,CAAC,UAAU,CAAC,OAAO,YAAY;AACjC,aAAO,EAAE,UAAU,OAAO,QAAQ,UAAU,OAAU;AAAA,IACxD;AACA,WAAO,EAAE,UAAU,MAAM,OAAO;AAAA,EAClC;AAAA,EAEA,MAAM,cAAc,IAAkD;AACpE,WAAO,KAAK,GAAG,QAAQ,sBAAsB,EAAE,IAAI,WAAW,KAAK,CAAC;AAAA,EACtE;AAAA,EAEA,MAAM,aACJ,SACA,OACiC;AACjC,UAAM,mBAAmB,SAAS,CAAC,MAAM,eAAe,EAAE,UAAU,MAAM,SAAS,IAAI,CAAC;AACxF,WAAO,KAAK,GAAG;AAAA,MACb;AAAA,MACA;AAAA,QACE,WAAW;AAAA,QACX,GAAI,SAAS,QAAQ,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,QACjD,GAAG;AAAA,MACL;AAAA,MACA;AAAA,QACE,SAAS,EAAE,WAAW,OAAO;AAAA,MAC/B;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,oBACJ,OACA,SACA,OAC2B;AAC3B,UAAM,EAAE,UAAU,eAAe,IAAI,KAAK,oBAAoB,OAAO,OAAO;AAC5E,SAAK,4BAA4B,OAAO,OAAO,QAAQ;AACvD,UAAM,QAAQ,MAAM,KAAK,GAAG,KAAK,MAAM;AAAA,MACrC,WAAW;AAAA,MACX,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,MAC/B,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;AAAA,IAC7C,CAAC;AAED,UAAM,QAAQ,MAAM;AACpB,QAAI,UAAU,GAAG;AACf,aAAO,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,EAAE;AAAA,IACzD;AAEA,UAAM,UAAU,MAAM,IAAI,CAAC,SAAS,KAAK,EAAE;AAC3C,UAAM,SAAS,MAAM,KAAK,kBAAkB,OAAO,UAAU,cAAc;AAC3E,UAAM,eAAe,KAAK,0BAA0B,QAAQ,kBAAkB,IAAI;AAClF,UAAM,UAAU,MAAM,KAAK,GAAG,KAAK,eAAe;AAAA,MAChD,QAAQ,EAAE,KAAK,QAAQ;AAAA,MACvB,UAAU;AAAA,MACV,WAAW;AAAA,MACX,GAAG;AAAA,IACL,CAAC;AAED,UAAM,kBAAkB,IAAI,IAAI,QAAQ,IAAI,CAAC,WAAW,OAAO,MAAM,CAAC;AACtE,UAAM,WAAW,gBAAgB;AACjC,UAAM,aAAa,KAAK,IAAI,GAAG,QAAQ,QAAQ;AAE/C,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,UAAU,6BAA6B,QAAQ,qBAAqB,GAAG,IAAI,aAAa;AAC9F,UAAM,UAAU,KAAK,IAAI,GAAG,aAAa,OAAO;AAEhD,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,aACJ,MACA,SACA,OAC+B;AAC/B,UAAM,aAAa,KAAK,qBAAqB,IAAI;AACjD,SAAK,4BAA4B,OAAO,WAAW,OAAO,WAAW,QAAQ;AAC7E,UAAM,WAAW,MAAM,KAAK;AAAA,MAC1B,WAAW;AAAA,MACX,WAAW,YAAY;AAAA,MACvB,WAAW,kBAAkB;AAAA,IAC/B;AAEA,QAAI,UAAU;AACZ,eAAS,aAAa,WAAW;AACjC,eAAS,iBAAiB,WAAW;AACrC,eAAS,sBAAsB,WAAW;AAC1C,eAAS,aAAa;AACtB,eAAS,YAAY,oBAAI,KAAK;AAC9B,YAAM,KAAK,GAAG,MAAM;AAEpB,YAAM,kBAAkB,gCAAgC;AAAA,QACtD;AAAA,QACA,UAAU,SAAS;AAAA,QACnB,OAAO,SAAS;AAAA,MAClB,CAAC;AACD,YAAM,KAAK,4BAA4B,SAAS,EAAE;AAClD,aAAO;AAAA,IACT;AAEA,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,SAAS,KAAK,GAAG,OAAO,sBAAsB;AAAA,MAClD,OAAO,WAAW;AAAA,MAClB,UAAU,WAAW;AAAA,MACrB,gBAAgB,WAAW;AAAA,MAC3B,YAAY,WAAW;AAAA,MACvB,gBAAgB,WAAW;AAAA,MAC3B,qBAAqB,WAAW;AAAA,MAChC,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,WAAW;AAAA,IACb,CAAC;AACD,SAAK,GAAG,QAAQ,MAAM;AACtB,UAAM,KAAK,GAAG,MAAM;AAEpB,UAAM,kBAAkB,gCAAgC;AAAA,MACtD;AAAA,MACA,UAAU,OAAO;AAAA,MACjB,OAAO,OAAO;AAAA,IAChB,CAAC;AACD,UAAM,KAAK,4BAA4B,OAAO,EAAE;AAChD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,aACJ,IACA,MACA,SACA,OAC+B;AAC/B,UAAM,SAAS,MAAM,KAAK,GAAG,QAAQ,sBAAsB;AAAA,MACzD;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,2BAA2B,gCAAgC,GAAG;AAAA,IAC1E;AACA,SAAK,4BAA4B,OAAO,OAAO,OAAO,OAAO,YAAY,IAAI;AAE7E,UAAM,cAAc,KAAK,qBAAqB;AAAA,MAC5C,OAAO,KAAK,SAAS,OAAO;AAAA,MAC5B,UAAU,KAAK,YAAY,OAAO,YAAY;AAAA,MAC9C,gBAAgB,KAAK,kBAAkB,OAAO,kBAAkB;AAAA,MAChE,YAAY,KAAK,cAAc,OAAO;AAAA,MACtC,gBAAgB,KAAK,kBAAkB,OAAO,kBAAkB;AAAA,MAChE,qBACE,KAAK,wBAAwB,SACxB,OAAO,uBAAuB,OAC/B,KAAK;AAAA,IACb,CAAC;AAED,SAAK,4BAA4B,OAAO,YAAY,OAAO,YAAY,QAAQ;AAE/E,QACE,YAAY,UAAU,OAAO,SAC7B,YAAY,cAAc,OAAO,YAAY,SAC7C,YAAY,oBAAoB,OAAO,kBAAkB,OACzD;AACA,YAAM,WAAW,MAAM,KAAK;AAAA,QAC1B,YAAY;AAAA,QACZ,YAAY,YAAY;AAAA,QACxB,YAAY,kBAAkB;AAAA,MAChC;AACA,UAAI,YAAY,SAAS,OAAO,OAAO,IAAI;AACzC,cAAM,IAAI,2BAA2B,oDAAoD,GAAG;AAAA,MAC9F;AAAA,IACF;AAEA,WAAO,QAAQ,YAAY;AAC3B,WAAO,WAAW,YAAY;AAC9B,WAAO,iBAAiB,YAAY;AACpC,WAAO,aAAa,YAAY;AAChC,WAAO,iBAAiB,YAAY;AACpC,WAAO,sBAAsB,YAAY;AACzC,WAAO,aAAa;AACpB,WAAO,YAAY,oBAAI,KAAK;AAC5B,UAAM,KAAK,GAAG,MAAM;AAEpB,UAAM,kBAAkB,gCAAgC;AAAA,MACtD;AAAA,MACA,UAAU,OAAO;AAAA,MACjB,OAAO,OAAO;AAAA,IAChB,CAAC;AACD,UAAM,KAAK,4BAA4B,OAAO,EAAE;AAChD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,aAAa,IAAY,OAAgD;AAC7E,UAAM,SAAS,MAAM,KAAK,GAAG,QAAQ,sBAAsB;AAAA,MACzD;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,2BAA2B,gCAAgC,GAAG;AAAA,IAC1E;AACA,SAAK,4BAA4B,OAAO,OAAO,OAAO,OAAO,YAAY,IAAI;AAE7E,UAAM,MAAM,oBAAI,KAAK;AACrB,WAAO,YAAY;AACnB,WAAO,YAAY;AACnB,UAAM,KAAK,GAAG,MAAM;AAAA,EACtB;AAAA,EAEA,MAAM,oBAAoB,QAAyC;AACjE,UAAM,SAAS,MAAM,KAAK,0BAA0B,MAAM;AAC1D,QAAI,CAAC,UAAU,CAAC,OAAO,YAAY;AACjC,aAAO,EAAE,WAAW,MAAM,UAAU,MAAM;AAAA,IAC5C;AAEA,UAAM,eAAe,KAAK,0BAA0B,OAAO,kBAAkB,IAAI;AACjF,UAAM,cAAc,MAAM,KAAK,GAAG,MAAM,eAAe;AAAA,MACrD;AAAA,MACA,UAAU;AAAA,MACV,WAAW;AAAA,MACX,GAAG;AAAA,IACL,CAAC;AAED,WAAO;AAAA,MACL,WAAW,cAAc;AAAA,MACzB,UAAU;AAAA,MACV,UAAU,OAAO,uBAAuB;AAAA,IAC1C;AAAA,EACF;AAAA,EAEA,MAAM,0BAA0B,QAAsD;AACpF,UAAM,OAAO,MAAM,KAAK,aAAa,MAAM;AAC3C,QAAI,CAAC,MAAM,UAAU;AACnB,YAAM,IAAI,2BAA2B,kBAAkB,GAAG;AAAA,IAC5D;AAEA,WAAO,KAAK,uBAAuB,KAAK,UAAU,KAAK,kBAAkB,MAAS;AAAA,EACpF;AAAA,EAEA,MAAc,uBACZ,UACA,OACsC;AACtC,QAAI,OAAO;AACT,YAAM,qBAAqB,MAAM,KAAK;AAAA,QACpC,iBAAiB;AAAA,QACjB;AAAA,QACA;AAAA,MACF;AACA,UAAI,mBAAoB,QAAO;AAAA,IACjC;AAEA,UAAM,eAAe,MAAM,KAAK,kBAAkB,iBAAiB,QAAQ,UAAU,MAAS;AAC9F,QAAI,aAAc,QAAO;AAEzB,WAAO,KAAK,kBAAkB,iBAAiB,UAAU,QAAW,MAAS;AAAA,EAC/E;AAAA,EAEA,MAAc,kBACZ,OACA,UACA,gBACsC;AACtC,WAAO,KAAK,GAAG;AAAA,MACb;AAAA,MACA;AAAA,QACE;AAAA,QACA,UAAU,YAAY;AAAA,QACtB,gBAAgB,kBAAkB;AAAA,QAClC,WAAW;AAAA,MACb;AAAA,MACA;AAAA,QACE,SAAS,EAAE,WAAW,OAAO;AAAA,MAC/B;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,4BACN,OACA,OACA,UACM;AACN,QAAI,CAAC,SAAS,MAAM,aAAc;AAClC,QAAI,UAAU,iBAAiB,UAAU;AACvC,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,YAAY,aAAa,MAAM,UAAU;AAC5C,YAAM,IAAI,2BAA2B,2CAA2C,GAAG;AAAA,IACrF;AAAA,EACF;AAAA,EAEQ,oBACN,OACA,SACgD;AAChD,QAAI,UAAU,iBAAiB,UAAU;AACvC,aAAO,CAAC;AAAA,IACV;AAEA,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,2BAA2B,0DAA0D,GAAG;AAAA,IACpG;AAEA,QAAI,UAAU,iBAAiB,QAAQ;AACrC,aAAO,EAAE,UAAU,QAAQ;AAAA,IAC7B;AAEA,UAAM,CAAC,UAAU,cAAc,IAAI,QAAQ,MAAM,GAAG;AACpD,QAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,WAAO,EAAE,UAAU,eAAe;AAAA,EACpC;AAAA,EAEQ,qBAAqB,MAc3B;AACA,UAAM,aAAa,KAAK,cAAc;AACtC,UAAM,iBAAiB,KAAK,wBAAwB,KAAK,cAAc;AACvE,UAAM,sBAAsB,KAAK,uBAAuB;AAExD,QAAI,KAAK,UAAU,iBAAiB,UAAU;AAC5C,aAAO;AAAA,QACL,OAAO,KAAK;AAAA,QACZ,UAAU;AAAA,QACV,gBAAgB;AAAA,QAChB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,QAAI,KAAK,UAAU,iBAAiB,QAAQ;AAC1C,UAAI,CAAC,KAAK,UAAU;AAClB,cAAM,IAAI,2BAA2B,yCAAyC,GAAG;AAAA,MACnF;AACA,aAAO;AAAA,QACL,OAAO,KAAK;AAAA,QACZ,UAAU,KAAK;AAAA,QACf,gBAAgB;AAAA,QAChB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,KAAK,YAAY,CAAC,KAAK,gBAAgB;AAC1C,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,MACL,OAAO,KAAK;AAAA,MACZ,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,wBAAwB,gBAAmD;AACjF,QAAI,CAAC,kBAAkB,eAAe,WAAW,GAAG;AAClD,aAAO;AAAA,IACT;AACA,WAAO,MAAM,KAAK,IAAI,IAAI,eAAe,IAAI,CAAC,WAAW,OAAO,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC,CAAC;AAAA,EAC1F;AAAA,EAEQ,0BACN,gBAC8B;AAC9B,QAAI,CAAC,kBAAkB,eAAe,WAAW,GAAG;AAClD,aAAO,CAAC;AAAA,IACV;AACA,WAAO,EAAE,MAAM,EAAE,KAAK,eAAe,EAAE;AAAA,EACzC;AAAA,EAEA,MAAc,aAAa,QAAsC;AAC/D,WAAO,sBAAsB,KAAK,IAAI,MAAM,EAAE,IAAI,QAAQ,WAAW,KAAK,GAAG,QAAW,CAAC,CAAC;AAAA,EAC5F;AAAA,EAEA,MAAc,4BAA4B,UAAiC;AACzE,UAAM,kBAAkB,oDAAoD;AAAA,MAC1E;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAEA,IAAO,gCAAQ;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/enterprise",
-  "version": "0.6.5-develop.4863.1.169bfbb3a3",
+  "version": "0.6.5-develop.4964.1.ae0edca575",
   "type": "module",
   "main": "./dist/index.js",
   "scripts": {
@@ -64,8 +64,8 @@
     }
   },
   "dependencies": {
-    "@open-mercato/core": "0.6.5-develop.4863.1.169bfbb3a3",
-    "@open-mercato/ui": "0.6.5-develop.4863.1.169bfbb3a3",
+    "@open-mercato/core": "0.6.5-develop.4964.1.ae0edca575",
+    "@open-mercato/ui": "0.6.5-develop.4964.1.ae0edca575",
     "@simplewebauthn/browser": "^13.3.0",
     "@simplewebauthn/server": "^13.3.1",
     "@simplewebauthn/types": "^12.0.0",
@@ -75,12 +75,12 @@
     "qrcode": "^1.5.4"
   },
   "peerDependencies": {
-    "@open-mercato/shared": "0.6.5-develop.4863.1.169bfbb3a3",
+    "@open-mercato/shared": "0.6.5-develop.4964.1.ae0edca575",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.6.5-develop.4863.1.169bfbb3a3",
+    "@open-mercato/shared": "0.6.5-develop.4964.1.ae0edca575",
     "@types/jest": "^30.0.0",
     "@types/react": "^19.2.16",
     "@types/react-dom": "^19.2.3",

package/src/modules/security/api/enforcement/[id]/route.ts

@@ -2,14 +2,48 @@ import { NextResponse } from 'next/server'
 import { z } from 'zod'
 import type { CommandBus } from '@open-mercato/shared/lib/commands'
 import { updateEnforcementPolicySchema } from '../../../data/validators'
+import { EnforcementScope } from '../../../data/entities'
+import type { MfaEnforcementPolicy } from '../../../data/entities'
+import type { UpdateEnforcementPolicyInput } from '../../../data/validators'
 import { buildSecurityOpenApi, securityErrorSchema } from '../../openapi'
 import { securityApiError } from '../../i18n'
-import { mapEnforcementError, resolveEnforcementContext } from '../_shared'
+import {
+  assertActorOwnsEnforcementScope,
+  mapEnforcementError,
+  resolveEnforcementContext,
+  type EnforcementRequestContext,
+} from '../_shared'
 
 const paramsSchema = z.object({
   id: z.string().uuid(),
 })
 
+function scopeIdFromPolicy(policy: {
+  scope: EnforcementScope
+  tenantId?: string | null
+  organizationId?: string | null
+}): string | null {
+  if (policy.scope === EnforcementScope.TENANT) {
+    return policy.tenantId ?? null
+  }
+  if (policy.scope === EnforcementScope.ORGANISATION) {
+    if (!policy.tenantId || !policy.organizationId) return null
+    return `${policy.tenantId}:${policy.organizationId}`
+  }
+  return null
+}
+
+async function assertActorOwnsRequestedPolicyScope(
+  context: EnforcementRequestContext,
+  current: MfaEnforcementPolicy,
+  data: UpdateEnforcementPolicyInput,
+): Promise<void> {
+  const scope = data.scope ?? current.scope
+  const tenantId = data.tenantId ?? current.tenantId ?? null
+  const organizationId = data.organizationId ?? current.organizationId ?? null
+  await assertActorOwnsEnforcementScope(context, scope, scopeIdFromPolicy({ scope, tenantId, organizationId }))
+}
+
 const okResponseSchema = z.object({
   ok: z.literal(true),
 })
@@ -41,6 +75,13 @@ export async function PUT(req: Request, context: { params: Promise<{ id: string
   }
 
   try {
+    const policy = await requestContext.enforcementService.getPolicyById(params.data.id)
+    if (!policy) {
+      return securityApiError(404, 'Enforcement policy not found')
+    }
+    await assertActorOwnsEnforcementScope(requestContext, policy.scope, scopeIdFromPolicy(policy))
+    await assertActorOwnsRequestedPolicyScope(requestContext, policy, parsedBody.data)
+
     const commandBus = requestContext.container.resolve<CommandBus>('commandBus')
     const { result } = await commandBus.execute('security.enforcement.update', {
       input: {
@@ -65,6 +106,12 @@ export async function DELETE(req: Request, context: { params: Promise<{ id: stri
   }
 
   try {
+    const policy = await requestContext.enforcementService.getPolicyById(params.data.id)
+    if (!policy) {
+      return securityApiError(404, 'Enforcement policy not found')
+    }
+    await assertActorOwnsEnforcementScope(requestContext, policy.scope, scopeIdFromPolicy(policy))
+
     const commandBus = requestContext.container.resolve<CommandBus>('commandBus')
     const { result } = await commandBus.execute('security.enforcement.delete', {
       input: { id: params.data.id },
@@ -92,6 +139,7 @@ export const openApi = buildSecurityOpenApi({
       errors: [
         { status: 400, description: 'Invalid input', schema: securityErrorSchema },
         { status: 401, description: 'Unauthorized', schema: securityErrorSchema },
+        { status: 403, description: 'Not authorized for the requested scope', schema: securityErrorSchema },
         { status: 404, description: 'Policy not found', schema: securityErrorSchema },
         { status: 409, description: 'Conflict', schema: securityErrorSchema },
       ],
@@ -105,6 +153,7 @@ export const openApi = buildSecurityOpenApi({
       errors: [
         { status: 400, description: 'Invalid policy id', schema: securityErrorSchema },
         { status: 401, description: 'Unauthorized', schema: securityErrorSchema },
+        { status: 403, description: 'Not authorized for the requested scope', schema: securityErrorSchema },
         { status: 404, description: 'Policy not found', schema: securityErrorSchema },
       ],
     },

package/src/modules/security/api/enforcement/_shared.ts

@@ -2,16 +2,23 @@ import { NextResponse } from 'next/server'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
 import { Organization, Tenant } from '@open-mercato/core/modules/directory/data/entities'
-import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { CrudHttpError, forbidden } from '@open-mercato/shared/lib/crud/errors'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
-import type { MfaEnforcementPolicy } from '../../data/entities'
+import { enforceTenantSelection, resolveIsSuperAdmin } from '@open-mercato/core/modules/auth/lib/tenantAccess'
+import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
+import { EnforcementScope, type MfaEnforcementPolicy } from '../../data/entities'
 import type { MfaEnforcementServiceError, MfaEnforcementService } from '../../services/MfaEnforcementService'
 import { localizeSecurityApiBody, securityApiError } from '../i18n'
 
 type RequestContainer = Awaited<ReturnType<typeof createRequestContainer>>
 type Auth = NonNullable<Awaited<ReturnType<typeof getAuthFromRequest>>>
 
+export type EnforcementActorContext = {
+  tenantId: string | null
+  isSuperAdmin: boolean
+}
+
 export type EnforcementRequestContext = {
   auth: Auth
   container: RequestContainer
@@ -41,6 +48,80 @@ export async function resolveEnforcementContext(req: Request): Promise<Enforceme
   }
 }
 
+function normalizeNullableString(value: unknown): string | null {
+  return typeof value === 'string' && value.trim().length > 0 ? value.trim() : null
+}
+
+function normalizeOrganizationList(values: unknown): string[] | null {
+  if (values === null || values === undefined) return null
+  if (!Array.isArray(values)) return null
+  const result: string[] = []
+  for (const value of values) {
+    if (typeof value !== 'string') continue
+    const trimmed = value.trim()
+    if (trimmed) result.push(trimmed)
+  }
+  return result
+}
+
+export async function resolveActorContext(ctx: EnforcementRequestContext): Promise<EnforcementActorContext> {
+  const isSuperAdmin = await resolveIsSuperAdmin({ auth: ctx.auth, container: ctx.container })
+  return {
+    tenantId: normalizeNullableString(ctx.auth.tenantId),
+    isSuperAdmin,
+  }
+}
+
+async function assertActorOwnsOrganization(
+  ctx: EnforcementRequestContext,
+  organizationId: string,
+): Promise<void> {
+  const rbacService = ctx.container.resolve<RbacService>('rbacService')
+  const acl = await rbacService.loadAcl(ctx.auth.sub, {
+    tenantId: normalizeNullableString(ctx.auth.tenantId),
+    organizationId: normalizeNullableString(ctx.auth.orgId),
+  })
+  const organizations = normalizeOrganizationList(acl?.organizations)
+  if (organizations === null || organizations.includes('__all__')) return
+  if (!organizations.includes(organizationId)) {
+    throw forbidden('Not authorized to target this organization.')
+  }
+}
+
+export async function assertActorOwnsEnforcementScope(
+  ctx: EnforcementRequestContext,
+  scope: EnforcementScope,
+  scopeId: string | null | undefined,
+): Promise<void> {
+  if (scope === EnforcementScope.PLATFORM) {
+    const isSuperAdmin = await resolveIsSuperAdmin({ auth: ctx.auth, container: ctx.container })
+    if (!isSuperAdmin) {
+      throw forbidden('Platform scope requires platform administrator privileges.')
+    }
+    return
+  }
+
+  if (scope === EnforcementScope.TENANT) {
+    await enforceTenantSelection({ auth: ctx.auth, container: ctx.container }, scopeId)
+    return
+  }
+
+  const normalizedScopeId = normalizeNullableString(scopeId)
+  if (!normalizedScopeId) {
+    throw new CrudHttpError(400, { error: "organisation scopeId must use '<tenantId>:<organizationId>' format" })
+  }
+  const [tenantId, organizationId] = normalizedScopeId.split(':')
+  if (!tenantId || !organizationId) {
+    throw new CrudHttpError(400, { error: "organisation scopeId must use '<tenantId>:<organizationId>' format" })
+  }
+
+  await enforceTenantSelection({ auth: ctx.auth, container: ctx.container }, tenantId)
+
+  const isSuperAdmin = await resolveIsSuperAdmin({ auth: ctx.auth, container: ctx.container })
+  if (isSuperAdmin) return
+  await assertActorOwnsOrganization(ctx, organizationId)
+}
+
 export async function mapEnforcementError(error: unknown): Promise<NextResponse> {
   if (error instanceof CrudHttpError) {
     return NextResponse.json(await localizeSecurityApiBody(error.body), { status: error.status })

package/src/modules/security/api/enforcement/compliance/route.ts

@@ -3,7 +3,12 @@ import { z } from 'zod'
 import { EnforcementScope } from '../../../data/entities'
 import { buildSecurityOpenApi, securityErrorSchema } from '../../openapi'
 import { securityApiError } from '../../i18n'
-import { mapEnforcementError, resolveEnforcementContext } from '../_shared'
+import {
+  assertActorOwnsEnforcementScope,
+  mapEnforcementError,
+  resolveActorContext,
+  resolveEnforcementContext,
+} from '../_shared'
 
 const complianceQuerySchema = z.object({
   scope: z.nativeEnum(EnforcementScope).default(EnforcementScope.PLATFORM),
@@ -37,9 +42,12 @@ export async function GET(req: Request) {
   }
 
   try {
+    await assertActorOwnsEnforcementScope(context, parsedQuery.data.scope, parsedQuery.data.scopeId)
+    const actor = await resolveActorContext(context)
     const report = await context.enforcementService.getComplianceReport(
       parsedQuery.data.scope,
       parsedQuery.data.scopeId,
+      actor,
     )
     return NextResponse.json({
       scope: parsedQuery.data.scope,
@@ -63,6 +71,7 @@ export const openApi = buildSecurityOpenApi({
       errors: [
         { status: 400, description: 'Invalid query parameters', schema: securityErrorSchema },
         { status: 401, description: 'Unauthorized', schema: securityErrorSchema },
+        { status: 403, description: 'Not authorized for the requested scope', schema: securityErrorSchema },
       ],
     },
   },

package/src/modules/security/api/enforcement/route.ts

@@ -5,7 +5,13 @@ import { enforcementPolicySchema } from '../../data/validators'
 import { EnforcementScope } from '../../data/entities'
 import { buildSecurityOpenApi, securityErrorSchema } from '../openapi'
 import { securityApiError } from '../i18n'
-import { attachPolicyScopeNames, mapEnforcementError, resolveEnforcementContext } from './_shared'
+import {
+  assertActorOwnsEnforcementScope,
+  attachPolicyScopeNames,
+  mapEnforcementError,
+  resolveActorContext,
+  resolveEnforcementContext,
+} from './_shared'
 
 const enforcementPolicyResponseSchema = z.object({
   id: z.string().uuid(),
@@ -52,7 +58,8 @@ export async function GET(req: Request) {
       return securityApiError(400, 'Invalid query parameters', { issues: parsedQuery.error.issues })
     }
 
-    const policies = await context.enforcementService.listPolicies(parsedQuery.data)
+    const actor = await resolveActorContext(context)
+    const policies = await context.enforcementService.listPolicies(parsedQuery.data, actor)
     return NextResponse.json({
       items: await attachPolicyScopeNames(context.container, policies),
     })
@@ -78,6 +85,11 @@ export async function POST(req: Request) {
   }
 
   try {
+    await assertActorOwnsEnforcementScope(
+      context,
+      parsedBody.data.scope,
+      scopeIdFromPolicyInput(parsedBody.data),
+    )
     const commandBus = context.container.resolve<CommandBus>('commandBus')
     const { result } = await commandBus.execute('security.enforcement.create', {
       input: parsedBody.data,
@@ -89,6 +101,21 @@ export async function POST(req: Request) {
   }
 }
 
+function scopeIdFromPolicyInput(data: {
+  scope: EnforcementScope
+  tenantId?: string | null
+  organizationId?: string | null
+}): string | null {
+  if (data.scope === EnforcementScope.TENANT) {
+    return data.tenantId ?? null
+  }
+  if (data.scope === EnforcementScope.ORGANISATION) {
+    if (!data.tenantId || !data.organizationId) return null
+    return `${data.tenantId}:${data.organizationId}`
+  }
+  return null
+}
+
 export const openApi = buildSecurityOpenApi({
   summary: 'Enforcement policy routes',
   methods: {
@@ -115,6 +142,7 @@ export const openApi = buildSecurityOpenApi({
       errors: [
         { status: 400, description: 'Invalid payload', schema: securityErrorSchema },
         { status: 401, description: 'Unauthorized', schema: securityErrorSchema },
+        { status: 403, description: 'Not authorized for the requested scope', schema: securityErrorSchema },
         { status: 409, description: 'Conflict', schema: securityErrorSchema },
       ],
     },

package/src/modules/security/api/users/[id]/mfa/reset/route.ts

@@ -3,7 +3,11 @@ import { z } from 'zod'
 import type { CommandBus } from '@open-mercato/shared/lib/commands'
 import { buildSecurityOpenApi, securityErrorSchema } from '../../../../openapi'
 import { securityApiError } from '../../../../i18n'
-import { mapSecurityUsersError, resolveSecurityUsersContext } from '../../../_shared'
+import {
+  assertActorCanAccessSecurityUserTarget,
+  mapSecurityUsersError,
+  resolveSecurityUsersContext,
+} from '../../../_shared'
 import { requireSudo } from '../../../../../lib/sudo-middleware'
 
 const paramsSchema = z.object({
@@ -44,6 +48,7 @@ export async function POST(req: Request, routeContext: { params: Promise<{ id: s
   }
 
   try {
+    await assertActorCanAccessSecurityUserTarget(context, parsedParams.data.id)
     await requireSudo(req, 'security.admin.mfa.reset')
     const commandBus = context.container.resolve<CommandBus>('commandBus')
     const { result } = await commandBus.execute('security.admin.mfa.reset', {

package/src/modules/security/api/users/[id]/mfa/status/route.ts

@@ -2,7 +2,12 @@ import { NextResponse } from 'next/server'
 import { z } from 'zod'
 import { buildSecurityOpenApi, securityErrorSchema } from '../../../../openapi'
 import { securityApiError } from '../../../../i18n'
-import { mapSecurityUsersError, resolveSecurityUsersContext } from '../../../_shared'
+import { resolveIsSuperAdmin } from '@open-mercato/core/modules/auth/lib/tenantAccess'
+import {
+  assertActorCanAccessSecurityUserTarget,
+  mapSecurityUsersError,
+  resolveSecurityUsersContext,
+} from '../../../_shared'
 
 const paramsSchema = z.object({
   id: z.string().uuid(),
@@ -35,7 +40,12 @@ export async function GET(req: Request, routeContext: { params: Promise<{ id: st
   }
 
   try {
-    const status = await context.mfaAdminService.getUserMfaStatus(parsedParams.data.id)
+    await assertActorCanAccessSecurityUserTarget(context, parsedParams.data.id)
+    const isSuperAdmin = await resolveIsSuperAdmin({ auth: context.auth, container: context.container })
+    const status = await context.mfaAdminService.getUserMfaStatus(parsedParams.data.id, {
+      tenantId: context.auth.tenantId ?? null,
+      isSuperAdmin,
+    })
     return NextResponse.json({
       ...status,
       methods: status.methods.map((method) => ({
@@ -60,6 +70,7 @@ export const openApi = buildSecurityOpenApi({
       errors: [
         { status: 400, description: 'Invalid user id', schema: securityErrorSchema },
         { status: 401, description: 'Unauthorized', schema: securityErrorSchema },
+        { status: 403, description: 'Not authorized to access this user', schema: securityErrorSchema },
         { status: 404, description: 'User not found', schema: securityErrorSchema },
       ],
     },

package/src/modules/security/api/users/_shared.ts

@@ -1,8 +1,13 @@
 import { NextResponse } from 'next/server'
-import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'
+import { CrudHttpError, forbidden } from '@open-mercato/shared/lib/crud/errors'
 import type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { enforceTenantSelection, resolveIsSuperAdmin } from '@open-mercato/core/modules/auth/lib/tenantAccess'
+import { User } from '@open-mercato/core/modules/auth/data/entities'
+import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 import { isSudoRequiredError } from '../../lib/sudo-middleware'
 import type { MfaAdminService, MfaAdminServiceError } from '../../services/MfaAdminService'
 import { localizeSecurityApiBody, securityApiError } from '../i18n'
@@ -41,6 +46,69 @@ export async function resolveSecurityUsersContext(
   }
 }
 
+function normalizeNullableString(value: unknown): string | null {
+  return typeof value === 'string' && value.trim().length > 0 ? value.trim() : null
+}
+
+function normalizeOrganizationList(values: unknown): string[] | null {
+  if (values === null || values === undefined) return null
+  if (!Array.isArray(values)) return null
+  const result: string[] = []
+  for (const value of values) {
+    if (typeof value !== 'string') continue
+    const trimmed = value.trim()
+    if (trimmed) result.push(trimmed)
+  }
+  return result
+}
+
+export async function assertActorCanAccessSecurityUserTarget(
+  ctx: SecurityUsersRequestContext,
+  targetUserId: string,
+): Promise<void> {
+  const isSuperAdmin = await resolveIsSuperAdmin({ auth: ctx.auth, container: ctx.container })
+  if (isSuperAdmin) return
+
+  const em = ctx.container.resolve<EntityManager>('em')
+  const target = await findOneWithDecryption(
+    em,
+    User,
+    { id: targetUserId, deletedAt: null } as FilterQuery<User>,
+    {},
+    { tenantId: null, organizationId: null },
+  )
+  if (!target) {
+    throw new CrudHttpError(404, { error: 'User not found' })
+  }
+
+  const actorTenantId = normalizeNullableString(ctx.auth.tenantId)
+  const targetTenantId = normalizeNullableString((target as { tenantId?: string | null }).tenantId)
+  if (!targetTenantId || targetTenantId !== actorTenantId) {
+    throw new CrudHttpError(404, { error: 'User not found' })
+  }
+
+  const rbacService = ctx.container.resolve<RbacService>('rbacService')
+  const acl = await rbacService.loadAcl(ctx.auth.sub, {
+    tenantId: actorTenantId,
+    organizationId: normalizeNullableString(ctx.auth.orgId),
+  })
+  const organizations = normalizeOrganizationList(acl?.organizations)
+  if (organizations !== null && !organizations.includes('__all__')) {
+    const targetOrganizationId = normalizeNullableString((target as { organizationId?: string | null }).organizationId)
+    if (!targetOrganizationId || !organizations.includes(targetOrganizationId)) {
+      throw forbidden('Not authorized to access this user.')
+    }
+  }
+}
+
+export async function assertActorOwnsTenantScope(
+  ctx: SecurityUsersRequestContext,
+  requestedTenantId: string | null | undefined,
+): Promise<string | null> {
+  const resolved = await enforceTenantSelection({ auth: ctx.auth, container: ctx.container }, requestedTenantId)
+  return resolved ?? ctx.auth.tenantId ?? null
+}
+
 export async function mapSecurityUsersError(error: unknown): Promise<NextResponse> {
   if (error instanceof CrudHttpError) {
     return NextResponse.json(await localizeSecurityApiBody(error.body), { status: error.status })

package/src/modules/security/api/users/mfa/compliance/route.ts

@@ -2,7 +2,12 @@ import { NextResponse } from 'next/server'
 import { z } from 'zod'
 import { buildSecurityOpenApi, securityErrorSchema } from '../../../openapi'
 import { securityApiError } from '../../../i18n'
-import { mapSecurityUsersError, resolveSecurityUsersContext } from '../../_shared'
+import { resolveIsSuperAdmin } from '@open-mercato/core/modules/auth/lib/tenantAccess'
+import {
+  assertActorOwnsTenantScope,
+  mapSecurityUsersError,
+  resolveSecurityUsersContext,
+} from '../../_shared'
 
 const querySchema = z.object({
   tenantId: z.string().uuid().optional(),
@@ -37,13 +42,16 @@ export async function GET(req: Request) {
     return securityApiError(400, 'Invalid query parameters', { issues: parsedQuery.error.issues })
   }
 
-  const tenantId = parsedQuery.data.tenantId ?? context.auth.tenantId ?? null
-  if (!tenantId) {
-    return securityApiError(400, 'Tenant context is required.')
-  }
-
   try {
-    const items = await context.mfaAdminService.bulkComplianceCheck(tenantId)
+    const tenantId = await assertActorOwnsTenantScope(context, parsedQuery.data.tenantId)
+    if (!tenantId) {
+      return securityApiError(400, 'Tenant context is required.')
+    }
+    const isSuperAdmin = await resolveIsSuperAdmin({ auth: context.auth, container: context.container })
+    const items = await context.mfaAdminService.bulkComplianceCheck(tenantId, {
+      tenantId: context.auth.tenantId ?? null,
+      isSuperAdmin,
+    })
     return NextResponse.json({ items })
   } catch (error) {
     return await mapSecurityUsersError(error)
@@ -62,6 +70,7 @@ export const openApi = buildSecurityOpenApi({
       errors: [
         { status: 400, description: 'Invalid query or missing tenant context', schema: securityErrorSchema },
         { status: 401, description: 'Unauthorized', schema: securityErrorSchema },
+        { status: 403, description: 'Not authorized for the requested tenant scope', schema: securityErrorSchema },
       ],
     },
   },

package/src/modules/security/commands/createEnforcementPolicy.ts

@@ -2,6 +2,7 @@ import { z } from 'zod'
 import { registerCommand } from '@open-mercato/shared/lib/commands'
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { resolveIsSuperAdmin } from '@open-mercato/core/modules/auth/lib/tenantAccess'
 import { enforcementPolicySchema } from '../data/validators'
 import type { MfaEnforcementService } from '../services/MfaEnforcementService'
 
@@ -34,8 +35,12 @@ registerCommand({
     }
 
     const enforcementService = ctx.container.resolve<MfaEnforcementService>('mfaEnforcementService')
+    const isSuperAdmin = await resolveIsSuperAdmin({ auth: ctx.auth, container: ctx.container })
     try {
-      const policy = await enforcementService.createPolicy(parsed.data, ctx.auth.sub)
+      const policy = await enforcementService.createPolicy(parsed.data, ctx.auth.sub, {
+        tenantId: ctx.auth.tenantId ?? null,
+        isSuperAdmin,
+      })
       return { id: policy.id }
     } catch (error) {
       if (isEnforcementServiceError(error)) {