@open-mercato/enterprise 0.6.8-develop.7100.1.fbf66fca35 → 0.7.0

package/src/modules/security/services/SudoChallengeService.ts

@@ -24,7 +24,7 @@ import type { MfaService } from './MfaService'
 import type { MfaVerificationService } from './MfaVerificationService'
 import { sudoTargets as defaultSudoTargets } from '../security.sudo'
 import type { SecurityModuleConfig } from '../lib/security-config'
-import { emitMfaEmergencyBypassActiveWarning, readSecurityModuleConfig } from '../lib/security-config'
+import { readSecurityModuleConfig } from '../lib/security-config'
 
 type SudoMethod = 'password' | 'mfa'
 
@@ -56,12 +56,6 @@ type UserScope = {
   organizationId: string | null
 }
 
-type BoundPendingSudoSession = SudoSession & {
-  targetIdentifier: string
-  sudoConfigId: string
-  sudoConfigUpdatedAt: Date
-}
-
 export type SudoAuthScope = {
   tenantId: string | null
   organizationId?: string | null
@@ -137,7 +131,21 @@ export class SudoChallengeService {
     organizationId?: string | null,
   ): Promise<SudoProtectionResolution> {
     await this.ensureDeveloperDefaultsRegistered()
-    return this.resolveProtection(this.em, targetIdentifier, tenantId ?? null, organizationId ?? null)
+
+    const candidates = await this.em.find(SudoChallengeConfig, {
+      targetIdentifier,
+      deletedAt: null,
+    })
+
+    const resolved = candidates
+      .filter((config) => this.matchesScope(config, tenantId ?? null, organizationId ?? null))
+      .sort((left, right) => this.compareConfigPriority(left, right, tenantId ?? null, organizationId ?? null))[0]
+
+    if (!resolved || !resolved.isEnabled) {
+      return { protected: false }
+    }
+
+    return { protected: true, config: resolved }
   }
 
   async initiate(
@@ -151,24 +159,23 @@ export class SudoChallengeService {
     availableMfaMethods?: SudoAvailableMethod[]
     expiresAt?: Date
   }> {
-    const user = await this.findUserScope(userId)
-    if (!user?.tenantId) {
-      throw new SudoChallengeServiceError('User not found', 404)
-    }
-    const scopeTenantId = options?.tenantId !== undefined ? options.tenantId : user.tenantId
-    const scopeOrganizationId = options?.organizationId !== undefined ? options.organizationId : user.organizationId
     const protection = await this.isProtected(
       targetIdentifier,
-      scopeTenantId,
-      scopeOrganizationId,
+      options?.tenantId ?? null,
+      options?.organizationId ?? null,
     )
 
     if (!protection.protected || !protection.config) {
       return { required: false }
     }
 
+    const user = await this.findUserScope(userId)
+    if (!user?.tenantId) {
+      throw new SudoChallengeServiceError('User not found', 404)
+    }
+
     const userMethods = await this.mfaService.getUserMethods(userId)
-    const method = this.resolveChallengeMethod(protection.config.challengeMethod, userMethods.length, userId, targetIdentifier)
+    const method = this.resolveChallengeMethod(protection.config.challengeMethod, userMethods.length)
 
     let sessionToken = randomBytes(16).toString('hex')
     let availableMfaMethods: SudoAvailableMethod[] | undefined
@@ -182,15 +189,9 @@ export class SudoChallengeService {
     const session = this.em.create(SudoSession, {
       userId,
       tenantId: user.tenantId,
-      scopeTenantId,
-      scopeOrganizationId,
-      targetIdentifier,
-      sudoConfigId: protection.config.id,
-      sudoConfigUpdatedAt: protection.config.updatedAt,
       sessionToken,
       challengeMethod: method,
       expiresAt,
-      verifiedAt: null,
       createdAt: new Date(),
     })
     this.em.persist(session)
@@ -254,36 +255,17 @@ export class SudoChallengeService {
     if (!user?.tenantId) {
       throw new SudoChallengeServiceError('User not found', 404)
     }
-    if (user.tenantId !== session.tenantId) {
-      throw new SudoChallengeServiceError('Unable to verify sudo challenge', 403)
-    }
 
-    const requestedTenantId = options.tenantId !== undefined ? options.tenantId : user.tenantId
-    const requestedOrganizationId = options.organizationId !== undefined ? options.organizationId : user.organizationId
-    if (
-      options.targetIdentifier !== session.targetIdentifier
-      || requestedTenantId !== session.scopeTenantId
-      || requestedOrganizationId !== session.scopeOrganizationId
-    ) {
-      throw new SudoChallengeServiceError('Unable to verify sudo challenge', 403)
-    }
-
-    const scopeTenantId = session.scopeTenantId ?? null
-    const scopeOrganizationId = session.scopeOrganizationId ?? null
+    const scopeTenantId = options.tenantId !== undefined ? options.tenantId : user.tenantId
+    const scopeOrganizationId = options.organizationId !== undefined ? options.organizationId : user.organizationId
     const protection = await this.isProtected(
-      session.targetIdentifier,
+      options.targetIdentifier,
       scopeTenantId,
       scopeOrganizationId,
     )
     if (!protection.protected || !protection.config) {
       throw new SudoChallengeServiceError('Sudo protection is not configured for this target', 404)
     }
-    if (
-      protection.config.id !== session.sudoConfigId
-      || protection.config.updatedAt.getTime() !== session.sudoConfigUpdatedAt?.getTime()
-    ) {
-      throw new SudoChallengeServiceError('Unable to verify sudo challenge', 403)
-    }
 
     let verified = false
     let methodUsed: string = methodType
@@ -306,73 +288,33 @@ export class SudoChallengeService {
         userId: session.userId,
         tenantId: user.tenantId,
         organizationId: user.organizationId,
-        targetIdentifier: session.targetIdentifier,
+        targetIdentifier: options.targetIdentifier,
         method: methodUsed,
       })
       throw new SudoChallengeServiceError('Unable to verify sudo challenge', 401)
     }
 
-    const pendingToken = session.sessionToken
-    const { sudoToken, expiresAt, verifiedAt } = await this.em.transactional(async (transactionalEm) => {
-      await transactionalEm.execute('lock table "sudo_challenge_configs" in share mode')
-      const currentProtection = await this.resolveProtection(
-        transactionalEm,
-        session.targetIdentifier,
-        scopeTenantId,
-        scopeOrganizationId,
-      )
-      if (
-        !currentProtection.protected
-        || !currentProtection.config
-        || currentProtection.config.id !== session.sudoConfigId
-        || currentProtection.config.updatedAt.getTime() !== session.sudoConfigUpdatedAt.getTime()
-      ) {
-        throw new SudoChallengeServiceError('Unable to verify sudo challenge', 403)
-      }
-
-      const ttlSeconds = this.normalizeTtl(currentProtection.config.ttlSeconds)
-      const currentVerifiedAt = new Date()
-      const currentExpiresAt = new Date(Date.now() + ttlSeconds * 1000)
-      const currentSudoToken = this.signToken({
-        sid: session.id,
-        sub: session.userId,
-        tid: scopeTenantId,
-        oid: scopeOrganizationId,
-        tgt: session.targetIdentifier,
-        exp: currentExpiresAt.getTime(),
-      })
-      const consumedRows = await transactionalEm.nativeUpdate(
-        SudoSession,
-        {
-          id: session.id,
-          sessionToken: pendingToken,
-          verifiedAt: null,
-          expiresAt: { $gt: currentVerifiedAt },
-        },
-        {
-          sessionToken: currentSudoToken,
-          expiresAt: currentExpiresAt,
-          verifiedAt: currentVerifiedAt,
-        },
-      )
-      if (consumedRows !== 1) {
-        throw new SudoChallengeServiceError('Unable to verify sudo challenge', 400)
-      }
-      return {
-        sudoToken: currentSudoToken,
-        expiresAt: currentExpiresAt,
-        verifiedAt: currentVerifiedAt,
-      }
+    const ttlSeconds = this.normalizeTtl(protection.config.ttlSeconds)
+    const expiresAt = new Date(Date.now() + ttlSeconds * 1000)
+    const sudoToken = this.signToken({
+      sid: session.id,
+      sub: session.userId,
+      tid: scopeTenantId,
+      oid: scopeOrganizationId,
+      tgt: options.targetIdentifier,
+      exp: expiresAt.getTime(),
     })
+
     session.sessionToken = sudoToken
+    session.challengeMethod = methodUsed
     session.expiresAt = expiresAt
-    session.verifiedAt = verifiedAt
+    await this.em.flush()
 
     await emitSecurityEvent('security.sudo.verified', {
       userId: session.userId,
       tenantId: scopeTenantId,
       organizationId: scopeOrganizationId,
-      targetIdentifier: session.targetIdentifier,
+      targetIdentifier: options.targetIdentifier,
       method: methodUsed,
       expiresAt: expiresAt.toISOString(),
     })
@@ -402,10 +344,6 @@ export class SudoChallengeService {
       id: payload.sid,
       userId: payload.sub,
       sessionToken: token,
-      targetIdentifier,
-      scopeTenantId: payload.tid,
-      scopeOrganizationId: payload.oid,
-      verifiedAt: { $ne: null },
     } as FilterQuery<SudoSession>)
 
     return Boolean(session && session.expiresAt.getTime() > Date.now())
@@ -525,20 +463,12 @@ export class SudoChallengeService {
     })
 
     if (existing) {
-      const ttlSeconds = this.normalizeTtl(input.ttlSeconds)
-      const challengeMethod = input.challengeMethod ?? ChallengeMethod.AUTO
-      const changed = !existing.isEnabled
-        || Boolean(existing.deletedAt)
-        || existing.ttlSeconds !== ttlSeconds
-        || existing.challengeMethod !== challengeMethod
-      if (changed) {
-        existing.isEnabled = true
-        existing.deletedAt = null
-        existing.ttlSeconds = ttlSeconds
-        existing.challengeMethod = challengeMethod
-        existing.updatedAt = new Date()
-        await this.em.flush()
-      }
+      existing.isEnabled = true
+      existing.deletedAt = null
+      existing.ttlSeconds = this.normalizeTtl(input.ttlSeconds)
+      existing.challengeMethod = input.challengeMethod ?? ChallengeMethod.AUTO
+      existing.updatedAt = new Date()
+      await this.em.flush()
       return
     }
 
@@ -643,33 +573,10 @@ export class SudoChallengeService {
   private resolveChallengeMethod(
     configuredMethod: ChallengeMethod,
     availableMfaMethodCount: number,
-    userId?: string,
-    targetIdentifier?: string,
   ): SudoMethod {
     if (this.securityConfig.mfa.emergencyBypass) {
-      let wouldHaveBeenMfa = false
-      try {
-        wouldHaveBeenMfa = this.resolveChallengeMethodWithoutBypass(configuredMethod, availableMfaMethodCount) === 'mfa'
-      } catch {
-        wouldHaveBeenMfa = configuredMethod === ChallengeMethod.MFA
-      }
-      if (wouldHaveBeenMfa) {
-        emitMfaEmergencyBypassActiveWarning('sudo challenge downgraded to password', {
-          configuredMethod,
-          availableMfaMethodCount,
-          userId,
-          targetIdentifier,
-        })
-      }
       return 'password'
     }
-    return this.resolveChallengeMethodWithoutBypass(configuredMethod, availableMfaMethodCount)
-  }
-
-  private resolveChallengeMethodWithoutBypass(
-    configuredMethod: ChallengeMethod,
-    availableMfaMethodCount: number,
-  ): SudoMethod {
     if (configuredMethod === ChallengeMethod.PASSWORD) return 'password'
     if (configuredMethod === ChallengeMethod.MFA) {
       if (availableMfaMethodCount === 0) {
@@ -680,28 +587,6 @@ export class SudoChallengeService {
     return availableMfaMethodCount > 0 ? 'mfa' : 'password'
   }
 
-  private async resolveProtection(
-    em: EntityManager,
-    targetIdentifier: string,
-    tenantId: string | null,
-    organizationId: string | null,
-  ): Promise<SudoProtectionResolution> {
-    const candidates = await em.find(SudoChallengeConfig, {
-      targetIdentifier,
-      deletedAt: null,
-    })
-
-    const resolved = candidates
-      .filter((config) => this.matchesScope(config, tenantId, organizationId))
-      .sort((left, right) => this.compareConfigPriority(left, right, tenantId, organizationId))[0]
-
-    if (!resolved || !resolved.isEnabled) {
-      return { protected: false }
-    }
-
-    return { protected: true, config: resolved }
-  }
-
   private matchesScope(config: SudoChallengeConfig, tenantId: string | null, organizationId: string | null): boolean {
     if (config.organizationId) {
       return config.organizationId === organizationId && config.tenantId === tenantId
@@ -739,21 +624,15 @@ export class SudoChallengeService {
     return 4
   }
 
-  private async getPendingSession(sessionId: string): Promise<BoundPendingSudoSession> {
+  private async getPendingSession(sessionId: string): Promise<SudoSession> {
     const session = await this.em.findOne(SudoSession, { id: sessionId })
     if (!session) {
       throw new SudoChallengeServiceError('Sudo challenge session not found', 404)
     }
-    if (!session.targetIdentifier || !session.sudoConfigId || !session.sudoConfigUpdatedAt) {
-      throw new SudoChallengeServiceError('Sudo challenge session not found', 404)
-    }
-    if (session.verifiedAt) {
-      throw new SudoChallengeServiceError('Unable to verify sudo challenge', 400)
-    }
     if (session.expiresAt.getTime() <= Date.now()) {
       throw new SudoChallengeServiceError('Sudo challenge session expired', 400)
     }
-    return session as BoundPendingSudoSession
+    return session
   }
 
   private async findUserScope(userId: string): Promise<UserScope | null> {

package/src/modules/sso/backend/page.tsx

@@ -30,7 +30,6 @@ interface ListResponse {
   items: SsoConfigRow[]
   total: number
   totalPages: number
-  totalIsCapped?: boolean
   isSuperAdmin?: boolean
 }
 
@@ -221,7 +220,6 @@ export default function SsoConfigListPage() {
               pageSize: 50,
               total: data.total,
               totalPages: data.totalPages,
-              totalIsCapped: data?.totalIsCapped === true,
               onPageChange: setPage,
             }}
             isLoading={isLoading}

package/dist/modules/security/lib/mfaCompletionRoutes.js

@@ -1,17 +0,0 @@
-import { registerMfaPendingAccessRoutes } from "@open-mercato/shared/lib/auth/mfaPendingAccess";
-const CANONICAL_MFA_COMPLETION_ROUTES = [
-  { path: "/api/security/mfa/prepare", methods: ["POST"] },
-  { path: "/api/security/mfa/verify", methods: ["POST"] },
-  { path: "/api/security/mfa/recovery", methods: ["POST"] }
-];
-let registered = false;
-function registerCanonicalMfaCompletionRoutes() {
-  if (registered) return;
-  registerMfaPendingAccessRoutes(CANONICAL_MFA_COMPLETION_ROUTES);
-  registered = true;
-}
-registerCanonicalMfaCompletionRoutes();
-export {
-  registerCanonicalMfaCompletionRoutes
-};
-//# sourceMappingURL=mfaCompletionRoutes.js.map

package/dist/modules/security/lib/mfaCompletionRoutes.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/modules/security/lib/mfaCompletionRoutes.ts"],
-  "sourcesContent": ["import { registerMfaPendingAccessRoutes } from '@open-mercato/shared/lib/auth/mfaPendingAccess'\n\nconst CANONICAL_MFA_COMPLETION_ROUTES = [\n  { path: '/api/security/mfa/prepare', methods: ['POST'] },\n  { path: '/api/security/mfa/verify', methods: ['POST'] },\n  { path: '/api/security/mfa/recovery', methods: ['POST'] },\n]\n\nlet registered = false\n\n/**\n * Register the canonical MFA challenge-completion routes with the platform-wide pending-token\n * allowlist. The enterprise security module owns these routes, so it owns their registration:\n * shared stays generic (SPEC-ENT-007 \u00A7 Amendment 2026-08-21). Idempotent; runs once per process\n * on first import of this module \u2014 which happens at security-module bootstrap and, as a\n * belt-and-braces guarantee, on every load of the completion route modules themselves, so the\n * routes are always registered before request authentication resolves.\n */\nexport function registerCanonicalMfaCompletionRoutes(): void {\n  if (registered) return\n  registerMfaPendingAccessRoutes(CANONICAL_MFA_COMPLETION_ROUTES)\n  registered = true\n}\n\nregisterCanonicalMfaCompletionRoutes()\n"],
-  "mappings": "AAAA,SAAS,sCAAsC;AAE/C,MAAM,kCAAkC;AAAA,EACtC,EAAE,MAAM,6BAA6B,SAAS,CAAC,MAAM,EAAE;AAAA,EACvD,EAAE,MAAM,4BAA4B,SAAS,CAAC,MAAM,EAAE;AAAA,EACtD,EAAE,MAAM,8BAA8B,SAAS,CAAC,MAAM,EAAE;AAC1D;AAEA,IAAI,aAAa;AAUV,SAAS,uCAA6C;AAC3D,MAAI,WAAY;AAChB,iCAA+B,+BAA+B;AAC9D,eAAa;AACf;AAEA,qCAAqC;",
-  "names": []
-}

package/dist/modules/security/migrations/Migration20260811143757_security.js

@@ -1,13 +0,0 @@
-import { Migration } from "@mikro-orm/migrations";
-class Migration20260811143757_security extends Migration {
-  up() {
-    this.addSql(`alter table "sudo_sessions" add "scope_tenant_id" uuid null, add "scope_organization_id" uuid null, add "target_identifier" text null, add "sudo_config_id" uuid null, add "sudo_config_updated_at" timestamptz null, add "verified_at" timestamptz null;`);
-  }
-  down() {
-    this.addSql(`alter table "sudo_sessions" drop column "scope_tenant_id", drop column "scope_organization_id", drop column "target_identifier", drop column "sudo_config_id", drop column "sudo_config_updated_at", drop column "verified_at";`);
-  }
-}
-export {
-  Migration20260811143757_security
-};
-//# sourceMappingURL=Migration20260811143757_security.js.map

package/dist/modules/security/migrations/Migration20260811143757_security.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/modules/security/migrations/Migration20260811143757_security.ts"],
-  "sourcesContent": ["import { Migration } from '@mikro-orm/migrations';\n\nexport class Migration20260811143757_security extends Migration {\n\n  override up(): void | Promise<void> {\n    this.addSql(`alter table \"sudo_sessions\" add \"scope_tenant_id\" uuid null, add \"scope_organization_id\" uuid null, add \"target_identifier\" text null, add \"sudo_config_id\" uuid null, add \"sudo_config_updated_at\" timestamptz null, add \"verified_at\" timestamptz null;`);\n  }\n\n  override down(): void | Promise<void> {\n    this.addSql(`alter table \"sudo_sessions\" drop column \"scope_tenant_id\", drop column \"scope_organization_id\", drop column \"target_identifier\", drop column \"sudo_config_id\", drop column \"sudo_config_updated_at\", drop column \"verified_at\";`);\n  }\n\n}\n"],
-  "mappings": "AAAA,SAAS,iBAAiB;AAEnB,MAAM,yCAAyC,UAAU;AAAA,EAErD,KAA2B;AAClC,SAAK,OAAO,2PAA2P;AAAA,EACzQ;AAAA,EAES,OAA6B;AACpC,SAAK,OAAO,iOAAiO;AAAA,EAC/O;AAEF;",
-  "names": []
-}

package/src/modules/security/lib/mfaCompletionRoutes.ts

@@ -1,25 +0,0 @@
-import { registerMfaPendingAccessRoutes } from '@open-mercato/shared/lib/auth/mfaPendingAccess'
-
-const CANONICAL_MFA_COMPLETION_ROUTES = [
-  { path: '/api/security/mfa/prepare', methods: ['POST'] },
-  { path: '/api/security/mfa/verify', methods: ['POST'] },
-  { path: '/api/security/mfa/recovery', methods: ['POST'] },
-]
-
-let registered = false
-
-/**
- * Register the canonical MFA challenge-completion routes with the platform-wide pending-token
- * allowlist. The enterprise security module owns these routes, so it owns their registration:
- * shared stays generic (SPEC-ENT-007 § Amendment 2026-08-21). Idempotent; runs once per process
- * on first import of this module — which happens at security-module bootstrap and, as a
- * belt-and-braces guarantee, on every load of the completion route modules themselves, so the
- * routes are always registered before request authentication resolves.
- */
-export function registerCanonicalMfaCompletionRoutes(): void {
-  if (registered) return
-  registerMfaPendingAccessRoutes(CANONICAL_MFA_COMPLETION_ROUTES)
-  registered = true
-}
-
-registerCanonicalMfaCompletionRoutes()

package/src/modules/security/migrations/Migration20260811143757_security.ts

@@ -1,13 +0,0 @@
-import { Migration } from '@mikro-orm/migrations';
-
-export class Migration20260811143757_security extends Migration {
-
-  override up(): void | Promise<void> {
-    this.addSql(`alter table "sudo_sessions" add "scope_tenant_id" uuid null, add "scope_organization_id" uuid null, add "target_identifier" text null, add "sudo_config_id" uuid null, add "sudo_config_updated_at" timestamptz null, add "verified_at" timestamptz null;`);
-  }
-
-  override down(): void | Promise<void> {
-    this.addSql(`alter table "sudo_sessions" drop column "scope_tenant_id", drop column "scope_organization_id", drop column "target_identifier", drop column "sudo_config_id", drop column "sudo_config_updated_at", drop column "verified_at";`);
-  }
-
-}