@open-mercato/enterprise 0.7.0 → 0.7.1-develop.7102.1.b41f7e3e51

package/dist/modules/security/services/SudoChallengeService.js

@@ -14,7 +14,7 @@ import {
 } from "../data/entities.js";
 import { emitSecurityEvent } from "../events.js";
 import { sudoTargets as defaultSudoTargets } from "../security.sudo.js";
-import { readSecurityModuleConfig } from "../lib/security-config.js";
+import { emitMfaEmergencyBypassActiveWarning, readSecurityModuleConfig } from "../lib/security-config.js";
 const signedSudoTokenPayloadSchema = z.object({
   sid: z.string(),
   sub: z.string(),
@@ -74,31 +74,25 @@ class SudoChallengeService {
   }
   async isProtected(targetIdentifier, tenantId, organizationId) {
     await this.ensureDeveloperDefaultsRegistered();
-    const candidates = await this.em.find(SudoChallengeConfig, {
-      targetIdentifier,
-      deletedAt: null
-    });
-    const resolved = candidates.filter((config) => this.matchesScope(config, tenantId ?? null, organizationId ?? null)).sort((left, right) => this.compareConfigPriority(left, right, tenantId ?? null, organizationId ?? null))[0];
-    if (!resolved || !resolved.isEnabled) {
-      return { protected: false };
-    }
-    return { protected: true, config: resolved };
+    return this.resolveProtection(this.em, targetIdentifier, tenantId ?? null, organizationId ?? null);
   }
   async initiate(userId, targetIdentifier, options) {
+    const user = await this.findUserScope(userId);
+    if (!user?.tenantId) {
+      throw new SudoChallengeServiceError("User not found", 404);
+    }
+    const scopeTenantId = options?.tenantId !== void 0 ? options.tenantId : user.tenantId;
+    const scopeOrganizationId = options?.organizationId !== void 0 ? options.organizationId : user.organizationId;
     const protection = await this.isProtected(
       targetIdentifier,
-      options?.tenantId ?? null,
-      options?.organizationId ?? null
+      scopeTenantId,
+      scopeOrganizationId
     );
     if (!protection.protected || !protection.config) {
       return { required: false };
     }
-    const user = await this.findUserScope(userId);
-    if (!user?.tenantId) {
-      throw new SudoChallengeServiceError("User not found", 404);
-    }
     const userMethods = await this.mfaService.getUserMethods(userId);
-    const method = this.resolveChallengeMethod(protection.config.challengeMethod, userMethods.length);
+    const method = this.resolveChallengeMethod(protection.config.challengeMethod, userMethods.length, userId, targetIdentifier);
     let sessionToken = randomBytes(16).toString("hex");
     let availableMfaMethods;
     if (method === "mfa") {
@@ -110,9 +104,15 @@ class SudoChallengeService {
     const session = this.em.create(SudoSession, {
       userId,
       tenantId: user.tenantId,
+      scopeTenantId,
+      scopeOrganizationId,
+      targetIdentifier,
+      sudoConfigId: protection.config.id,
+      sudoConfigUpdatedAt: protection.config.updatedAt,
       sessionToken,
       challengeMethod: method,
       expiresAt,
+      verifiedAt: null,
       createdAt: /* @__PURE__ */ new Date()
     });
     this.em.persist(session);
@@ -156,16 +156,27 @@ class SudoChallengeService {
     if (!user?.tenantId) {
       throw new SudoChallengeServiceError("User not found", 404);
     }
-    const scopeTenantId = options.tenantId !== void 0 ? options.tenantId : user.tenantId;
-    const scopeOrganizationId = options.organizationId !== void 0 ? options.organizationId : user.organizationId;
+    if (user.tenantId !== session.tenantId) {
+      throw new SudoChallengeServiceError("Unable to verify sudo challenge", 403);
+    }
+    const requestedTenantId = options.tenantId !== void 0 ? options.tenantId : user.tenantId;
+    const requestedOrganizationId = options.organizationId !== void 0 ? options.organizationId : user.organizationId;
+    if (options.targetIdentifier !== session.targetIdentifier || requestedTenantId !== session.scopeTenantId || requestedOrganizationId !== session.scopeOrganizationId) {
+      throw new SudoChallengeServiceError("Unable to verify sudo challenge", 403);
+    }
+    const scopeTenantId = session.scopeTenantId ?? null;
+    const scopeOrganizationId = session.scopeOrganizationId ?? null;
     const protection = await this.isProtected(
-      options.targetIdentifier,
+      session.targetIdentifier,
       scopeTenantId,
       scopeOrganizationId
     );
     if (!protection.protected || !protection.config) {
       throw new SudoChallengeServiceError("Sudo protection is not configured for this target", 404);
     }
+    if (protection.config.id !== session.sudoConfigId || protection.config.updatedAt.getTime() !== session.sudoConfigUpdatedAt?.getTime()) {
+      throw new SudoChallengeServiceError("Unable to verify sudo challenge", 403);
+    }
     let verified = false;
     let methodUsed = methodType;
     if (session.challengeMethod === "password") {
@@ -186,30 +197,65 @@ class SudoChallengeService {
         userId: session.userId,
         tenantId: user.tenantId,
         organizationId: user.organizationId,
-        targetIdentifier: options.targetIdentifier,
+        targetIdentifier: session.targetIdentifier,
         method: methodUsed
       });
       throw new SudoChallengeServiceError("Unable to verify sudo challenge", 401);
     }
-    const ttlSeconds = this.normalizeTtl(protection.config.ttlSeconds);
-    const expiresAt = new Date(Date.now() + ttlSeconds * 1e3);
-    const sudoToken = this.signToken({
-      sid: session.id,
-      sub: session.userId,
-      tid: scopeTenantId,
-      oid: scopeOrganizationId,
-      tgt: options.targetIdentifier,
-      exp: expiresAt.getTime()
+    const pendingToken = session.sessionToken;
+    const { sudoToken, expiresAt, verifiedAt } = await this.em.transactional(async (transactionalEm) => {
+      await transactionalEm.execute('lock table "sudo_challenge_configs" in share mode');
+      const currentProtection = await this.resolveProtection(
+        transactionalEm,
+        session.targetIdentifier,
+        scopeTenantId,
+        scopeOrganizationId
+      );
+      if (!currentProtection.protected || !currentProtection.config || currentProtection.config.id !== session.sudoConfigId || currentProtection.config.updatedAt.getTime() !== session.sudoConfigUpdatedAt.getTime()) {
+        throw new SudoChallengeServiceError("Unable to verify sudo challenge", 403);
+      }
+      const ttlSeconds = this.normalizeTtl(currentProtection.config.ttlSeconds);
+      const currentVerifiedAt = /* @__PURE__ */ new Date();
+      const currentExpiresAt = new Date(Date.now() + ttlSeconds * 1e3);
+      const currentSudoToken = this.signToken({
+        sid: session.id,
+        sub: session.userId,
+        tid: scopeTenantId,
+        oid: scopeOrganizationId,
+        tgt: session.targetIdentifier,
+        exp: currentExpiresAt.getTime()
+      });
+      const consumedRows = await transactionalEm.nativeUpdate(
+        SudoSession,
+        {
+          id: session.id,
+          sessionToken: pendingToken,
+          verifiedAt: null,
+          expiresAt: { $gt: currentVerifiedAt }
+        },
+        {
+          sessionToken: currentSudoToken,
+          expiresAt: currentExpiresAt,
+          verifiedAt: currentVerifiedAt
+        }
+      );
+      if (consumedRows !== 1) {
+        throw new SudoChallengeServiceError("Unable to verify sudo challenge", 400);
+      }
+      return {
+        sudoToken: currentSudoToken,
+        expiresAt: currentExpiresAt,
+        verifiedAt: currentVerifiedAt
+      };
     });
     session.sessionToken = sudoToken;
-    session.challengeMethod = methodUsed;
     session.expiresAt = expiresAt;
-    await this.em.flush();
+    session.verifiedAt = verifiedAt;
     await emitSecurityEvent("security.sudo.verified", {
       userId: session.userId,
       tenantId: scopeTenantId,
       organizationId: scopeOrganizationId,
-      targetIdentifier: options.targetIdentifier,
+      targetIdentifier: session.targetIdentifier,
       method: methodUsed,
       expiresAt: expiresAt.toISOString()
     });
@@ -227,7 +273,11 @@ class SudoChallengeService {
     const session = await this.em.findOne(SudoSession, {
       id: payload.sid,
       userId: payload.sub,
-      sessionToken: token
+      sessionToken: token,
+      targetIdentifier,
+      scopeTenantId: payload.tid,
+      scopeOrganizationId: payload.oid,
+      verifiedAt: { $ne: null }
     });
     return Boolean(session && session.expiresAt.getTime() > Date.now());
   }
@@ -322,12 +372,17 @@ class SudoChallengeService {
       isDeveloperDefault: true
     });
     if (existing) {
-      existing.isEnabled = true;
-      existing.deletedAt = null;
-      existing.ttlSeconds = this.normalizeTtl(input.ttlSeconds);
-      existing.challengeMethod = input.challengeMethod ?? ChallengeMethod.AUTO;
-      existing.updatedAt = /* @__PURE__ */ new Date();
-      await this.em.flush();
+      const ttlSeconds = this.normalizeTtl(input.ttlSeconds);
+      const challengeMethod = input.challengeMethod ?? ChallengeMethod.AUTO;
+      const changed = !existing.isEnabled || Boolean(existing.deletedAt) || existing.ttlSeconds !== ttlSeconds || existing.challengeMethod !== challengeMethod;
+      if (changed) {
+        existing.isEnabled = true;
+        existing.deletedAt = null;
+        existing.ttlSeconds = ttlSeconds;
+        existing.challengeMethod = challengeMethod;
+        existing.updatedAt = /* @__PURE__ */ new Date();
+        await this.em.flush();
+      }
       return;
     }
     const config = this.em.create(SudoChallengeConfig, {
@@ -405,10 +460,27 @@ class SudoChallengeService {
       throw new SudoChallengeServiceError("Sudo configuration not found", 404);
     }
   }
-  resolveChallengeMethod(configuredMethod, availableMfaMethodCount) {
+  resolveChallengeMethod(configuredMethod, availableMfaMethodCount, userId, targetIdentifier) {
     if (this.securityConfig.mfa.emergencyBypass) {
+      let wouldHaveBeenMfa = false;
+      try {
+        wouldHaveBeenMfa = this.resolveChallengeMethodWithoutBypass(configuredMethod, availableMfaMethodCount) === "mfa";
+      } catch {
+        wouldHaveBeenMfa = configuredMethod === ChallengeMethod.MFA;
+      }
+      if (wouldHaveBeenMfa) {
+        emitMfaEmergencyBypassActiveWarning("sudo challenge downgraded to password", {
+          configuredMethod,
+          availableMfaMethodCount,
+          userId,
+          targetIdentifier
+        });
+      }
       return "password";
     }
+    return this.resolveChallengeMethodWithoutBypass(configuredMethod, availableMfaMethodCount);
+  }
+  resolveChallengeMethodWithoutBypass(configuredMethod, availableMfaMethodCount) {
     if (configuredMethod === ChallengeMethod.PASSWORD) return "password";
     if (configuredMethod === ChallengeMethod.MFA) {
       if (availableMfaMethodCount === 0) {
@@ -418,6 +490,17 @@ class SudoChallengeService {
     }
     return availableMfaMethodCount > 0 ? "mfa" : "password";
   }
+  async resolveProtection(em, targetIdentifier, tenantId, organizationId) {
+    const candidates = await em.find(SudoChallengeConfig, {
+      targetIdentifier,
+      deletedAt: null
+    });
+    const resolved = candidates.filter((config) => this.matchesScope(config, tenantId, organizationId)).sort((left, right) => this.compareConfigPriority(left, right, tenantId, organizationId))[0];
+    if (!resolved || !resolved.isEnabled) {
+      return { protected: false };
+    }
+    return { protected: true, config: resolved };
+  }
   matchesScope(config, tenantId, organizationId) {
     if (config.organizationId) {
       return config.organizationId === organizationId && config.tenantId === tenantId;
@@ -448,6 +531,12 @@ class SudoChallengeService {
     if (!session) {
       throw new SudoChallengeServiceError("Sudo challenge session not found", 404);
     }
+    if (!session.targetIdentifier || !session.sudoConfigId || !session.sudoConfigUpdatedAt) {
+      throw new SudoChallengeServiceError("Sudo challenge session not found", 404);
+    }
+    if (session.verifiedAt) {
+      throw new SudoChallengeServiceError("Unable to verify sudo challenge", 400);
+    }
     if (session.expiresAt.getTime() <= Date.now()) {
       throw new SudoChallengeServiceError("Sudo challenge session expired", 400);
     }

package/dist/modules/security/services/SudoChallengeService.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/security/services/SudoChallengeService.ts"],
-  "sourcesContent": ["import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto'\nimport { z } from 'zod'\nimport type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport { User } from '@open-mercato/core/modules/auth/data/entities'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  dedupeSudoTargets,\n  getSecuritySudoTargetEntries,\n  type SecuritySudoTarget,\n} from '../lib/module-security-registry'\nimport {\n  ChallengeMethod,\n  SudoChallengeConfig,\n  SudoChallengeMethodUsed,\n  SudoSession,\n} from '../data/entities'\nimport { emitSecurityEvent } from '../events'\nimport type {\n  SudoConfigInput,\n  SudoConfigUpdateInput,\n} from '../data/validators'\nimport type { PasswordService } from './PasswordService'\nimport type { MfaService } from './MfaService'\nimport type { MfaVerificationService } from './MfaVerificationService'\nimport { sudoTargets as defaultSudoTargets } from '../security.sudo'\nimport type { SecurityModuleConfig } from '../lib/security-config'\nimport { readSecurityModuleConfig } from '../lib/security-config'\n\ntype SudoMethod = 'password' | 'mfa'\n\nexport type SudoAvailableMethod = {\n  type: string\n  label: string\n  icon: string\n}\n\nexport type SudoProtectionResolution = {\n  protected: boolean\n  config?: SudoChallengeConfig\n}\n\nconst signedSudoTokenPayloadSchema = z.object({\n  sid: z.string(),\n  sub: z.string(),\n  tid: z.string().nullable(),\n  oid: z.string().nullable(),\n  tgt: z.string(),\n  exp: z.number(),\n})\n\ntype SignedSudoTokenPayload = z.infer<typeof signedSudoTokenPayloadSchema>\n\ntype UserScope = {\n  id: string\n  tenantId: string | null\n  organizationId: string | null\n}\n\nexport type SudoAuthScope = {\n  tenantId: string | null\n  organizationId?: string | null\n  isSuperAdmin?: boolean\n}\n\ntype DeveloperDefaultPayload = {\n  targetIdentifier: string\n  label?: string | null\n  ttlSeconds?: number\n  challengeMethod?: ChallengeMethod\n}\n\nfunction readTrimmedEnv(value: string | undefined): string | undefined {\n  const trimmed = value?.trim()\n  return trimmed ? trimmed : undefined\n}\n\nexport class SudoChallengeServiceError extends Error {\n  constructor(\n    message: string,\n    public readonly statusCode: number,\n  ) {\n    super(message)\n    this.name = 'SudoChallengeServiceError'\n  }\n}\n\nexport class SudoChallengeService {\n  constructor(\n    private readonly em: EntityManager,\n    private readonly passwordService: PasswordService,\n    private readonly mfaService: MfaService,\n    private readonly mfaVerificationService: MfaVerificationService,\n    private readonly securityConfig: SecurityModuleConfig = readSecurityModuleConfig(),\n  ) {}\n\n  async listConfigs(scope?: SudoAuthScope): Promise<SudoChallengeConfig[]> {\n    await this.ensureDeveloperDefaultsRegistered()\n    const filter: FilterQuery<SudoChallengeConfig> = { deletedAt: null }\n    if (scope && !scope.isSuperAdmin) {\n      if (!scope.tenantId) return []\n      ;(filter as Record<string, unknown>).$or = [\n        { tenantId: scope.tenantId },\n        { tenantId: null },\n      ]\n    }\n    return this.em.find(\n      SudoChallengeConfig,\n      filter,\n      {\n        orderBy: {\n          targetIdentifier: 'asc',\n          tenantId: 'asc',\n          organizationId: 'asc',\n          createdAt: 'asc',\n        },\n      },\n    )\n  }\n\n  async getConfigById(id: string, scope?: SudoAuthScope): Promise<SudoChallengeConfig | null> {\n    await this.ensureDeveloperDefaultsRegistered()\n    const config = await this.em.findOne(SudoChallengeConfig, { id, deletedAt: null })\n    if (!config) return null\n    if (scope && !this.isConfigVisibleToScope(config, scope)) return null\n    return config\n  }\n\n  async isProtected(\n    targetIdentifier: string,\n    tenantId?: string | null,\n    organizationId?: string | null,\n  ): Promise<SudoProtectionResolution> {\n    await this.ensureDeveloperDefaultsRegistered()\n\n    const candidates = await this.em.find(SudoChallengeConfig, {\n      targetIdentifier,\n      deletedAt: null,\n    })\n\n    const resolved = candidates\n      .filter((config) => this.matchesScope(config, tenantId ?? null, organizationId ?? null))\n      .sort((left, right) => this.compareConfigPriority(left, right, tenantId ?? null, organizationId ?? null))[0]\n\n    if (!resolved || !resolved.isEnabled) {\n      return { protected: false }\n    }\n\n    return { protected: true, config: resolved }\n  }\n\n  async initiate(\n    userId: string,\n    targetIdentifier: string,\n    options?: { tenantId?: string | null; organizationId?: string | null },\n  ): Promise<{\n    required: boolean\n    sessionId?: string\n    method?: SudoMethod\n    availableMfaMethods?: SudoAvailableMethod[]\n    expiresAt?: Date\n  }> {\n    const protection = await this.isProtected(\n      targetIdentifier,\n      options?.tenantId ?? null,\n      options?.organizationId ?? null,\n    )\n\n    if (!protection.protected || !protection.config) {\n      return { required: false }\n    }\n\n    const user = await this.findUserScope(userId)\n    if (!user?.tenantId) {\n      throw new SudoChallengeServiceError('User not found', 404)\n    }\n\n    const userMethods = await this.mfaService.getUserMethods(userId)\n    const method = this.resolveChallengeMethod(protection.config.challengeMethod, userMethods.length)\n\n    let sessionToken = randomBytes(16).toString('hex')\n    let availableMfaMethods: SudoAvailableMethod[] | undefined\n    if (method === 'mfa') {\n      const challenge = await this.mfaVerificationService.createChallenge(userId)\n      sessionToken = challenge.challengeId\n      availableMfaMethods = challenge.availableMethods\n    }\n\n    const expiresAt = new Date(Date.now() + this.securityConfig.sudo.pendingChallengeTtlMs)\n    const session = this.em.create(SudoSession, {\n      userId,\n      tenantId: user.tenantId,\n      sessionToken,\n      challengeMethod: method,\n      expiresAt,\n      createdAt: new Date(),\n    })\n    this.em.persist(session)\n    await this.em.flush()\n\n    await emitSecurityEvent('security.sudo.challenged', {\n      userId,\n      tenantId: user.tenantId,\n      organizationId: user.organizationId,\n      targetIdentifier,\n      method,\n    })\n\n    return {\n      required: true,\n      sessionId: session.id,\n      method,\n      availableMfaMethods,\n      expiresAt,\n    }\n  }\n\n  async prepare(\n    sessionId: string,\n    methodType: string,\n    options: { expectedUserId?: string } = {},\n    request?: Request,\n  ): Promise<{ clientData?: Record<string, unknown> }> {\n    const session = await this.getPendingSession(sessionId)\n    if (options.expectedUserId && session.userId !== options.expectedUserId) {\n      throw new SudoChallengeServiceError('Sudo challenge user mismatch', 403)\n    }\n    if (session.challengeMethod !== 'mfa') {\n      throw new SudoChallengeServiceError('This sudo session does not require MFA', 400)\n    }\n    return this.mfaVerificationService.prepareChallenge(\n      session.sessionToken,\n      methodType,\n      { request },\n      { userId: session.userId },\n    )\n  }\n\n  async verify(\n    sessionId: string,\n    methodType: string,\n    payload: unknown,\n    options: {\n      expectedUserId?: string\n      tenantId?: string | null\n      organizationId?: string | null\n      targetIdentifier: string\n    },\n    request?: Request,\n  ): Promise<{ sudoToken: string; expiresAt: Date }> {\n    const session = await this.getPendingSession(sessionId)\n    if (options.expectedUserId && session.userId !== options.expectedUserId) {\n      throw new SudoChallengeServiceError('Sudo challenge user mismatch', 403)\n    }\n    const user = await this.findUserScope(session.userId)\n    if (!user?.tenantId) {\n      throw new SudoChallengeServiceError('User not found', 404)\n    }\n\n    const scopeTenantId = options.tenantId !== undefined ? options.tenantId : user.tenantId\n    const scopeOrganizationId = options.organizationId !== undefined ? options.organizationId : user.organizationId\n    const protection = await this.isProtected(\n      options.targetIdentifier,\n      scopeTenantId,\n      scopeOrganizationId,\n    )\n    if (!protection.protected || !protection.config) {\n      throw new SudoChallengeServiceError('Sudo protection is not configured for this target', 404)\n    }\n\n    let verified = false\n    let methodUsed: string = methodType\n    if (session.challengeMethod === 'password') {\n      const password = this.readPassword(payload)\n      verified = await this.passwordService.verifyPassword(session.userId, password)\n      methodUsed = SudoChallengeMethodUsed.PASSWORD\n    } else {\n      verified = await this.mfaVerificationService.verifyChallenge(\n        session.sessionToken,\n        methodType,\n        payload,\n        { request },\n        { userId: session.userId },\n      )\n    }\n\n    if (!verified) {\n      await emitSecurityEvent('security.sudo.failed', {\n        userId: session.userId,\n        tenantId: user.tenantId,\n        organizationId: user.organizationId,\n        targetIdentifier: options.targetIdentifier,\n        method: methodUsed,\n      })\n      throw new SudoChallengeServiceError('Unable to verify sudo challenge', 401)\n    }\n\n    const ttlSeconds = this.normalizeTtl(protection.config.ttlSeconds)\n    const expiresAt = new Date(Date.now() + ttlSeconds * 1000)\n    const sudoToken = this.signToken({\n      sid: session.id,\n      sub: session.userId,\n      tid: scopeTenantId,\n      oid: scopeOrganizationId,\n      tgt: options.targetIdentifier,\n      exp: expiresAt.getTime(),\n    })\n\n    session.sessionToken = sudoToken\n    session.challengeMethod = methodUsed\n    session.expiresAt = expiresAt\n    await this.em.flush()\n\n    await emitSecurityEvent('security.sudo.verified', {\n      userId: session.userId,\n      tenantId: scopeTenantId,\n      organizationId: scopeOrganizationId,\n      targetIdentifier: options.targetIdentifier,\n      method: methodUsed,\n      expiresAt: expiresAt.toISOString(),\n    })\n\n    return { sudoToken, expiresAt }\n  }\n\n  async validateToken(\n    token: string,\n    targetIdentifier: string,\n    options?: {\n      expectedUserId?: string\n      tenantId?: string | null\n      organizationId?: string | null\n    },\n  ): Promise<boolean> {\n    if (!token) return false\n    const payload = this.readSignedToken(token)\n    if (!payload) return false\n    if (payload.exp <= Date.now()) return false\n    if (payload.tgt !== targetIdentifier) return false\n    if (options?.expectedUserId && payload.sub !== options.expectedUserId) return false\n    if (options?.tenantId !== undefined && payload.tid !== (options.tenantId ?? null)) return false\n    if (options?.organizationId !== undefined && payload.oid !== (options.organizationId ?? null)) return false\n\n    const session = await this.em.findOne(SudoSession, {\n      id: payload.sid,\n      userId: payload.sub,\n      sessionToken: token,\n    } as FilterQuery<SudoSession>)\n\n    return Boolean(session && session.expiresAt.getTime() > Date.now())\n  }\n\n  async createConfig(\n    input: SudoConfigInput,\n    configuredBy: string,\n    scope?: SudoAuthScope,\n  ): Promise<SudoChallengeConfig> {\n    await this.ensureDeveloperDefaultsRegistered()\n    const inputTenantId = input.tenantId ?? null\n    const inputOrganizationId = input.organizationId ?? null\n    this.validateScope(inputTenantId, inputOrganizationId)\n    if (scope) this.assertWriteScope(inputTenantId, inputOrganizationId, scope)\n    await this.ensureUniqueConfig(input.targetIdentifier, inputTenantId, inputOrganizationId)\n\n    const config = this.em.create(SudoChallengeConfig, {\n      tenantId: inputTenantId,\n      organizationId: inputOrganizationId,\n      label: input.label ?? null,\n      targetIdentifier: input.targetIdentifier,\n      isEnabled: input.isEnabled,\n      ttlSeconds: this.normalizeTtl(input.ttlSeconds),\n      challengeMethod: input.challengeMethod,\n      configuredBy,\n      isDeveloperDefault: false,\n      createdAt: new Date(),\n      updatedAt: new Date(),\n    })\n    this.em.persist(config)\n    await this.em.flush()\n\n    await emitSecurityEvent('security.sudo.config.created', {\n      id: config.id,\n      targetIdentifier: config.targetIdentifier,\n      configuredBy,\n    })\n\n    return config\n  }\n\n  async updateConfig(\n    id: string,\n    input: SudoConfigUpdateInput,\n    configuredBy: string,\n    scope?: SudoAuthScope,\n  ): Promise<SudoChallengeConfig> {\n    await this.ensureDeveloperDefaultsRegistered()\n    const config = await this.em.findOne(SudoChallengeConfig, { id, deletedAt: null })\n    if (!config) {\n      throw new SudoChallengeServiceError('Sudo configuration not found', 404)\n    }\n    if (scope) {\n      this.assertWriteScope(config.tenantId ?? null, config.organizationId ?? null, scope)\n      if (config.isDeveloperDefault && !scope.isSuperAdmin) {\n        throw new SudoChallengeServiceError('Sudo configuration not found', 404)\n      }\n    }\n\n    const nextTenantId = input.tenantId !== undefined ? input.tenantId ?? null : config.tenantId ?? null\n    const nextOrganizationId = input.organizationId !== undefined ? input.organizationId ?? null : config.organizationId ?? null\n    const nextTargetIdentifier = input.targetIdentifier ?? config.targetIdentifier\n    this.validateScope(nextTenantId, nextOrganizationId)\n    if (scope) this.assertWriteScope(nextTenantId, nextOrganizationId, scope)\n    await this.ensureUniqueConfig(nextTargetIdentifier, nextTenantId, nextOrganizationId, config.id)\n\n    if (input.tenantId !== undefined) config.tenantId = input.tenantId ?? null\n    if (input.organizationId !== undefined) config.organizationId = input.organizationId ?? null\n    if (input.label !== undefined) config.label = input.label ?? null\n    if (input.targetIdentifier !== undefined) config.targetIdentifier = input.targetIdentifier\n    if (input.isEnabled !== undefined) config.isEnabled = input.isEnabled\n    if (input.ttlSeconds !== undefined) config.ttlSeconds = this.normalizeTtl(input.ttlSeconds)\n    if (input.challengeMethod !== undefined) config.challengeMethod = input.challengeMethod\n    config.configuredBy = configuredBy\n    config.updatedAt = new Date()\n    await this.em.flush()\n\n    await emitSecurityEvent('security.sudo.config.updated', {\n      id: config.id,\n      targetIdentifier: config.targetIdentifier,\n      configuredBy,\n    })\n\n    return config\n  }\n\n  async deleteConfig(id: string, scope?: SudoAuthScope): Promise<void> {\n    const config = await this.em.findOne(SudoChallengeConfig, { id, deletedAt: null })\n    if (!config) {\n      throw new SudoChallengeServiceError('Sudo configuration not found', 404)\n    }\n    if (scope) {\n      this.assertWriteScope(config.tenantId ?? null, config.organizationId ?? null, scope)\n      if (config.isDeveloperDefault && !scope.isSuperAdmin) {\n        throw new SudoChallengeServiceError('Sudo configuration not found', 404)\n      }\n    }\n    config.deletedAt = new Date()\n    config.updatedAt = new Date()\n    await this.em.flush()\n\n    await emitSecurityEvent('security.sudo.config.deleted', {\n      id: config.id,\n      targetIdentifier: config.targetIdentifier,\n    })\n  }\n\n  async registerDeveloperDefault(\n    input: DeveloperDefaultPayload,\n  ): Promise<void> {\n    const existing = await this.em.findOne(SudoChallengeConfig, {\n      targetIdentifier: input.targetIdentifier,\n      tenantId: null,\n      organizationId: null,\n      isDeveloperDefault: true,\n    })\n\n    if (existing) {\n      existing.isEnabled = true\n      existing.deletedAt = null\n      existing.ttlSeconds = this.normalizeTtl(input.ttlSeconds)\n      existing.challengeMethod = input.challengeMethod ?? ChallengeMethod.AUTO\n      existing.updatedAt = new Date()\n      await this.em.flush()\n      return\n    }\n\n    const config = this.em.create(SudoChallengeConfig, {\n      tenantId: null,\n      organizationId: null,\n      label: input.label ?? null,\n      targetIdentifier: input.targetIdentifier,\n      isEnabled: true,\n      isDeveloperDefault: true,\n      ttlSeconds: this.normalizeTtl(input.ttlSeconds),\n      challengeMethod: input.challengeMethod ?? ChallengeMethod.AUTO,\n      configuredBy: null,\n      createdAt: new Date(),\n      updatedAt: new Date(),\n    })\n    this.em.persist(config)\n    await this.em.flush()\n  }\n\n  async cleanupExpired(): Promise<number> {\n    return this.em.nativeDelete(SudoSession, {\n      expiresAt: { $lte: new Date() },\n    })\n  }\n\n  private async ensureDeveloperDefaultsRegistered(): Promise<void> {\n    const registryEntries = getSecuritySudoTargetEntries()\n    const registryTargets = registryEntries.flatMap((entry) => entry.targets ?? [])\n    const fallbackTargets = registryEntries.length === 0 ? defaultSudoTargets : []\n\n    for (const target of dedupeSudoTargets([\n      ...registryTargets,\n      ...fallbackTargets,\n    ])) {\n      await this.registerDeveloperDefault(this.readDeveloperDefault(target))\n    }\n  }\n\n  private readDeveloperDefault(target: SecuritySudoTarget): DeveloperDefaultPayload {\n    return {\n      targetIdentifier: target.identifier,\n      label: target.label ?? null,\n      ttlSeconds: target.ttlSeconds,\n      challengeMethod: this.toChallengeMethod(target.challengeMethod),\n    }\n  }\n\n  private async ensureUniqueConfig(\n    targetIdentifier: string,\n    tenantId: string | null,\n    organizationId: string | null,\n    ignoreId?: string,\n  ): Promise<void> {\n    const existing = await this.em.findOne(SudoChallengeConfig, {\n      targetIdentifier,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })\n    if (existing && existing.id !== ignoreId) {\n      throw new SudoChallengeServiceError('A sudo configuration for this target and scope already exists', 409)\n    }\n  }\n\n  private validateScope(tenantId: string | null, organizationId: string | null): void {\n    if (organizationId && !tenantId) {\n      throw new SudoChallengeServiceError('Organization-scoped sudo config requires a tenant', 400)\n    }\n  }\n\n  private isConfigVisibleToScope(config: SudoChallengeConfig, scope: SudoAuthScope): boolean {\n    if (scope.isSuperAdmin) return true\n    if (!scope.tenantId) return false\n    const configTenantId = config.tenantId ?? null\n    if (configTenantId === null) return true\n    return configTenantId === scope.tenantId\n  }\n\n  private assertWriteScope(\n    targetTenantId: string | null,\n    targetOrganizationId: string | null,\n    scope: SudoAuthScope,\n  ): void {\n    if (scope.isSuperAdmin) return\n    if (!scope.tenantId) {\n      throw new SudoChallengeServiceError('Sudo configuration not found', 404)\n    }\n    if ((targetTenantId ?? null) !== scope.tenantId) {\n      throw new SudoChallengeServiceError('Sudo configuration not found', 404)\n    }\n    if (\n      scope.organizationId !== undefined\n      && scope.organizationId !== null\n      && targetOrganizationId !== null\n      && targetOrganizationId !== scope.organizationId\n    ) {\n      throw new SudoChallengeServiceError('Sudo configuration not found', 404)\n    }\n  }\n\n  private resolveChallengeMethod(\n    configuredMethod: ChallengeMethod,\n    availableMfaMethodCount: number,\n  ): SudoMethod {\n    if (this.securityConfig.mfa.emergencyBypass) {\n      return 'password'\n    }\n    if (configuredMethod === ChallengeMethod.PASSWORD) return 'password'\n    if (configuredMethod === ChallengeMethod.MFA) {\n      if (availableMfaMethodCount === 0) {\n        throw new SudoChallengeServiceError('This sudo target requires MFA, but no MFA methods are configured', 400)\n      }\n      return 'mfa'\n    }\n    return availableMfaMethodCount > 0 ? 'mfa' : 'password'\n  }\n\n  private matchesScope(config: SudoChallengeConfig, tenantId: string | null, organizationId: string | null): boolean {\n    if (config.organizationId) {\n      return config.organizationId === organizationId && config.tenantId === tenantId\n    }\n    if (config.tenantId) {\n      return config.tenantId === tenantId\n    }\n    return true\n  }\n\n  private compareConfigPriority(\n    left: SudoChallengeConfig,\n    right: SudoChallengeConfig,\n    tenantId: string | null,\n    organizationId: string | null,\n  ): number {\n    const leftScore = this.getScopePriority(left, tenantId, organizationId)\n    const rightScore = this.getScopePriority(right, tenantId, organizationId)\n    if (leftScore !== rightScore) return leftScore - rightScore\n    if (left.isDeveloperDefault !== right.isDeveloperDefault) {\n      return left.isDeveloperDefault ? 1 : -1\n    }\n    return right.updatedAt.getTime() - left.updatedAt.getTime()\n  }\n\n  private getScopePriority(\n    config: SudoChallengeConfig,\n    tenantId: string | null,\n    organizationId: string | null,\n  ): number {\n    if (config.organizationId === organizationId && config.tenantId === tenantId) return 0\n    if (!config.organizationId && config.tenantId === tenantId) return 1\n    if (!config.organizationId && !config.tenantId && !config.isDeveloperDefault) return 2\n    if (!config.organizationId && !config.tenantId && config.isDeveloperDefault) return 3\n    return 4\n  }\n\n  private async getPendingSession(sessionId: string): Promise<SudoSession> {\n    const session = await this.em.findOne(SudoSession, { id: sessionId })\n    if (!session) {\n      throw new SudoChallengeServiceError('Sudo challenge session not found', 404)\n    }\n    if (session.expiresAt.getTime() <= Date.now()) {\n      throw new SudoChallengeServiceError('Sudo challenge session expired', 400)\n    }\n    return session\n  }\n\n  private async findUserScope(userId: string): Promise<UserScope | null> {\n    const user = await findOneWithDecryption(\n      this.em,\n      User,\n      { id: userId, deletedAt: null },\n      undefined,\n      {},\n    )\n\n    if (!user) return null\n    return {\n      id: String(user.id),\n      tenantId: user.tenantId ? String(user.tenantId) : null,\n      organizationId: user.organizationId ? String(user.organizationId) : null,\n    }\n  }\n\n  private normalizeTtl(value?: number | null): number {\n    const rawValue = value ?? this.securityConfig.sudo.defaultTtlSeconds\n    return Math.min(\n      Math.max(rawValue, this.securityConfig.sudo.minTtlSeconds),\n      this.securityConfig.sudo.maxTtlSeconds,\n    )\n  }\n\n  private readPassword(payload: unknown): string {\n    if (!payload || typeof payload !== 'object') {\n      throw new SudoChallengeServiceError('Password is required', 400)\n    }\n    const maybePassword = (payload as Record<string, unknown>).password\n    if (typeof maybePassword !== 'string' || maybePassword.trim().length === 0) {\n      throw new SudoChallengeServiceError('Password is required', 400)\n    }\n    return maybePassword\n  }\n\n  private signToken(payload: SignedSudoTokenPayload): string {\n    const encodedPayload = Buffer.from(JSON.stringify(payload)).toString('base64url')\n    const signature = createHmac('sha256', this.getSudoSecret()).update(encodedPayload).digest('base64url')\n    return `${encodedPayload}.${signature}`\n  }\n\n  private readSignedToken(token: string): SignedSudoTokenPayload | null {\n    const [encodedPayload, signature] = token.split('.')\n    if (!encodedPayload || !signature) return null\n\n    const expected = createHmac('sha256', this.getSudoSecret()).update(encodedPayload).digest('base64url')\n    const signatureBuffer = Buffer.from(signature)\n    const expectedBuffer = Buffer.from(expected)\n    if (signatureBuffer.length !== expectedBuffer.length) return null\n    if (!timingSafeEqual(signatureBuffer, expectedBuffer)) return null\n\n    try {\n      const parsed = signedSudoTokenPayloadSchema.safeParse(\n        JSON.parse(Buffer.from(encodedPayload, 'base64url').toString('utf8')),\n      )\n      if (!parsed.success) return null\n      return parsed.data\n    } catch {\n      return null\n    }\n  }\n\n  private getSudoSecret(): string {\n    const secret =\n      readTrimmedEnv(process.env.OM_SECURITY_SUDO_SECRET)\n      ?? readTrimmedEnv(process.env.AUTH_JWT_SECRET)\n      ?? readTrimmedEnv(process.env.AUTH_SECRET)\n      ?? readTrimmedEnv(process.env.JWT_SECRET)\n    if (secret) return secret\n    throw new Error(\n      'Sudo step-up tokens require OM_SECURITY_SUDO_SECRET, AUTH_JWT_SECRET, AUTH_SECRET, or JWT_SECRET to be set.',\n    )\n  }\n\n  private toChallengeMethod(\n    method: SecuritySudoTarget['challengeMethod'],\n  ): ChallengeMethod | undefined {\n    switch (method) {\n      case 'password':\n        return ChallengeMethod.PASSWORD\n      case 'mfa':\n        return ChallengeMethod.MFA\n      case 'auto':\n      default:\n        return ChallengeMethod.AUTO\n    }\n  }\n}\n\nexport default SudoChallengeService\n"],
-  "mappings": "AAAA,SAAS,YAAY,aAAa,uBAAuB;AACzD,SAAS,SAAS;AAElB,SAAS,YAAY;AACrB,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,yBAAyB;AAQlC,SAAS,eAAe,0BAA0B;AAElD,SAAS,gCAAgC;AAezC,MAAM,+BAA+B,EAAE,OAAO;AAAA,EAC5C,KAAK,EAAE,OAAO;AAAA,EACd,KAAK,EAAE,OAAO;AAAA,EACd,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,EACzB,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,EACzB,KAAK,EAAE,OAAO;AAAA,EACd,KAAK,EAAE,OAAO;AAChB,CAAC;AAuBD,SAAS,eAAe,OAA+C;AACrE,QAAM,UAAU,OAAO,KAAK;AAC5B,SAAO,UAAU,UAAU;AAC7B;AAEO,MAAM,kCAAkC,MAAM;AAAA,EACnD,YACE,SACgB,YAChB;AACA,UAAM,OAAO;AAFG;AAGhB,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,qBAAqB;AAAA,EAChC,YACmB,IACA,iBACA,YACA,wBACA,iBAAuC,yBAAyB,GACjF;AALiB;AACA;AACA;AACA;AACA;AAAA,EAChB;AAAA,EAEH,MAAM,YAAY,OAAuD;AACvE,UAAM,KAAK,kCAAkC;AAC7C,UAAM,SAA2C,EAAE,WAAW,KAAK;AACnE,QAAI,SAAS,CAAC,MAAM,cAAc;AAChC,UAAI,CAAC,MAAM,SAAU,QAAO,CAAC;AAC5B,MAAC,OAAmC,MAAM;AAAA,QACzC,EAAE,UAAU,MAAM,SAAS;AAAA,QAC3B,EAAE,UAAU,KAAK;AAAA,MACnB;AAAA,IACF;AACA,WAAO,KAAK,GAAG;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,QACE,SAAS;AAAA,UACP,kBAAkB;AAAA,UAClB,UAAU;AAAA,UACV,gBAAgB;AAAA,UAChB,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,cAAc,IAAY,OAA4D;AAC1F,UAAM,KAAK,kCAAkC;AAC7C,UAAM,SAAS,MAAM,KAAK,GAAG,QAAQ,qBAAqB,EAAE,IAAI,WAAW,KAAK,CAAC;AACjF,QAAI,CAAC,OAAQ,QAAO;AACpB,QAAI,SAAS,CAAC,KAAK,uBAAuB,QAAQ,KAAK,EAAG,QAAO;AACjE,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,YACJ,kBACA,UACA,gBACmC;AACnC,UAAM,KAAK,kCAAkC;AAE7C,UAAM,aAAa,MAAM,KAAK,GAAG,KAAK,qBAAqB;AAAA,MACzD;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AAED,UAAM,WAAW,WACd,OAAO,CAAC,WAAW,KAAK,aAAa,QAAQ,YAAY,MAAM,kBAAkB,IAAI,CAAC,EACtF,KAAK,CAAC,MAAM,UAAU,KAAK,sBAAsB,MAAM,OAAO,YAAY,MAAM,kBAAkB,IAAI,CAAC,EAAE,CAAC;AAE7G,QAAI,CAAC,YAAY,CAAC,SAAS,WAAW;AACpC,aAAO,EAAE,WAAW,MAAM;AAAA,IAC5B;AAEA,WAAO,EAAE,WAAW,MAAM,QAAQ,SAAS;AAAA,EAC7C;AAAA,EAEA,MAAM,SACJ,QACA,kBACA,SAOC;AACD,UAAM,aAAa,MAAM,KAAK;AAAA,MAC5B;AAAA,MACA,SAAS,YAAY;AAAA,MACrB,SAAS,kBAAkB;AAAA,IAC7B;AAEA,QAAI,CAAC,WAAW,aAAa,CAAC,WAAW,QAAQ;AAC/C,aAAO,EAAE,UAAU,MAAM;AAAA,IAC3B;AAEA,UAAM,OAAO,MAAM,KAAK,cAAc,MAAM;AAC5C,QAAI,CAAC,MAAM,UAAU;AACnB,YAAM,IAAI,0BAA0B,kBAAkB,GAAG;AAAA,IAC3D;AAEA,UAAM,cAAc,MAAM,KAAK,WAAW,eAAe,MAAM;AAC/D,UAAM,SAAS,KAAK,uBAAuB,WAAW,OAAO,iBAAiB,YAAY,MAAM;AAEhG,QAAI,eAAe,YAAY,EAAE,EAAE,SAAS,KAAK;AACjD,QAAI;AACJ,QAAI,WAAW,OAAO;AACpB,YAAM,YAAY,MAAM,KAAK,uBAAuB,gBAAgB,MAAM;AAC1E,qBAAe,UAAU;AACzB,4BAAsB,UAAU;AAAA,IAClC;AAEA,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,eAAe,KAAK,qBAAqB;AACtF,UAAM,UAAU,KAAK,GAAG,OAAO,aAAa;AAAA,MAC1C;AAAA,MACA,UAAU,KAAK;AAAA,MACf;AAAA,MACA,iBAAiB;AAAA,MACjB;AAAA,MACA,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AACD,SAAK,GAAG,QAAQ,OAAO;AACvB,UAAM,KAAK,GAAG,MAAM;AAEpB,UAAM,kBAAkB,4BAA4B;AAAA,MAClD;AAAA,MACA,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB;AAAA,MACA;AAAA,IACF,CAAC;AAED,WAAO;AAAA,MACL,UAAU;AAAA,MACV,WAAW,QAAQ;AAAA,MACnB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,QACJ,WACA,YACA,UAAuC,CAAC,GACxC,SACmD;AACnD,UAAM,UAAU,MAAM,KAAK,kBAAkB,SAAS;AACtD,QAAI,QAAQ,kBAAkB,QAAQ,WAAW,QAAQ,gBAAgB;AACvE,YAAM,IAAI,0BAA0B,gCAAgC,GAAG;AAAA,IACzE;AACA,QAAI,QAAQ,oBAAoB,OAAO;AACrC,YAAM,IAAI,0BAA0B,0CAA0C,GAAG;AAAA,IACnF;AACA,WAAO,KAAK,uBAAuB;AAAA,MACjC,QAAQ;AAAA,MACR;AAAA,MACA,EAAE,QAAQ;AAAA,MACV,EAAE,QAAQ,QAAQ,OAAO;AAAA,IAC3B;AAAA,EACF;AAAA,EAEA,MAAM,OACJ,WACA,YACA,SACA,SAMA,SACiD;AACjD,UAAM,UAAU,MAAM,KAAK,kBAAkB,SAAS;AACtD,QAAI,QAAQ,kBAAkB,QAAQ,WAAW,QAAQ,gBAAgB;AACvE,YAAM,IAAI,0BAA0B,gCAAgC,GAAG;AAAA,IACzE;AACA,UAAM,OAAO,MAAM,KAAK,cAAc,QAAQ,MAAM;AACpD,QAAI,CAAC,MAAM,UAAU;AACnB,YAAM,IAAI,0BAA0B,kBAAkB,GAAG;AAAA,IAC3D;AAEA,UAAM,gBAAgB,QAAQ,aAAa,SAAY,QAAQ,WAAW,KAAK;AAC/E,UAAM,sBAAsB,QAAQ,mBAAmB,SAAY,QAAQ,iBAAiB,KAAK;AACjG,UAAM,aAAa,MAAM,KAAK;AAAA,MAC5B,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,WAAW,aAAa,CAAC,WAAW,QAAQ;AAC/C,YAAM,IAAI,0BAA0B,qDAAqD,GAAG;AAAA,IAC9F;AAEA,QAAI,WAAW;AACf,QAAI,aAAqB;AACzB,QAAI,QAAQ,oBAAoB,YAAY;AAC1C,YAAM,WAAW,KAAK,aAAa,OAAO;AAC1C,iBAAW,MAAM,KAAK,gBAAgB,eAAe,QAAQ,QAAQ,QAAQ;AAC7E,mBAAa,wBAAwB;AAAA,IACvC,OAAO;AACL,iBAAW,MAAM,KAAK,uBAAuB;AAAA,QAC3C,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA,EAAE,QAAQ;AAAA,QACV,EAAE,QAAQ,QAAQ,OAAO;AAAA,MAC3B;AAAA,IACF;AAEA,QAAI,CAAC,UAAU;AACb,YAAM,kBAAkB,wBAAwB;AAAA,QAC9C,QAAQ,QAAQ;AAAA,QAChB,UAAU,KAAK;AAAA,QACf,gBAAgB,KAAK;AAAA,QACrB,kBAAkB,QAAQ;AAAA,QAC1B,QAAQ;AAAA,MACV,CAAC;AACD,YAAM,IAAI,0BAA0B,mCAAmC,GAAG;AAAA,IAC5E;AAEA,UAAM,aAAa,KAAK,aAAa,WAAW,OAAO,UAAU;AACjE,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,aAAa,GAAI;AACzD,UAAM,YAAY,KAAK,UAAU;AAAA,MAC/B,KAAK,QAAQ;AAAA,MACb,KAAK,QAAQ;AAAA,MACb,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,MACb,KAAK,UAAU,QAAQ;AAAA,IACzB,CAAC;AAED,YAAQ,eAAe;AACvB,YAAQ,kBAAkB;AAC1B,YAAQ,YAAY;AACpB,UAAM,KAAK,GAAG,MAAM;AAEpB,UAAM,kBAAkB,0BAA0B;AAAA,MAChD,QAAQ,QAAQ;AAAA,MAChB,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB,kBAAkB,QAAQ;AAAA,MAC1B,QAAQ;AAAA,MACR,WAAW,UAAU,YAAY;AAAA,IACnC,CAAC;AAED,WAAO,EAAE,WAAW,UAAU;AAAA,EAChC;AAAA,EAEA,MAAM,cACJ,OACA,kBACA,SAKkB;AAClB,QAAI,CAAC,MAAO,QAAO;AACnB,UAAM,UAAU,KAAK,gBAAgB,KAAK;AAC1C,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,QAAQ,OAAO,KAAK,IAAI,EAAG,QAAO;AACtC,QAAI,QAAQ,QAAQ,iBAAkB,QAAO;AAC7C,QAAI,SAAS,kBAAkB,QAAQ,QAAQ,QAAQ,eAAgB,QAAO;AAC9E,QAAI,SAAS,aAAa,UAAa,QAAQ,SAAS,QAAQ,YAAY,MAAO,QAAO;AAC1F,QAAI,SAAS,mBAAmB,UAAa,QAAQ,SAAS,QAAQ,kBAAkB,MAAO,QAAO;AAEtG,UAAM,UAAU,MAAM,KAAK,GAAG,QAAQ,aAAa;AAAA,MACjD,IAAI,QAAQ;AAAA,MACZ,QAAQ,QAAQ;AAAA,MAChB,cAAc;AAAA,IAChB,CAA6B;AAE7B,WAAO,QAAQ,WAAW,QAAQ,UAAU,QAAQ,IAAI,KAAK,IAAI,CAAC;AAAA,EACpE;AAAA,EAEA,MAAM,aACJ,OACA,cACA,OAC8B;AAC9B,UAAM,KAAK,kCAAkC;AAC7C,UAAM,gBAAgB,MAAM,YAAY;AACxC,UAAM,sBAAsB,MAAM,kBAAkB;AACpD,SAAK,cAAc,eAAe,mBAAmB;AACrD,QAAI,MAAO,MAAK,iBAAiB,eAAe,qBAAqB,KAAK;AAC1E,UAAM,KAAK,mBAAmB,MAAM,kBAAkB,eAAe,mBAAmB;AAExF,UAAM,SAAS,KAAK,GAAG,OAAO,qBAAqB;AAAA,MACjD,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB,OAAO,MAAM,SAAS;AAAA,MACtB,kBAAkB,MAAM;AAAA,MACxB,WAAW,MAAM;AAAA,MACjB,YAAY,KAAK,aAAa,MAAM,UAAU;AAAA,MAC9C,iBAAiB,MAAM;AAAA,MACvB;AAAA,MACA,oBAAoB;AAAA,MACpB,WAAW,oBAAI,KAAK;AAAA,MACpB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AACD,SAAK,GAAG,QAAQ,MAAM;AACtB,UAAM,KAAK,GAAG,MAAM;AAEpB,UAAM,kBAAkB,gCAAgC;AAAA,MACtD,IAAI,OAAO;AAAA,MACX,kBAAkB,OAAO;AAAA,MACzB;AAAA,IACF,CAAC;AAED,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,aACJ,IACA,OACA,cACA,OAC8B;AAC9B,UAAM,KAAK,kCAAkC;AAC7C,UAAM,SAAS,MAAM,KAAK,GAAG,QAAQ,qBAAqB,EAAE,IAAI,WAAW,KAAK,CAAC;AACjF,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,0BAA0B,gCAAgC,GAAG;AAAA,IACzE;AACA,QAAI,OAAO;AACT,WAAK,iBAAiB,OAAO,YAAY,MAAM,OAAO,kBAAkB,MAAM,KAAK;AACnF,UAAI,OAAO,sBAAsB,CAAC,MAAM,cAAc;AACpD,cAAM,IAAI,0BAA0B,gCAAgC,GAAG;AAAA,MACzE;AAAA,IACF;AAEA,UAAM,eAAe,MAAM,aAAa,SAAY,MAAM,YAAY,OAAO,OAAO,YAAY;AAChG,UAAM,qBAAqB,MAAM,mBAAmB,SAAY,MAAM,kBAAkB,OAAO,OAAO,kBAAkB;AACxH,UAAM,uBAAuB,MAAM,oBAAoB,OAAO;AAC9D,SAAK,cAAc,cAAc,kBAAkB;AACnD,QAAI,MAAO,MAAK,iBAAiB,cAAc,oBAAoB,KAAK;AACxE,UAAM,KAAK,mBAAmB,sBAAsB,cAAc,oBAAoB,OAAO,EAAE;AAE/F,QAAI,MAAM,aAAa,OAAW,QAAO,WAAW,MAAM,YAAY;AACtE,QAAI,MAAM,mBAAmB,OAAW,QAAO,iBAAiB,MAAM,kBAAkB;AACxF,QAAI,MAAM,UAAU,OAAW,QAAO,QAAQ,MAAM,SAAS;AAC7D,QAAI,MAAM,qBAAqB,OAAW,QAAO,mBAAmB,MAAM;AAC1E,QAAI,MAAM,cAAc,OAAW,QAAO,YAAY,MAAM;AAC5D,QAAI,MAAM,eAAe,OAAW,QAAO,aAAa,KAAK,aAAa,MAAM,UAAU;AAC1F,QAAI,MAAM,oBAAoB,OAAW,QAAO,kBAAkB,MAAM;AACxE,WAAO,eAAe;AACtB,WAAO,YAAY,oBAAI,KAAK;AAC5B,UAAM,KAAK,GAAG,MAAM;AAEpB,UAAM,kBAAkB,gCAAgC;AAAA,MACtD,IAAI,OAAO;AAAA,MACX,kBAAkB,OAAO;AAAA,MACzB;AAAA,IACF,CAAC;AAED,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,aAAa,IAAY,OAAsC;AACnE,UAAM,SAAS,MAAM,KAAK,GAAG,QAAQ,qBAAqB,EAAE,IAAI,WAAW,KAAK,CAAC;AACjF,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,0BAA0B,gCAAgC,GAAG;AAAA,IACzE;AACA,QAAI,OAAO;AACT,WAAK,iBAAiB,OAAO,YAAY,MAAM,OAAO,kBAAkB,MAAM,KAAK;AACnF,UAAI,OAAO,sBAAsB,CAAC,MAAM,cAAc;AACpD,cAAM,IAAI,0BAA0B,gCAAgC,GAAG;AAAA,MACzE;AAAA,IACF;AACA,WAAO,YAAY,oBAAI,KAAK;AAC5B,WAAO,YAAY,oBAAI,KAAK;AAC5B,UAAM,KAAK,GAAG,MAAM;AAEpB,UAAM,kBAAkB,gCAAgC;AAAA,MACtD,IAAI,OAAO;AAAA,MACX,kBAAkB,OAAO;AAAA,IAC3B,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,yBACJ,OACe;AACf,UAAM,WAAW,MAAM,KAAK,GAAG,QAAQ,qBAAqB;AAAA,MAC1D,kBAAkB,MAAM;AAAA,MACxB,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB,oBAAoB;AAAA,IACtB,CAAC;AAED,QAAI,UAAU;AACZ,eAAS,YAAY;AACrB,eAAS,YAAY;AACrB,eAAS,aAAa,KAAK,aAAa,MAAM,UAAU;AACxD,eAAS,kBAAkB,MAAM,mBAAmB,gBAAgB;AACpE,eAAS,YAAY,oBAAI,KAAK;AAC9B,YAAM,KAAK,GAAG,MAAM;AACpB;AAAA,IACF;AAEA,UAAM,SAAS,KAAK,GAAG,OAAO,qBAAqB;AAAA,MACjD,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB,OAAO,MAAM,SAAS;AAAA,MACtB,kBAAkB,MAAM;AAAA,MACxB,WAAW;AAAA,MACX,oBAAoB;AAAA,MACpB,YAAY,KAAK,aAAa,MAAM,UAAU;AAAA,MAC9C,iBAAiB,MAAM,mBAAmB,gBAAgB;AAAA,MAC1D,cAAc;AAAA,MACd,WAAW,oBAAI,KAAK;AAAA,MACpB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AACD,SAAK,GAAG,QAAQ,MAAM;AACtB,UAAM,KAAK,GAAG,MAAM;AAAA,EACtB;AAAA,EAEA,MAAM,iBAAkC;AACtC,WAAO,KAAK,GAAG,aAAa,aAAa;AAAA,MACvC,WAAW,EAAE,MAAM,oBAAI,KAAK,EAAE;AAAA,IAChC,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,oCAAmD;AAC/D,UAAM,kBAAkB,6BAA6B;AACrD,UAAM,kBAAkB,gBAAgB,QAAQ,CAAC,UAAU,MAAM,WAAW,CAAC,CAAC;AAC9E,UAAM,kBAAkB,gBAAgB,WAAW,IAAI,qBAAqB,CAAC;AAE7E,eAAW,UAAU,kBAAkB;AAAA,MACrC,GAAG;AAAA,MACH,GAAG;AAAA,IACL,CAAC,GAAG;AACF,YAAM,KAAK,yBAAyB,KAAK,qBAAqB,MAAM,CAAC;AAAA,IACvE;AAAA,EACF;AAAA,EAEQ,qBAAqB,QAAqD;AAChF,WAAO;AAAA,MACL,kBAAkB,OAAO;AAAA,MACzB,OAAO,OAAO,SAAS;AAAA,MACvB,YAAY,OAAO;AAAA,MACnB,iBAAiB,KAAK,kBAAkB,OAAO,eAAe;AAAA,IAChE;AAAA,EACF;AAAA,EAEA,MAAc,mBACZ,kBACA,UACA,gBACA,UACe;AACf,UAAM,WAAW,MAAM,KAAK,GAAG,QAAQ,qBAAqB;AAAA,MAC1D;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AACD,QAAI,YAAY,SAAS,OAAO,UAAU;AACxC,YAAM,IAAI,0BAA0B,iEAAiE,GAAG;AAAA,IAC1G;AAAA,EACF;AAAA,EAEQ,cAAc,UAAyB,gBAAqC;AAClF,QAAI,kBAAkB,CAAC,UAAU;AAC/B,YAAM,IAAI,0BAA0B,qDAAqD,GAAG;AAAA,IAC9F;AAAA,EACF;AAAA,EAEQ,uBAAuB,QAA6B,OAA+B;AACzF,QAAI,MAAM,aAAc,QAAO;AAC/B,QAAI,CAAC,MAAM,SAAU,QAAO;AAC5B,UAAM,iBAAiB,OAAO,YAAY;AAC1C,QAAI,mBAAmB,KAAM,QAAO;AACpC,WAAO,mBAAmB,MAAM;AAAA,EAClC;AAAA,EAEQ,iBACN,gBACA,sBACA,OACM;AACN,QAAI,MAAM,aAAc;AACxB,QAAI,CAAC,MAAM,UAAU;AACnB,YAAM,IAAI,0BAA0B,gCAAgC,GAAG;AAAA,IACzE;AACA,SAAK,kBAAkB,UAAU,MAAM,UAAU;AAC/C,YAAM,IAAI,0BAA0B,gCAAgC,GAAG;AAAA,IACzE;AACA,QACE,MAAM,mBAAmB,UACtB,MAAM,mBAAmB,QACzB,yBAAyB,QACzB,yBAAyB,MAAM,gBAClC;AACA,YAAM,IAAI,0BAA0B,gCAAgC,GAAG;AAAA,IACzE;AAAA,EACF;AAAA,EAEQ,uBACN,kBACA,yBACY;AACZ,QAAI,KAAK,eAAe,IAAI,iBAAiB;AAC3C,aAAO;AAAA,IACT;AACA,QAAI,qBAAqB,gBAAgB,SAAU,QAAO;AAC1D,QAAI,qBAAqB,gBAAgB,KAAK;AAC5C,UAAI,4BAA4B,GAAG;AACjC,cAAM,IAAI,0BAA0B,oEAAoE,GAAG;AAAA,MAC7G;AACA,aAAO;AAAA,IACT;AACA,WAAO,0BAA0B,IAAI,QAAQ;AAAA,EAC/C;AAAA,EAEQ,aAAa,QAA6B,UAAyB,gBAAwC;AACjH,QAAI,OAAO,gBAAgB;AACzB,aAAO,OAAO,mBAAmB,kBAAkB,OAAO,aAAa;AAAA,IACzE;AACA,QAAI,OAAO,UAAU;AACnB,aAAO,OAAO,aAAa;AAAA,IAC7B;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,sBACN,MACA,OACA,UACA,gBACQ;AACR,UAAM,YAAY,KAAK,iBAAiB,MAAM,UAAU,cAAc;AACtE,UAAM,aAAa,KAAK,iBAAiB,OAAO,UAAU,cAAc;AACxE,QAAI,cAAc,WAAY,QAAO,YAAY;AACjD,QAAI,KAAK,uBAAuB,MAAM,oBAAoB;AACxD,aAAO,KAAK,qBAAqB,IAAI;AAAA,IACvC;AACA,WAAO,MAAM,UAAU,QAAQ,IAAI,KAAK,UAAU,QAAQ;AAAA,EAC5D;AAAA,EAEQ,iBACN,QACA,UACA,gBACQ;AACR,QAAI,OAAO,mBAAmB,kBAAkB,OAAO,aAAa,SAAU,QAAO;AACrF,QAAI,CAAC,OAAO,kBAAkB,OAAO,aAAa,SAAU,QAAO;AACnE,QAAI,CAAC,OAAO,kBAAkB,CAAC,OAAO,YAAY,CAAC,OAAO,mBAAoB,QAAO;AACrF,QAAI,CAAC,OAAO,kBAAkB,CAAC,OAAO,YAAY,OAAO,mBAAoB,QAAO;AACpF,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,kBAAkB,WAAyC;AACvE,UAAM,UAAU,MAAM,KAAK,GAAG,QAAQ,aAAa,EAAE,IAAI,UAAU,CAAC;AACpE,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,0BAA0B,oCAAoC,GAAG;AAAA,IAC7E;AACA,QAAI,QAAQ,UAAU,QAAQ,KAAK,KAAK,IAAI,GAAG;AAC7C,YAAM,IAAI,0BAA0B,kCAAkC,GAAG;AAAA,IAC3E;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,cAAc,QAA2C;AACrE,UAAM,OAAO,MAAM;AAAA,MACjB,KAAK;AAAA,MACL;AAAA,MACA,EAAE,IAAI,QAAQ,WAAW,KAAK;AAAA,MAC9B;AAAA,MACA,CAAC;AAAA,IACH;AAEA,QAAI,CAAC,KAAM,QAAO;AAClB,WAAO;AAAA,MACL,IAAI,OAAO,KAAK,EAAE;AAAA,MAClB,UAAU,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAAA,MAClD,gBAAgB,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,IACtE;AAAA,EACF;AAAA,EAEQ,aAAa,OAA+B;AAClD,UAAM,WAAW,SAAS,KAAK,eAAe,KAAK;AACnD,WAAO,KAAK;AAAA,MACV,KAAK,IAAI,UAAU,KAAK,eAAe,KAAK,aAAa;AAAA,MACzD,KAAK,eAAe,KAAK;AAAA,IAC3B;AAAA,EACF;AAAA,EAEQ,aAAa,SAA0B;AAC7C,QAAI,CAAC,WAAW,OAAO,YAAY,UAAU;AAC3C,YAAM,IAAI,0BAA0B,wBAAwB,GAAG;AAAA,IACjE;AACA,UAAM,gBAAiB,QAAoC;AAC3D,QAAI,OAAO,kBAAkB,YAAY,cAAc,KAAK,EAAE,WAAW,GAAG;AAC1E,YAAM,IAAI,0BAA0B,wBAAwB,GAAG;AAAA,IACjE;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,UAAU,SAAyC;AACzD,UAAM,iBAAiB,OAAO,KAAK,KAAK,UAAU,OAAO,CAAC,EAAE,SAAS,WAAW;AAChF,UAAM,YAAY,WAAW,UAAU,KAAK,cAAc,CAAC,EAAE,OAAO,cAAc,EAAE,OAAO,WAAW;AACtG,WAAO,GAAG,cAAc,IAAI,SAAS;AAAA,EACvC;AAAA,EAEQ,gBAAgB,OAA8C;AACpE,UAAM,CAAC,gBAAgB,SAAS,IAAI,MAAM,MAAM,GAAG;AACnD,QAAI,CAAC,kBAAkB,CAAC,UAAW,QAAO;AAE1C,UAAM,WAAW,WAAW,UAAU,KAAK,cAAc,CAAC,EAAE,OAAO,cAAc,EAAE,OAAO,WAAW;AACrG,UAAM,kBAAkB,OAAO,KAAK,SAAS;AAC7C,UAAM,iBAAiB,OAAO,KAAK,QAAQ;AAC3C,QAAI,gBAAgB,WAAW,eAAe,OAAQ,QAAO;AAC7D,QAAI,CAAC,gBAAgB,iBAAiB,cAAc,EAAG,QAAO;AAE9D,QAAI;AACF,YAAM,SAAS,6BAA6B;AAAA,QAC1C,KAAK,MAAM,OAAO,KAAK,gBAAgB,WAAW,EAAE,SAAS,MAAM,CAAC;AAAA,MACtE;AACA,UAAI,CAAC,OAAO,QAAS,QAAO;AAC5B,aAAO,OAAO;AAAA,IAChB,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,gBAAwB;AAC9B,UAAM,SACJ,eAAe,QAAQ,IAAI,uBAAuB,KAC/C,eAAe,QAAQ,IAAI,eAAe,KAC1C,eAAe,QAAQ,IAAI,WAAW,KACtC,eAAe,QAAQ,IAAI,UAAU;AAC1C,QAAI,OAAQ,QAAO;AACnB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,kBACN,QAC6B;AAC7B,YAAQ,QAAQ;AAAA,MACd,KAAK;AACH,eAAO,gBAAgB;AAAA,MACzB,KAAK;AACH,eAAO,gBAAgB;AAAA,MACzB,KAAK;AAAA,MACL;AACE,eAAO,gBAAgB;AAAA,IAC3B;AAAA,EACF;AACF;AAEA,IAAO,+BAAQ;",
+  "sourcesContent": ["import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto'\nimport { z } from 'zod'\nimport type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport { User } from '@open-mercato/core/modules/auth/data/entities'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  dedupeSudoTargets,\n  getSecuritySudoTargetEntries,\n  type SecuritySudoTarget,\n} from '../lib/module-security-registry'\nimport {\n  ChallengeMethod,\n  SudoChallengeConfig,\n  SudoChallengeMethodUsed,\n  SudoSession,\n} from '../data/entities'\nimport { emitSecurityEvent } from '../events'\nimport type {\n  SudoConfigInput,\n  SudoConfigUpdateInput,\n} from '../data/validators'\nimport type { PasswordService } from './PasswordService'\nimport type { MfaService } from './MfaService'\nimport type { MfaVerificationService } from './MfaVerificationService'\nimport { sudoTargets as defaultSudoTargets } from '../security.sudo'\nimport type { SecurityModuleConfig } from '../lib/security-config'\nimport { emitMfaEmergencyBypassActiveWarning, readSecurityModuleConfig } from '../lib/security-config'\n\ntype SudoMethod = 'password' | 'mfa'\n\nexport type SudoAvailableMethod = {\n  type: string\n  label: string\n  icon: string\n}\n\nexport type SudoProtectionResolution = {\n  protected: boolean\n  config?: SudoChallengeConfig\n}\n\nconst signedSudoTokenPayloadSchema = z.object({\n  sid: z.string(),\n  sub: z.string(),\n  tid: z.string().nullable(),\n  oid: z.string().nullable(),\n  tgt: z.string(),\n  exp: z.number(),\n})\n\ntype SignedSudoTokenPayload = z.infer<typeof signedSudoTokenPayloadSchema>\n\ntype UserScope = {\n  id: string\n  tenantId: string | null\n  organizationId: string | null\n}\n\ntype BoundPendingSudoSession = SudoSession & {\n  targetIdentifier: string\n  sudoConfigId: string\n  sudoConfigUpdatedAt: Date\n}\n\nexport type SudoAuthScope = {\n  tenantId: string | null\n  organizationId?: string | null\n  isSuperAdmin?: boolean\n}\n\ntype DeveloperDefaultPayload = {\n  targetIdentifier: string\n  label?: string | null\n  ttlSeconds?: number\n  challengeMethod?: ChallengeMethod\n}\n\nfunction readTrimmedEnv(value: string | undefined): string | undefined {\n  const trimmed = value?.trim()\n  return trimmed ? trimmed : undefined\n}\n\nexport class SudoChallengeServiceError extends Error {\n  constructor(\n    message: string,\n    public readonly statusCode: number,\n  ) {\n    super(message)\n    this.name = 'SudoChallengeServiceError'\n  }\n}\n\nexport class SudoChallengeService {\n  constructor(\n    private readonly em: EntityManager,\n    private readonly passwordService: PasswordService,\n    private readonly mfaService: MfaService,\n    private readonly mfaVerificationService: MfaVerificationService,\n    private readonly securityConfig: SecurityModuleConfig = readSecurityModuleConfig(),\n  ) {}\n\n  async listConfigs(scope?: SudoAuthScope): Promise<SudoChallengeConfig[]> {\n    await this.ensureDeveloperDefaultsRegistered()\n    const filter: FilterQuery<SudoChallengeConfig> = { deletedAt: null }\n    if (scope && !scope.isSuperAdmin) {\n      if (!scope.tenantId) return []\n      ;(filter as Record<string, unknown>).$or = [\n        { tenantId: scope.tenantId },\n        { tenantId: null },\n      ]\n    }\n    return this.em.find(\n      SudoChallengeConfig,\n      filter,\n      {\n        orderBy: {\n          targetIdentifier: 'asc',\n          tenantId: 'asc',\n          organizationId: 'asc',\n          createdAt: 'asc',\n        },\n      },\n    )\n  }\n\n  async getConfigById(id: string, scope?: SudoAuthScope): Promise<SudoChallengeConfig | null> {\n    await this.ensureDeveloperDefaultsRegistered()\n    const config = await this.em.findOne(SudoChallengeConfig, { id, deletedAt: null })\n    if (!config) return null\n    if (scope && !this.isConfigVisibleToScope(config, scope)) return null\n    return config\n  }\n\n  async isProtected(\n    targetIdentifier: string,\n    tenantId?: string | null,\n    organizationId?: string | null,\n  ): Promise<SudoProtectionResolution> {\n    await this.ensureDeveloperDefaultsRegistered()\n    return this.resolveProtection(this.em, targetIdentifier, tenantId ?? null, organizationId ?? null)\n  }\n\n  async initiate(\n    userId: string,\n    targetIdentifier: string,\n    options?: { tenantId?: string | null; organizationId?: string | null },\n  ): Promise<{\n    required: boolean\n    sessionId?: string\n    method?: SudoMethod\n    availableMfaMethods?: SudoAvailableMethod[]\n    expiresAt?: Date\n  }> {\n    const user = await this.findUserScope(userId)\n    if (!user?.tenantId) {\n      throw new SudoChallengeServiceError('User not found', 404)\n    }\n    const scopeTenantId = options?.tenantId !== undefined ? options.tenantId : user.tenantId\n    const scopeOrganizationId = options?.organizationId !== undefined ? options.organizationId : user.organizationId\n    const protection = await this.isProtected(\n      targetIdentifier,\n      scopeTenantId,\n      scopeOrganizationId,\n    )\n\n    if (!protection.protected || !protection.config) {\n      return { required: false }\n    }\n\n    const userMethods = await this.mfaService.getUserMethods(userId)\n    const method = this.resolveChallengeMethod(protection.config.challengeMethod, userMethods.length, userId, targetIdentifier)\n\n    let sessionToken = randomBytes(16).toString('hex')\n    let availableMfaMethods: SudoAvailableMethod[] | undefined\n    if (method === 'mfa') {\n      const challenge = await this.mfaVerificationService.createChallenge(userId)\n      sessionToken = challenge.challengeId\n      availableMfaMethods = challenge.availableMethods\n    }\n\n    const expiresAt = new Date(Date.now() + this.securityConfig.sudo.pendingChallengeTtlMs)\n    const session = this.em.create(SudoSession, {\n      userId,\n      tenantId: user.tenantId,\n      scopeTenantId,\n      scopeOrganizationId,\n      targetIdentifier,\n      sudoConfigId: protection.config.id,\n      sudoConfigUpdatedAt: protection.config.updatedAt,\n      sessionToken,\n      challengeMethod: method,\n      expiresAt,\n      verifiedAt: null,\n      createdAt: new Date(),\n    })\n    this.em.persist(session)\n    await this.em.flush()\n\n    await emitSecurityEvent('security.sudo.challenged', {\n      userId,\n      tenantId: user.tenantId,\n      organizationId: user.organizationId,\n      targetIdentifier,\n      method,\n    })\n\n    return {\n      required: true,\n      sessionId: session.id,\n      method,\n      availableMfaMethods,\n      expiresAt,\n    }\n  }\n\n  async prepare(\n    sessionId: string,\n    methodType: string,\n    options: { expectedUserId?: string } = {},\n    request?: Request,\n  ): Promise<{ clientData?: Record<string, unknown> }> {\n    const session = await this.getPendingSession(sessionId)\n    if (options.expectedUserId && session.userId !== options.expectedUserId) {\n      throw new SudoChallengeServiceError('Sudo challenge user mismatch', 403)\n    }\n    if (session.challengeMethod !== 'mfa') {\n      throw new SudoChallengeServiceError('This sudo session does not require MFA', 400)\n    }\n    return this.mfaVerificationService.prepareChallenge(\n      session.sessionToken,\n      methodType,\n      { request },\n      { userId: session.userId },\n    )\n  }\n\n  async verify(\n    sessionId: string,\n    methodType: string,\n    payload: unknown,\n    options: {\n      expectedUserId?: string\n      tenantId?: string | null\n      organizationId?: string | null\n      targetIdentifier: string\n    },\n    request?: Request,\n  ): Promise<{ sudoToken: string; expiresAt: Date }> {\n    const session = await this.getPendingSession(sessionId)\n    if (options.expectedUserId && session.userId !== options.expectedUserId) {\n      throw new SudoChallengeServiceError('Sudo challenge user mismatch', 403)\n    }\n    const user = await this.findUserScope(session.userId)\n    if (!user?.tenantId) {\n      throw new SudoChallengeServiceError('User not found', 404)\n    }\n    if (user.tenantId !== session.tenantId) {\n      throw new SudoChallengeServiceError('Unable to verify sudo challenge', 403)\n    }\n\n    const requestedTenantId = options.tenantId !== undefined ? options.tenantId : user.tenantId\n    const requestedOrganizationId = options.organizationId !== undefined ? options.organizationId : user.organizationId\n    if (\n      options.targetIdentifier !== session.targetIdentifier\n      || requestedTenantId !== session.scopeTenantId\n      || requestedOrganizationId !== session.scopeOrganizationId\n    ) {\n      throw new SudoChallengeServiceError('Unable to verify sudo challenge', 403)\n    }\n\n    const scopeTenantId = session.scopeTenantId ?? null\n    const scopeOrganizationId = session.scopeOrganizationId ?? null\n    const protection = await this.isProtected(\n      session.targetIdentifier,\n      scopeTenantId,\n      scopeOrganizationId,\n    )\n    if (!protection.protected || !protection.config) {\n      throw new SudoChallengeServiceError('Sudo protection is not configured for this target', 404)\n    }\n    if (\n      protection.config.id !== session.sudoConfigId\n      || protection.config.updatedAt.getTime() !== session.sudoConfigUpdatedAt?.getTime()\n    ) {\n      throw new SudoChallengeServiceError('Unable to verify sudo challenge', 403)\n    }\n\n    let verified = false\n    let methodUsed: string = methodType\n    if (session.challengeMethod === 'password') {\n      const password = this.readPassword(payload)\n      verified = await this.passwordService.verifyPassword(session.userId, password)\n      methodUsed = SudoChallengeMethodUsed.PASSWORD\n    } else {\n      verified = await this.mfaVerificationService.verifyChallenge(\n        session.sessionToken,\n        methodType,\n        payload,\n        { request },\n        { userId: session.userId },\n      )\n    }\n\n    if (!verified) {\n      await emitSecurityEvent('security.sudo.failed', {\n        userId: session.userId,\n        tenantId: user.tenantId,\n        organizationId: user.organizationId,\n        targetIdentifier: session.targetIdentifier,\n        method: methodUsed,\n      })\n      throw new SudoChallengeServiceError('Unable to verify sudo challenge', 401)\n    }\n\n    const pendingToken = session.sessionToken\n    const { sudoToken, expiresAt, verifiedAt } = await this.em.transactional(async (transactionalEm) => {\n      await transactionalEm.execute('lock table \"sudo_challenge_configs\" in share mode')\n      const currentProtection = await this.resolveProtection(\n        transactionalEm,\n        session.targetIdentifier,\n        scopeTenantId,\n        scopeOrganizationId,\n      )\n      if (\n        !currentProtection.protected\n        || !currentProtection.config\n        || currentProtection.config.id !== session.sudoConfigId\n        || currentProtection.config.updatedAt.getTime() !== session.sudoConfigUpdatedAt.getTime()\n      ) {\n        throw new SudoChallengeServiceError('Unable to verify sudo challenge', 403)\n      }\n\n      const ttlSeconds = this.normalizeTtl(currentProtection.config.ttlSeconds)\n      const currentVerifiedAt = new Date()\n      const currentExpiresAt = new Date(Date.now() + ttlSeconds * 1000)\n      const currentSudoToken = this.signToken({\n        sid: session.id,\n        sub: session.userId,\n        tid: scopeTenantId,\n        oid: scopeOrganizationId,\n        tgt: session.targetIdentifier,\n        exp: currentExpiresAt.getTime(),\n      })\n      const consumedRows = await transactionalEm.nativeUpdate(\n        SudoSession,\n        {\n          id: session.id,\n          sessionToken: pendingToken,\n          verifiedAt: null,\n          expiresAt: { $gt: currentVerifiedAt },\n        },\n        {\n          sessionToken: currentSudoToken,\n          expiresAt: currentExpiresAt,\n          verifiedAt: currentVerifiedAt,\n        },\n      )\n      if (consumedRows !== 1) {\n        throw new SudoChallengeServiceError('Unable to verify sudo challenge', 400)\n      }\n      return {\n        sudoToken: currentSudoToken,\n        expiresAt: currentExpiresAt,\n        verifiedAt: currentVerifiedAt,\n      }\n    })\n    session.sessionToken = sudoToken\n    session.expiresAt = expiresAt\n    session.verifiedAt = verifiedAt\n\n    await emitSecurityEvent('security.sudo.verified', {\n      userId: session.userId,\n      tenantId: scopeTenantId,\n      organizationId: scopeOrganizationId,\n      targetIdentifier: session.targetIdentifier,\n      method: methodUsed,\n      expiresAt: expiresAt.toISOString(),\n    })\n\n    return { sudoToken, expiresAt }\n  }\n\n  async validateToken(\n    token: string,\n    targetIdentifier: string,\n    options?: {\n      expectedUserId?: string\n      tenantId?: string | null\n      organizationId?: string | null\n    },\n  ): Promise<boolean> {\n    if (!token) return false\n    const payload = this.readSignedToken(token)\n    if (!payload) return false\n    if (payload.exp <= Date.now()) return false\n    if (payload.tgt !== targetIdentifier) return false\n    if (options?.expectedUserId && payload.sub !== options.expectedUserId) return false\n    if (options?.tenantId !== undefined && payload.tid !== (options.tenantId ?? null)) return false\n    if (options?.organizationId !== undefined && payload.oid !== (options.organizationId ?? null)) return false\n\n    const session = await this.em.findOne(SudoSession, {\n      id: payload.sid,\n      userId: payload.sub,\n      sessionToken: token,\n      targetIdentifier,\n      scopeTenantId: payload.tid,\n      scopeOrganizationId: payload.oid,\n      verifiedAt: { $ne: null },\n    } as FilterQuery<SudoSession>)\n\n    return Boolean(session && session.expiresAt.getTime() > Date.now())\n  }\n\n  async createConfig(\n    input: SudoConfigInput,\n    configuredBy: string,\n    scope?: SudoAuthScope,\n  ): Promise<SudoChallengeConfig> {\n    await this.ensureDeveloperDefaultsRegistered()\n    const inputTenantId = input.tenantId ?? null\n    const inputOrganizationId = input.organizationId ?? null\n    this.validateScope(inputTenantId, inputOrganizationId)\n    if (scope) this.assertWriteScope(inputTenantId, inputOrganizationId, scope)\n    await this.ensureUniqueConfig(input.targetIdentifier, inputTenantId, inputOrganizationId)\n\n    const config = this.em.create(SudoChallengeConfig, {\n      tenantId: inputTenantId,\n      organizationId: inputOrganizationId,\n      label: input.label ?? null,\n      targetIdentifier: input.targetIdentifier,\n      isEnabled: input.isEnabled,\n      ttlSeconds: this.normalizeTtl(input.ttlSeconds),\n      challengeMethod: input.challengeMethod,\n      configuredBy,\n      isDeveloperDefault: false,\n      createdAt: new Date(),\n      updatedAt: new Date(),\n    })\n    this.em.persist(config)\n    await this.em.flush()\n\n    await emitSecurityEvent('security.sudo.config.created', {\n      id: config.id,\n      targetIdentifier: config.targetIdentifier,\n      configuredBy,\n    })\n\n    return config\n  }\n\n  async updateConfig(\n    id: string,\n    input: SudoConfigUpdateInput,\n    configuredBy: string,\n    scope?: SudoAuthScope,\n  ): Promise<SudoChallengeConfig> {\n    await this.ensureDeveloperDefaultsRegistered()\n    const config = await this.em.findOne(SudoChallengeConfig, { id, deletedAt: null })\n    if (!config) {\n      throw new SudoChallengeServiceError('Sudo configuration not found', 404)\n    }\n    if (scope) {\n      this.assertWriteScope(config.tenantId ?? null, config.organizationId ?? null, scope)\n      if (config.isDeveloperDefault && !scope.isSuperAdmin) {\n        throw new SudoChallengeServiceError('Sudo configuration not found', 404)\n      }\n    }\n\n    const nextTenantId = input.tenantId !== undefined ? input.tenantId ?? null : config.tenantId ?? null\n    const nextOrganizationId = input.organizationId !== undefined ? input.organizationId ?? null : config.organizationId ?? null\n    const nextTargetIdentifier = input.targetIdentifier ?? config.targetIdentifier\n    this.validateScope(nextTenantId, nextOrganizationId)\n    if (scope) this.assertWriteScope(nextTenantId, nextOrganizationId, scope)\n    await this.ensureUniqueConfig(nextTargetIdentifier, nextTenantId, nextOrganizationId, config.id)\n\n    if (input.tenantId !== undefined) config.tenantId = input.tenantId ?? null\n    if (input.organizationId !== undefined) config.organizationId = input.organizationId ?? null\n    if (input.label !== undefined) config.label = input.label ?? null\n    if (input.targetIdentifier !== undefined) config.targetIdentifier = input.targetIdentifier\n    if (input.isEnabled !== undefined) config.isEnabled = input.isEnabled\n    if (input.ttlSeconds !== undefined) config.ttlSeconds = this.normalizeTtl(input.ttlSeconds)\n    if (input.challengeMethod !== undefined) config.challengeMethod = input.challengeMethod\n    config.configuredBy = configuredBy\n    config.updatedAt = new Date()\n    await this.em.flush()\n\n    await emitSecurityEvent('security.sudo.config.updated', {\n      id: config.id,\n      targetIdentifier: config.targetIdentifier,\n      configuredBy,\n    })\n\n    return config\n  }\n\n  async deleteConfig(id: string, scope?: SudoAuthScope): Promise<void> {\n    const config = await this.em.findOne(SudoChallengeConfig, { id, deletedAt: null })\n    if (!config) {\n      throw new SudoChallengeServiceError('Sudo configuration not found', 404)\n    }\n    if (scope) {\n      this.assertWriteScope(config.tenantId ?? null, config.organizationId ?? null, scope)\n      if (config.isDeveloperDefault && !scope.isSuperAdmin) {\n        throw new SudoChallengeServiceError('Sudo configuration not found', 404)\n      }\n    }\n    config.deletedAt = new Date()\n    config.updatedAt = new Date()\n    await this.em.flush()\n\n    await emitSecurityEvent('security.sudo.config.deleted', {\n      id: config.id,\n      targetIdentifier: config.targetIdentifier,\n    })\n  }\n\n  async registerDeveloperDefault(\n    input: DeveloperDefaultPayload,\n  ): Promise<void> {\n    const existing = await this.em.findOne(SudoChallengeConfig, {\n      targetIdentifier: input.targetIdentifier,\n      tenantId: null,\n      organizationId: null,\n      isDeveloperDefault: true,\n    })\n\n    if (existing) {\n      const ttlSeconds = this.normalizeTtl(input.ttlSeconds)\n      const challengeMethod = input.challengeMethod ?? ChallengeMethod.AUTO\n      const changed = !existing.isEnabled\n        || Boolean(existing.deletedAt)\n        || existing.ttlSeconds !== ttlSeconds\n        || existing.challengeMethod !== challengeMethod\n      if (changed) {\n        existing.isEnabled = true\n        existing.deletedAt = null\n        existing.ttlSeconds = ttlSeconds\n        existing.challengeMethod = challengeMethod\n        existing.updatedAt = new Date()\n        await this.em.flush()\n      }\n      return\n    }\n\n    const config = this.em.create(SudoChallengeConfig, {\n      tenantId: null,\n      organizationId: null,\n      label: input.label ?? null,\n      targetIdentifier: input.targetIdentifier,\n      isEnabled: true,\n      isDeveloperDefault: true,\n      ttlSeconds: this.normalizeTtl(input.ttlSeconds),\n      challengeMethod: input.challengeMethod ?? ChallengeMethod.AUTO,\n      configuredBy: null,\n      createdAt: new Date(),\n      updatedAt: new Date(),\n    })\n    this.em.persist(config)\n    await this.em.flush()\n  }\n\n  async cleanupExpired(): Promise<number> {\n    return this.em.nativeDelete(SudoSession, {\n      expiresAt: { $lte: new Date() },\n    })\n  }\n\n  private async ensureDeveloperDefaultsRegistered(): Promise<void> {\n    const registryEntries = getSecuritySudoTargetEntries()\n    const registryTargets = registryEntries.flatMap((entry) => entry.targets ?? [])\n    const fallbackTargets = registryEntries.length === 0 ? defaultSudoTargets : []\n\n    for (const target of dedupeSudoTargets([\n      ...registryTargets,\n      ...fallbackTargets,\n    ])) {\n      await this.registerDeveloperDefault(this.readDeveloperDefault(target))\n    }\n  }\n\n  private readDeveloperDefault(target: SecuritySudoTarget): DeveloperDefaultPayload {\n    return {\n      targetIdentifier: target.identifier,\n      label: target.label ?? null,\n      ttlSeconds: target.ttlSeconds,\n      challengeMethod: this.toChallengeMethod(target.challengeMethod),\n    }\n  }\n\n  private async ensureUniqueConfig(\n    targetIdentifier: string,\n    tenantId: string | null,\n    organizationId: string | null,\n    ignoreId?: string,\n  ): Promise<void> {\n    const existing = await this.em.findOne(SudoChallengeConfig, {\n      targetIdentifier,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })\n    if (existing && existing.id !== ignoreId) {\n      throw new SudoChallengeServiceError('A sudo configuration for this target and scope already exists', 409)\n    }\n  }\n\n  private validateScope(tenantId: string | null, organizationId: string | null): void {\n    if (organizationId && !tenantId) {\n      throw new SudoChallengeServiceError('Organization-scoped sudo config requires a tenant', 400)\n    }\n  }\n\n  private isConfigVisibleToScope(config: SudoChallengeConfig, scope: SudoAuthScope): boolean {\n    if (scope.isSuperAdmin) return true\n    if (!scope.tenantId) return false\n    const configTenantId = config.tenantId ?? null\n    if (configTenantId === null) return true\n    return configTenantId === scope.tenantId\n  }\n\n  private assertWriteScope(\n    targetTenantId: string | null,\n    targetOrganizationId: string | null,\n    scope: SudoAuthScope,\n  ): void {\n    if (scope.isSuperAdmin) return\n    if (!scope.tenantId) {\n      throw new SudoChallengeServiceError('Sudo configuration not found', 404)\n    }\n    if ((targetTenantId ?? null) !== scope.tenantId) {\n      throw new SudoChallengeServiceError('Sudo configuration not found', 404)\n    }\n    if (\n      scope.organizationId !== undefined\n      && scope.organizationId !== null\n      && targetOrganizationId !== null\n      && targetOrganizationId !== scope.organizationId\n    ) {\n      throw new SudoChallengeServiceError('Sudo configuration not found', 404)\n    }\n  }\n\n  private resolveChallengeMethod(\n    configuredMethod: ChallengeMethod,\n    availableMfaMethodCount: number,\n    userId?: string,\n    targetIdentifier?: string,\n  ): SudoMethod {\n    if (this.securityConfig.mfa.emergencyBypass) {\n      let wouldHaveBeenMfa = false\n      try {\n        wouldHaveBeenMfa = this.resolveChallengeMethodWithoutBypass(configuredMethod, availableMfaMethodCount) === 'mfa'\n      } catch {\n        wouldHaveBeenMfa = configuredMethod === ChallengeMethod.MFA\n      }\n      if (wouldHaveBeenMfa) {\n        emitMfaEmergencyBypassActiveWarning('sudo challenge downgraded to password', {\n          configuredMethod,\n          availableMfaMethodCount,\n          userId,\n          targetIdentifier,\n        })\n      }\n      return 'password'\n    }\n    return this.resolveChallengeMethodWithoutBypass(configuredMethod, availableMfaMethodCount)\n  }\n\n  private resolveChallengeMethodWithoutBypass(\n    configuredMethod: ChallengeMethod,\n    availableMfaMethodCount: number,\n  ): SudoMethod {\n    if (configuredMethod === ChallengeMethod.PASSWORD) return 'password'\n    if (configuredMethod === ChallengeMethod.MFA) {\n      if (availableMfaMethodCount === 0) {\n        throw new SudoChallengeServiceError('This sudo target requires MFA, but no MFA methods are configured', 400)\n      }\n      return 'mfa'\n    }\n    return availableMfaMethodCount > 0 ? 'mfa' : 'password'\n  }\n\n  private async resolveProtection(\n    em: EntityManager,\n    targetIdentifier: string,\n    tenantId: string | null,\n    organizationId: string | null,\n  ): Promise<SudoProtectionResolution> {\n    const candidates = await em.find(SudoChallengeConfig, {\n      targetIdentifier,\n      deletedAt: null,\n    })\n\n    const resolved = candidates\n      .filter((config) => this.matchesScope(config, tenantId, organizationId))\n      .sort((left, right) => this.compareConfigPriority(left, right, tenantId, organizationId))[0]\n\n    if (!resolved || !resolved.isEnabled) {\n      return { protected: false }\n    }\n\n    return { protected: true, config: resolved }\n  }\n\n  private matchesScope(config: SudoChallengeConfig, tenantId: string | null, organizationId: string | null): boolean {\n    if (config.organizationId) {\n      return config.organizationId === organizationId && config.tenantId === tenantId\n    }\n    if (config.tenantId) {\n      return config.tenantId === tenantId\n    }\n    return true\n  }\n\n  private compareConfigPriority(\n    left: SudoChallengeConfig,\n    right: SudoChallengeConfig,\n    tenantId: string | null,\n    organizationId: string | null,\n  ): number {\n    const leftScore = this.getScopePriority(left, tenantId, organizationId)\n    const rightScore = this.getScopePriority(right, tenantId, organizationId)\n    if (leftScore !== rightScore) return leftScore - rightScore\n    if (left.isDeveloperDefault !== right.isDeveloperDefault) {\n      return left.isDeveloperDefault ? 1 : -1\n    }\n    return right.updatedAt.getTime() - left.updatedAt.getTime()\n  }\n\n  private getScopePriority(\n    config: SudoChallengeConfig,\n    tenantId: string | null,\n    organizationId: string | null,\n  ): number {\n    if (config.organizationId === organizationId && config.tenantId === tenantId) return 0\n    if (!config.organizationId && config.tenantId === tenantId) return 1\n    if (!config.organizationId && !config.tenantId && !config.isDeveloperDefault) return 2\n    if (!config.organizationId && !config.tenantId && config.isDeveloperDefault) return 3\n    return 4\n  }\n\n  private async getPendingSession(sessionId: string): Promise<BoundPendingSudoSession> {\n    const session = await this.em.findOne(SudoSession, { id: sessionId })\n    if (!session) {\n      throw new SudoChallengeServiceError('Sudo challenge session not found', 404)\n    }\n    if (!session.targetIdentifier || !session.sudoConfigId || !session.sudoConfigUpdatedAt) {\n      throw new SudoChallengeServiceError('Sudo challenge session not found', 404)\n    }\n    if (session.verifiedAt) {\n      throw new SudoChallengeServiceError('Unable to verify sudo challenge', 400)\n    }\n    if (session.expiresAt.getTime() <= Date.now()) {\n      throw new SudoChallengeServiceError('Sudo challenge session expired', 400)\n    }\n    return session as BoundPendingSudoSession\n  }\n\n  private async findUserScope(userId: string): Promise<UserScope | null> {\n    const user = await findOneWithDecryption(\n      this.em,\n      User,\n      { id: userId, deletedAt: null },\n      undefined,\n      {},\n    )\n\n    if (!user) return null\n    return {\n      id: String(user.id),\n      tenantId: user.tenantId ? String(user.tenantId) : null,\n      organizationId: user.organizationId ? String(user.organizationId) : null,\n    }\n  }\n\n  private normalizeTtl(value?: number | null): number {\n    const rawValue = value ?? this.securityConfig.sudo.defaultTtlSeconds\n    return Math.min(\n      Math.max(rawValue, this.securityConfig.sudo.minTtlSeconds),\n      this.securityConfig.sudo.maxTtlSeconds,\n    )\n  }\n\n  private readPassword(payload: unknown): string {\n    if (!payload || typeof payload !== 'object') {\n      throw new SudoChallengeServiceError('Password is required', 400)\n    }\n    const maybePassword = (payload as Record<string, unknown>).password\n    if (typeof maybePassword !== 'string' || maybePassword.trim().length === 0) {\n      throw new SudoChallengeServiceError('Password is required', 400)\n    }\n    return maybePassword\n  }\n\n  private signToken(payload: SignedSudoTokenPayload): string {\n    const encodedPayload = Buffer.from(JSON.stringify(payload)).toString('base64url')\n    const signature = createHmac('sha256', this.getSudoSecret()).update(encodedPayload).digest('base64url')\n    return `${encodedPayload}.${signature}`\n  }\n\n  private readSignedToken(token: string): SignedSudoTokenPayload | null {\n    const [encodedPayload, signature] = token.split('.')\n    if (!encodedPayload || !signature) return null\n\n    const expected = createHmac('sha256', this.getSudoSecret()).update(encodedPayload).digest('base64url')\n    const signatureBuffer = Buffer.from(signature)\n    const expectedBuffer = Buffer.from(expected)\n    if (signatureBuffer.length !== expectedBuffer.length) return null\n    if (!timingSafeEqual(signatureBuffer, expectedBuffer)) return null\n\n    try {\n      const parsed = signedSudoTokenPayloadSchema.safeParse(\n        JSON.parse(Buffer.from(encodedPayload, 'base64url').toString('utf8')),\n      )\n      if (!parsed.success) return null\n      return parsed.data\n    } catch {\n      return null\n    }\n  }\n\n  private getSudoSecret(): string {\n    const secret =\n      readTrimmedEnv(process.env.OM_SECURITY_SUDO_SECRET)\n      ?? readTrimmedEnv(process.env.AUTH_JWT_SECRET)\n      ?? readTrimmedEnv(process.env.AUTH_SECRET)\n      ?? readTrimmedEnv(process.env.JWT_SECRET)\n    if (secret) return secret\n    throw new Error(\n      'Sudo step-up tokens require OM_SECURITY_SUDO_SECRET, AUTH_JWT_SECRET, AUTH_SECRET, or JWT_SECRET to be set.',\n    )\n  }\n\n  private toChallengeMethod(\n    method: SecuritySudoTarget['challengeMethod'],\n  ): ChallengeMethod | undefined {\n    switch (method) {\n      case 'password':\n        return ChallengeMethod.PASSWORD\n      case 'mfa':\n        return ChallengeMethod.MFA\n      case 'auto':\n      default:\n        return ChallengeMethod.AUTO\n    }\n  }\n}\n\nexport default SudoChallengeService\n"],
+  "mappings": "AAAA,SAAS,YAAY,aAAa,uBAAuB;AACzD,SAAS,SAAS;AAElB,SAAS,YAAY;AACrB,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,yBAAyB;AAQlC,SAAS,eAAe,0BAA0B;AAElD,SAAS,qCAAqC,gCAAgC;AAe9E,MAAM,+BAA+B,EAAE,OAAO;AAAA,EAC5C,KAAK,EAAE,OAAO;AAAA,EACd,KAAK,EAAE,OAAO;AAAA,EACd,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,EACzB,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,EACzB,KAAK,EAAE,OAAO;AAAA,EACd,KAAK,EAAE,OAAO;AAChB,CAAC;AA6BD,SAAS,eAAe,OAA+C;AACrE,QAAM,UAAU,OAAO,KAAK;AAC5B,SAAO,UAAU,UAAU;AAC7B;AAEO,MAAM,kCAAkC,MAAM;AAAA,EACnD,YACE,SACgB,YAChB;AACA,UAAM,OAAO;AAFG;AAGhB,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,qBAAqB;AAAA,EAChC,YACmB,IACA,iBACA,YACA,wBACA,iBAAuC,yBAAyB,GACjF;AALiB;AACA;AACA;AACA;AACA;AAAA,EAChB;AAAA,EAEH,MAAM,YAAY,OAAuD;AACvE,UAAM,KAAK,kCAAkC;AAC7C,UAAM,SAA2C,EAAE,WAAW,KAAK;AACnE,QAAI,SAAS,CAAC,MAAM,cAAc;AAChC,UAAI,CAAC,MAAM,SAAU,QAAO,CAAC;AAC5B,MAAC,OAAmC,MAAM;AAAA,QACzC,EAAE,UAAU,MAAM,SAAS;AAAA,QAC3B,EAAE,UAAU,KAAK;AAAA,MACnB;AAAA,IACF;AACA,WAAO,KAAK,GAAG;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,QACE,SAAS;AAAA,UACP,kBAAkB;AAAA,UAClB,UAAU;AAAA,UACV,gBAAgB;AAAA,UAChB,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,cAAc,IAAY,OAA4D;AAC1F,UAAM,KAAK,kCAAkC;AAC7C,UAAM,SAAS,MAAM,KAAK,GAAG,QAAQ,qBAAqB,EAAE,IAAI,WAAW,KAAK,CAAC;AACjF,QAAI,CAAC,OAAQ,QAAO;AACpB,QAAI,SAAS,CAAC,KAAK,uBAAuB,QAAQ,KAAK,EAAG,QAAO;AACjE,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,YACJ,kBACA,UACA,gBACmC;AACnC,UAAM,KAAK,kCAAkC;AAC7C,WAAO,KAAK,kBAAkB,KAAK,IAAI,kBAAkB,YAAY,MAAM,kBAAkB,IAAI;AAAA,EACnG;AAAA,EAEA,MAAM,SACJ,QACA,kBACA,SAOC;AACD,UAAM,OAAO,MAAM,KAAK,cAAc,MAAM;AAC5C,QAAI,CAAC,MAAM,UAAU;AACnB,YAAM,IAAI,0BAA0B,kBAAkB,GAAG;AAAA,IAC3D;AACA,UAAM,gBAAgB,SAAS,aAAa,SAAY,QAAQ,WAAW,KAAK;AAChF,UAAM,sBAAsB,SAAS,mBAAmB,SAAY,QAAQ,iBAAiB,KAAK;AAClG,UAAM,aAAa,MAAM,KAAK;AAAA,MAC5B;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,QAAI,CAAC,WAAW,aAAa,CAAC,WAAW,QAAQ;AAC/C,aAAO,EAAE,UAAU,MAAM;AAAA,IAC3B;AAEA,UAAM,cAAc,MAAM,KAAK,WAAW,eAAe,MAAM;AAC/D,UAAM,SAAS,KAAK,uBAAuB,WAAW,OAAO,iBAAiB,YAAY,QAAQ,QAAQ,gBAAgB;AAE1H,QAAI,eAAe,YAAY,EAAE,EAAE,SAAS,KAAK;AACjD,QAAI;AACJ,QAAI,WAAW,OAAO;AACpB,YAAM,YAAY,MAAM,KAAK,uBAAuB,gBAAgB,MAAM;AAC1E,qBAAe,UAAU;AACzB,4BAAsB,UAAU;AAAA,IAClC;AAEA,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,eAAe,KAAK,qBAAqB;AACtF,UAAM,UAAU,KAAK,GAAG,OAAO,aAAa;AAAA,MAC1C;AAAA,MACA,UAAU,KAAK;AAAA,MACf;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc,WAAW,OAAO;AAAA,MAChC,qBAAqB,WAAW,OAAO;AAAA,MACvC;AAAA,MACA,iBAAiB;AAAA,MACjB;AAAA,MACA,YAAY;AAAA,MACZ,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AACD,SAAK,GAAG,QAAQ,OAAO;AACvB,UAAM,KAAK,GAAG,MAAM;AAEpB,UAAM,kBAAkB,4BAA4B;AAAA,MAClD;AAAA,MACA,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB;AAAA,MACA;AAAA,IACF,CAAC;AAED,WAAO;AAAA,MACL,UAAU;AAAA,MACV,WAAW,QAAQ;AAAA,MACnB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,QACJ,WACA,YACA,UAAuC,CAAC,GACxC,SACmD;AACnD,UAAM,UAAU,MAAM,KAAK,kBAAkB,SAAS;AACtD,QAAI,QAAQ,kBAAkB,QAAQ,WAAW,QAAQ,gBAAgB;AACvE,YAAM,IAAI,0BAA0B,gCAAgC,GAAG;AAAA,IACzE;AACA,QAAI,QAAQ,oBAAoB,OAAO;AACrC,YAAM,IAAI,0BAA0B,0CAA0C,GAAG;AAAA,IACnF;AACA,WAAO,KAAK,uBAAuB;AAAA,MACjC,QAAQ;AAAA,MACR;AAAA,MACA,EAAE,QAAQ;AAAA,MACV,EAAE,QAAQ,QAAQ,OAAO;AAAA,IAC3B;AAAA,EACF;AAAA,EAEA,MAAM,OACJ,WACA,YACA,SACA,SAMA,SACiD;AACjD,UAAM,UAAU,MAAM,KAAK,kBAAkB,SAAS;AACtD,QAAI,QAAQ,kBAAkB,QAAQ,WAAW,QAAQ,gBAAgB;AACvE,YAAM,IAAI,0BAA0B,gCAAgC,GAAG;AAAA,IACzE;AACA,UAAM,OAAO,MAAM,KAAK,cAAc,QAAQ,MAAM;AACpD,QAAI,CAAC,MAAM,UAAU;AACnB,YAAM,IAAI,0BAA0B,kBAAkB,GAAG;AAAA,IAC3D;AACA,QAAI,KAAK,aAAa,QAAQ,UAAU;AACtC,YAAM,IAAI,0BAA0B,mCAAmC,GAAG;AAAA,IAC5E;AAEA,UAAM,oBAAoB,QAAQ,aAAa,SAAY,QAAQ,WAAW,KAAK;AACnF,UAAM,0BAA0B,QAAQ,mBAAmB,SAAY,QAAQ,iBAAiB,KAAK;AACrG,QACE,QAAQ,qBAAqB,QAAQ,oBAClC,sBAAsB,QAAQ,iBAC9B,4BAA4B,QAAQ,qBACvC;AACA,YAAM,IAAI,0BAA0B,mCAAmC,GAAG;AAAA,IAC5E;AAEA,UAAM,gBAAgB,QAAQ,iBAAiB;AAC/C,UAAM,sBAAsB,QAAQ,uBAAuB;AAC3D,UAAM,aAAa,MAAM,KAAK;AAAA,MAC5B,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,WAAW,aAAa,CAAC,WAAW,QAAQ;AAC/C,YAAM,IAAI,0BAA0B,qDAAqD,GAAG;AAAA,IAC9F;AACA,QACE,WAAW,OAAO,OAAO,QAAQ,gBAC9B,WAAW,OAAO,UAAU,QAAQ,MAAM,QAAQ,qBAAqB,QAAQ,GAClF;AACA,YAAM,IAAI,0BAA0B,mCAAmC,GAAG;AAAA,IAC5E;AAEA,QAAI,WAAW;AACf,QAAI,aAAqB;AACzB,QAAI,QAAQ,oBAAoB,YAAY;AAC1C,YAAM,WAAW,KAAK,aAAa,OAAO;AAC1C,iBAAW,MAAM,KAAK,gBAAgB,eAAe,QAAQ,QAAQ,QAAQ;AAC7E,mBAAa,wBAAwB;AAAA,IACvC,OAAO;AACL,iBAAW,MAAM,KAAK,uBAAuB;AAAA,QAC3C,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA,EAAE,QAAQ;AAAA,QACV,EAAE,QAAQ,QAAQ,OAAO;AAAA,MAC3B;AAAA,IACF;AAEA,QAAI,CAAC,UAAU;AACb,YAAM,kBAAkB,wBAAwB;AAAA,QAC9C,QAAQ,QAAQ;AAAA,QAChB,UAAU,KAAK;AAAA,QACf,gBAAgB,KAAK;AAAA,QACrB,kBAAkB,QAAQ;AAAA,QAC1B,QAAQ;AAAA,MACV,CAAC;AACD,YAAM,IAAI,0BAA0B,mCAAmC,GAAG;AAAA,IAC5E;AAEA,UAAM,eAAe,QAAQ;AAC7B,UAAM,EAAE,WAAW,WAAW,WAAW,IAAI,MAAM,KAAK,GAAG,cAAc,OAAO,oBAAoB;AAClG,YAAM,gBAAgB,QAAQ,mDAAmD;AACjF,YAAM,oBAAoB,MAAM,KAAK;AAAA,QACnC;AAAA,QACA,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,MACF;AACA,UACE,CAAC,kBAAkB,aAChB,CAAC,kBAAkB,UACnB,kBAAkB,OAAO,OAAO,QAAQ,gBACxC,kBAAkB,OAAO,UAAU,QAAQ,MAAM,QAAQ,oBAAoB,QAAQ,GACxF;AACA,cAAM,IAAI,0BAA0B,mCAAmC,GAAG;AAAA,MAC5E;AAEA,YAAM,aAAa,KAAK,aAAa,kBAAkB,OAAO,UAAU;AACxE,YAAM,oBAAoB,oBAAI,KAAK;AACnC,YAAM,mBAAmB,IAAI,KAAK,KAAK,IAAI,IAAI,aAAa,GAAI;AAChE,YAAM,mBAAmB,KAAK,UAAU;AAAA,QACtC,KAAK,QAAQ;AAAA,QACb,KAAK,QAAQ;AAAA,QACb,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK,QAAQ;AAAA,QACb,KAAK,iBAAiB,QAAQ;AAAA,MAChC,CAAC;AACD,YAAM,eAAe,MAAM,gBAAgB;AAAA,QACzC;AAAA,QACA;AAAA,UACE,IAAI,QAAQ;AAAA,UACZ,cAAc;AAAA,UACd,YAAY;AAAA,UACZ,WAAW,EAAE,KAAK,kBAAkB;AAAA,QACtC;AAAA,QACA;AAAA,UACE,cAAc;AAAA,UACd,WAAW;AAAA,UACX,YAAY;AAAA,QACd;AAAA,MACF;AACA,UAAI,iBAAiB,GAAG;AACtB,cAAM,IAAI,0BAA0B,mCAAmC,GAAG;AAAA,MAC5E;AACA,aAAO;AAAA,QACL,WAAW;AAAA,QACX,WAAW;AAAA,QACX,YAAY;AAAA,MACd;AAAA,IACF,CAAC;AACD,YAAQ,eAAe;AACvB,YAAQ,YAAY;AACpB,YAAQ,aAAa;AAErB,UAAM,kBAAkB,0BAA0B;AAAA,MAChD,QAAQ,QAAQ;AAAA,MAChB,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB,kBAAkB,QAAQ;AAAA,MAC1B,QAAQ;AAAA,MACR,WAAW,UAAU,YAAY;AAAA,IACnC,CAAC;AAED,WAAO,EAAE,WAAW,UAAU;AAAA,EAChC;AAAA,EAEA,MAAM,cACJ,OACA,kBACA,SAKkB;AAClB,QAAI,CAAC,MAAO,QAAO;AACnB,UAAM,UAAU,KAAK,gBAAgB,KAAK;AAC1C,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,QAAQ,OAAO,KAAK,IAAI,EAAG,QAAO;AACtC,QAAI,QAAQ,QAAQ,iBAAkB,QAAO;AAC7C,QAAI,SAAS,kBAAkB,QAAQ,QAAQ,QAAQ,eAAgB,QAAO;AAC9E,QAAI,SAAS,aAAa,UAAa,QAAQ,SAAS,QAAQ,YAAY,MAAO,QAAO;AAC1F,QAAI,SAAS,mBAAmB,UAAa,QAAQ,SAAS,QAAQ,kBAAkB,MAAO,QAAO;AAEtG,UAAM,UAAU,MAAM,KAAK,GAAG,QAAQ,aAAa;AAAA,MACjD,IAAI,QAAQ;AAAA,MACZ,QAAQ,QAAQ;AAAA,MAChB,cAAc;AAAA,MACd;AAAA,MACA,eAAe,QAAQ;AAAA,MACvB,qBAAqB,QAAQ;AAAA,MAC7B,YAAY,EAAE,KAAK,KAAK;AAAA,IAC1B,CAA6B;AAE7B,WAAO,QAAQ,WAAW,QAAQ,UAAU,QAAQ,IAAI,KAAK,IAAI,CAAC;AAAA,EACpE;AAAA,EAEA,MAAM,aACJ,OACA,cACA,OAC8B;AAC9B,UAAM,KAAK,kCAAkC;AAC7C,UAAM,gBAAgB,MAAM,YAAY;AACxC,UAAM,sBAAsB,MAAM,kBAAkB;AACpD,SAAK,cAAc,eAAe,mBAAmB;AACrD,QAAI,MAAO,MAAK,iBAAiB,eAAe,qBAAqB,KAAK;AAC1E,UAAM,KAAK,mBAAmB,MAAM,kBAAkB,eAAe,mBAAmB;AAExF,UAAM,SAAS,KAAK,GAAG,OAAO,qBAAqB;AAAA,MACjD,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB,OAAO,MAAM,SAAS;AAAA,MACtB,kBAAkB,MAAM;AAAA,MACxB,WAAW,MAAM;AAAA,MACjB,YAAY,KAAK,aAAa,MAAM,UAAU;AAAA,MAC9C,iBAAiB,MAAM;AAAA,MACvB;AAAA,MACA,oBAAoB;AAAA,MACpB,WAAW,oBAAI,KAAK;AAAA,MACpB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AACD,SAAK,GAAG,QAAQ,MAAM;AACtB,UAAM,KAAK,GAAG,MAAM;AAEpB,UAAM,kBAAkB,gCAAgC;AAAA,MACtD,IAAI,OAAO;AAAA,MACX,kBAAkB,OAAO;AAAA,MACzB;AAAA,IACF,CAAC;AAED,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,aACJ,IACA,OACA,cACA,OAC8B;AAC9B,UAAM,KAAK,kCAAkC;AAC7C,UAAM,SAAS,MAAM,KAAK,GAAG,QAAQ,qBAAqB,EAAE,IAAI,WAAW,KAAK,CAAC;AACjF,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,0BAA0B,gCAAgC,GAAG;AAAA,IACzE;AACA,QAAI,OAAO;AACT,WAAK,iBAAiB,OAAO,YAAY,MAAM,OAAO,kBAAkB,MAAM,KAAK;AACnF,UAAI,OAAO,sBAAsB,CAAC,MAAM,cAAc;AACpD,cAAM,IAAI,0BAA0B,gCAAgC,GAAG;AAAA,MACzE;AAAA,IACF;AAEA,UAAM,eAAe,MAAM,aAAa,SAAY,MAAM,YAAY,OAAO,OAAO,YAAY;AAChG,UAAM,qBAAqB,MAAM,mBAAmB,SAAY,MAAM,kBAAkB,OAAO,OAAO,kBAAkB;AACxH,UAAM,uBAAuB,MAAM,oBAAoB,OAAO;AAC9D,SAAK,cAAc,cAAc,kBAAkB;AACnD,QAAI,MAAO,MAAK,iBAAiB,cAAc,oBAAoB,KAAK;AACxE,UAAM,KAAK,mBAAmB,sBAAsB,cAAc,oBAAoB,OAAO,EAAE;AAE/F,QAAI,MAAM,aAAa,OAAW,QAAO,WAAW,MAAM,YAAY;AACtE,QAAI,MAAM,mBAAmB,OAAW,QAAO,iBAAiB,MAAM,kBAAkB;AACxF,QAAI,MAAM,UAAU,OAAW,QAAO,QAAQ,MAAM,SAAS;AAC7D,QAAI,MAAM,qBAAqB,OAAW,QAAO,mBAAmB,MAAM;AAC1E,QAAI,MAAM,cAAc,OAAW,QAAO,YAAY,MAAM;AAC5D,QAAI,MAAM,eAAe,OAAW,QAAO,aAAa,KAAK,aAAa,MAAM,UAAU;AAC1F,QAAI,MAAM,oBAAoB,OAAW,QAAO,kBAAkB,MAAM;AACxE,WAAO,eAAe;AACtB,WAAO,YAAY,oBAAI,KAAK;AAC5B,UAAM,KAAK,GAAG,MAAM;AAEpB,UAAM,kBAAkB,gCAAgC;AAAA,MACtD,IAAI,OAAO;AAAA,MACX,kBAAkB,OAAO;AAAA,MACzB;AAAA,IACF,CAAC;AAED,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,aAAa,IAAY,OAAsC;AACnE,UAAM,SAAS,MAAM,KAAK,GAAG,QAAQ,qBAAqB,EAAE,IAAI,WAAW,KAAK,CAAC;AACjF,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,0BAA0B,gCAAgC,GAAG;AAAA,IACzE;AACA,QAAI,OAAO;AACT,WAAK,iBAAiB,OAAO,YAAY,MAAM,OAAO,kBAAkB,MAAM,KAAK;AACnF,UAAI,OAAO,sBAAsB,CAAC,MAAM,cAAc;AACpD,cAAM,IAAI,0BAA0B,gCAAgC,GAAG;AAAA,MACzE;AAAA,IACF;AACA,WAAO,YAAY,oBAAI,KAAK;AAC5B,WAAO,YAAY,oBAAI,KAAK;AAC5B,UAAM,KAAK,GAAG,MAAM;AAEpB,UAAM,kBAAkB,gCAAgC;AAAA,MACtD,IAAI,OAAO;AAAA,MACX,kBAAkB,OAAO;AAAA,IAC3B,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,yBACJ,OACe;AACf,UAAM,WAAW,MAAM,KAAK,GAAG,QAAQ,qBAAqB;AAAA,MAC1D,kBAAkB,MAAM;AAAA,MACxB,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB,oBAAoB;AAAA,IACtB,CAAC;AAED,QAAI,UAAU;AACZ,YAAM,aAAa,KAAK,aAAa,MAAM,UAAU;AACrD,YAAM,kBAAkB,MAAM,mBAAmB,gBAAgB;AACjE,YAAM,UAAU,CAAC,SAAS,aACrB,QAAQ,SAAS,SAAS,KAC1B,SAAS,eAAe,cACxB,SAAS,oBAAoB;AAClC,UAAI,SAAS;AACX,iBAAS,YAAY;AACrB,iBAAS,YAAY;AACrB,iBAAS,aAAa;AACtB,iBAAS,kBAAkB;AAC3B,iBAAS,YAAY,oBAAI,KAAK;AAC9B,cAAM,KAAK,GAAG,MAAM;AAAA,MACtB;AACA;AAAA,IACF;AAEA,UAAM,SAAS,KAAK,GAAG,OAAO,qBAAqB;AAAA,MACjD,UAAU;AAAA,MACV,gBAAgB;AAAA,MAChB,OAAO,MAAM,SAAS;AAAA,MACtB,kBAAkB,MAAM;AAAA,MACxB,WAAW;AAAA,MACX,oBAAoB;AAAA,MACpB,YAAY,KAAK,aAAa,MAAM,UAAU;AAAA,MAC9C,iBAAiB,MAAM,mBAAmB,gBAAgB;AAAA,MAC1D,cAAc;AAAA,MACd,WAAW,oBAAI,KAAK;AAAA,MACpB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AACD,SAAK,GAAG,QAAQ,MAAM;AACtB,UAAM,KAAK,GAAG,MAAM;AAAA,EACtB;AAAA,EAEA,MAAM,iBAAkC;AACtC,WAAO,KAAK,GAAG,aAAa,aAAa;AAAA,MACvC,WAAW,EAAE,MAAM,oBAAI,KAAK,EAAE;AAAA,IAChC,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,oCAAmD;AAC/D,UAAM,kBAAkB,6BAA6B;AACrD,UAAM,kBAAkB,gBAAgB,QAAQ,CAAC,UAAU,MAAM,WAAW,CAAC,CAAC;AAC9E,UAAM,kBAAkB,gBAAgB,WAAW,IAAI,qBAAqB,CAAC;AAE7E,eAAW,UAAU,kBAAkB;AAAA,MACrC,GAAG;AAAA,MACH,GAAG;AAAA,IACL,CAAC,GAAG;AACF,YAAM,KAAK,yBAAyB,KAAK,qBAAqB,MAAM,CAAC;AAAA,IACvE;AAAA,EACF;AAAA,EAEQ,qBAAqB,QAAqD;AAChF,WAAO;AAAA,MACL,kBAAkB,OAAO;AAAA,MACzB,OAAO,OAAO,SAAS;AAAA,MACvB,YAAY,OAAO;AAAA,MACnB,iBAAiB,KAAK,kBAAkB,OAAO,eAAe;AAAA,IAChE;AAAA,EACF;AAAA,EAEA,MAAc,mBACZ,kBACA,UACA,gBACA,UACe;AACf,UAAM,WAAW,MAAM,KAAK,GAAG,QAAQ,qBAAqB;AAAA,MAC1D;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AACD,QAAI,YAAY,SAAS,OAAO,UAAU;AACxC,YAAM,IAAI,0BAA0B,iEAAiE,GAAG;AAAA,IAC1G;AAAA,EACF;AAAA,EAEQ,cAAc,UAAyB,gBAAqC;AAClF,QAAI,kBAAkB,CAAC,UAAU;AAC/B,YAAM,IAAI,0BAA0B,qDAAqD,GAAG;AAAA,IAC9F;AAAA,EACF;AAAA,EAEQ,uBAAuB,QAA6B,OAA+B;AACzF,QAAI,MAAM,aAAc,QAAO;AAC/B,QAAI,CAAC,MAAM,SAAU,QAAO;AAC5B,UAAM,iBAAiB,OAAO,YAAY;AAC1C,QAAI,mBAAmB,KAAM,QAAO;AACpC,WAAO,mBAAmB,MAAM;AAAA,EAClC;AAAA,EAEQ,iBACN,gBACA,sBACA,OACM;AACN,QAAI,MAAM,aAAc;AACxB,QAAI,CAAC,MAAM,UAAU;AACnB,YAAM,IAAI,0BAA0B,gCAAgC,GAAG;AAAA,IACzE;AACA,SAAK,kBAAkB,UAAU,MAAM,UAAU;AAC/C,YAAM,IAAI,0BAA0B,gCAAgC,GAAG;AAAA,IACzE;AACA,QACE,MAAM,mBAAmB,UACtB,MAAM,mBAAmB,QACzB,yBAAyB,QACzB,yBAAyB,MAAM,gBAClC;AACA,YAAM,IAAI,0BAA0B,gCAAgC,GAAG;AAAA,IACzE;AAAA,EACF;AAAA,EAEQ,uBACN,kBACA,yBACA,QACA,kBACY;AACZ,QAAI,KAAK,eAAe,IAAI,iBAAiB;AAC3C,UAAI,mBAAmB;AACvB,UAAI;AACF,2BAAmB,KAAK,oCAAoC,kBAAkB,uBAAuB,MAAM;AAAA,MAC7G,QAAQ;AACN,2BAAmB,qBAAqB,gBAAgB;AAAA,MAC1D;AACA,UAAI,kBAAkB;AACpB,4CAAoC,yCAAyC;AAAA,UAC3E;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF,CAAC;AAAA,MACH;AACA,aAAO;AAAA,IACT;AACA,WAAO,KAAK,oCAAoC,kBAAkB,uBAAuB;AAAA,EAC3F;AAAA,EAEQ,oCACN,kBACA,yBACY;AACZ,QAAI,qBAAqB,gBAAgB,SAAU,QAAO;AAC1D,QAAI,qBAAqB,gBAAgB,KAAK;AAC5C,UAAI,4BAA4B,GAAG;AACjC,cAAM,IAAI,0BAA0B,oEAAoE,GAAG;AAAA,MAC7G;AACA,aAAO;AAAA,IACT;AACA,WAAO,0BAA0B,IAAI,QAAQ;AAAA,EAC/C;AAAA,EAEA,MAAc,kBACZ,IACA,kBACA,UACA,gBACmC;AACnC,UAAM,aAAa,MAAM,GAAG,KAAK,qBAAqB;AAAA,MACpD;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AAED,UAAM,WAAW,WACd,OAAO,CAAC,WAAW,KAAK,aAAa,QAAQ,UAAU,cAAc,CAAC,EACtE,KAAK,CAAC,MAAM,UAAU,KAAK,sBAAsB,MAAM,OAAO,UAAU,cAAc,CAAC,EAAE,CAAC;AAE7F,QAAI,CAAC,YAAY,CAAC,SAAS,WAAW;AACpC,aAAO,EAAE,WAAW,MAAM;AAAA,IAC5B;AAEA,WAAO,EAAE,WAAW,MAAM,QAAQ,SAAS;AAAA,EAC7C;AAAA,EAEQ,aAAa,QAA6B,UAAyB,gBAAwC;AACjH,QAAI,OAAO,gBAAgB;AACzB,aAAO,OAAO,mBAAmB,kBAAkB,OAAO,aAAa;AAAA,IACzE;AACA,QAAI,OAAO,UAAU;AACnB,aAAO,OAAO,aAAa;AAAA,IAC7B;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,sBACN,MACA,OACA,UACA,gBACQ;AACR,UAAM,YAAY,KAAK,iBAAiB,MAAM,UAAU,cAAc;AACtE,UAAM,aAAa,KAAK,iBAAiB,OAAO,UAAU,cAAc;AACxE,QAAI,cAAc,WAAY,QAAO,YAAY;AACjD,QAAI,KAAK,uBAAuB,MAAM,oBAAoB;AACxD,aAAO,KAAK,qBAAqB,IAAI;AAAA,IACvC;AACA,WAAO,MAAM,UAAU,QAAQ,IAAI,KAAK,UAAU,QAAQ;AAAA,EAC5D;AAAA,EAEQ,iBACN,QACA,UACA,gBACQ;AACR,QAAI,OAAO,mBAAmB,kBAAkB,OAAO,aAAa,SAAU,QAAO;AACrF,QAAI,CAAC,OAAO,kBAAkB,OAAO,aAAa,SAAU,QAAO;AACnE,QAAI,CAAC,OAAO,kBAAkB,CAAC,OAAO,YAAY,CAAC,OAAO,mBAAoB,QAAO;AACrF,QAAI,CAAC,OAAO,kBAAkB,CAAC,OAAO,YAAY,OAAO,mBAAoB,QAAO;AACpF,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,kBAAkB,WAAqD;AACnF,UAAM,UAAU,MAAM,KAAK,GAAG,QAAQ,aAAa,EAAE,IAAI,UAAU,CAAC;AACpE,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,0BAA0B,oCAAoC,GAAG;AAAA,IAC7E;AACA,QAAI,CAAC,QAAQ,oBAAoB,CAAC,QAAQ,gBAAgB,CAAC,QAAQ,qBAAqB;AACtF,YAAM,IAAI,0BAA0B,oCAAoC,GAAG;AAAA,IAC7E;AACA,QAAI,QAAQ,YAAY;AACtB,YAAM,IAAI,0BAA0B,mCAAmC,GAAG;AAAA,IAC5E;AACA,QAAI,QAAQ,UAAU,QAAQ,KAAK,KAAK,IAAI,GAAG;AAC7C,YAAM,IAAI,0BAA0B,kCAAkC,GAAG;AAAA,IAC3E;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,cAAc,QAA2C;AACrE,UAAM,OAAO,MAAM;AAAA,MACjB,KAAK;AAAA,MACL;AAAA,MACA,EAAE,IAAI,QAAQ,WAAW,KAAK;AAAA,MAC9B;AAAA,MACA,CAAC;AAAA,IACH;AAEA,QAAI,CAAC,KAAM,QAAO;AAClB,WAAO;AAAA,MACL,IAAI,OAAO,KAAK,EAAE;AAAA,MAClB,UAAU,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAAA,MAClD,gBAAgB,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,IACtE;AAAA,EACF;AAAA,EAEQ,aAAa,OAA+B;AAClD,UAAM,WAAW,SAAS,KAAK,eAAe,KAAK;AACnD,WAAO,KAAK;AAAA,MACV,KAAK,IAAI,UAAU,KAAK,eAAe,KAAK,aAAa;AAAA,MACzD,KAAK,eAAe,KAAK;AAAA,IAC3B;AAAA,EACF;AAAA,EAEQ,aAAa,SAA0B;AAC7C,QAAI,CAAC,WAAW,OAAO,YAAY,UAAU;AAC3C,YAAM,IAAI,0BAA0B,wBAAwB,GAAG;AAAA,IACjE;AACA,UAAM,gBAAiB,QAAoC;AAC3D,QAAI,OAAO,kBAAkB,YAAY,cAAc,KAAK,EAAE,WAAW,GAAG;AAC1E,YAAM,IAAI,0BAA0B,wBAAwB,GAAG;AAAA,IACjE;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,UAAU,SAAyC;AACzD,UAAM,iBAAiB,OAAO,KAAK,KAAK,UAAU,OAAO,CAAC,EAAE,SAAS,WAAW;AAChF,UAAM,YAAY,WAAW,UAAU,KAAK,cAAc,CAAC,EAAE,OAAO,cAAc,EAAE,OAAO,WAAW;AACtG,WAAO,GAAG,cAAc,IAAI,SAAS;AAAA,EACvC;AAAA,EAEQ,gBAAgB,OAA8C;AACpE,UAAM,CAAC,gBAAgB,SAAS,IAAI,MAAM,MAAM,GAAG;AACnD,QAAI,CAAC,kBAAkB,CAAC,UAAW,QAAO;AAE1C,UAAM,WAAW,WAAW,UAAU,KAAK,cAAc,CAAC,EAAE,OAAO,cAAc,EAAE,OAAO,WAAW;AACrG,UAAM,kBAAkB,OAAO,KAAK,SAAS;AAC7C,UAAM,iBAAiB,OAAO,KAAK,QAAQ;AAC3C,QAAI,gBAAgB,WAAW,eAAe,OAAQ,QAAO;AAC7D,QAAI,CAAC,gBAAgB,iBAAiB,cAAc,EAAG,QAAO;AAE9D,QAAI;AACF,YAAM,SAAS,6BAA6B;AAAA,QAC1C,KAAK,MAAM,OAAO,KAAK,gBAAgB,WAAW,EAAE,SAAS,MAAM,CAAC;AAAA,MACtE;AACA,UAAI,CAAC,OAAO,QAAS,QAAO;AAC5B,aAAO,OAAO;AAAA,IAChB,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,gBAAwB;AAC9B,UAAM,SACJ,eAAe,QAAQ,IAAI,uBAAuB,KAC/C,eAAe,QAAQ,IAAI,eAAe,KAC1C,eAAe,QAAQ,IAAI,WAAW,KACtC,eAAe,QAAQ,IAAI,UAAU;AAC1C,QAAI,OAAQ,QAAO;AACnB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,kBACN,QAC6B;AAC7B,YAAQ,QAAQ;AAAA,MACd,KAAK;AACH,eAAO,gBAAgB;AAAA,MACzB,KAAK;AACH,eAAO,gBAAgB;AAAA,MACzB,KAAK;AAAA,MACL;AACE,eAAO,gBAAgB;AAAA,IAC3B;AAAA,EACF;AACF;AAEA,IAAO,+BAAQ;",
   "names": []
 }

package/dist/modules/sso/backend/page.js

@@ -159,6 +159,7 @@ function SsoConfigListPage() {
           pageSize: 50,
           total: data.total,
           totalPages: data.totalPages,
+          totalIsCapped: data?.totalIsCapped === true,
           onPageChange: setPage
         },
         isLoading

package/dist/modules/sso/backend/page.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/sso/backend/page.tsx"],
-  "sourcesContent": ["'use client'\n\nimport React from 'react'\nimport { useRouter } from 'next/navigation'\nimport type { LegacyColumnDef as ColumnDef } from '@tanstack/react-table/legacy'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { DataTable } from '@open-mercato/ui/backend/DataTable'\nimport { RowActions } from '@open-mercato/ui/backend/RowActions'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { apiCall, apiCallOrThrow } from '@open-mercato/ui/backend/utils/apiCall'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport Link from 'next/link'\n\ninterface SsoConfigRow {\n  id: string\n  name: string | null\n  protocol: string\n  issuer: string | null\n  allowedDomains: string[]\n  isActive: boolean\n  hasClientSecret: boolean\n  organizationId: string\n  tenantId: string | null\n  createdAt: string\n}\n\ninterface ListResponse {\n  items: SsoConfigRow[]\n  total: number\n  totalPages: number\n  isSuperAdmin?: boolean\n}\n\nconst fallback: ListResponse = { items: [], total: 0, totalPages: 1 }\n\nexport default function SsoConfigListPage() {\n  const router = useRouter()\n  const t = useT()\n\n  const [data, setData] = React.useState<ListResponse>(fallback)\n  const [isLoading, setIsLoading] = React.useState(true)\n  const [page, setPage] = React.useState(1)\n  const [search, setSearch] = React.useState('')\n  const { confirm, ConfirmDialogElement } = useConfirmDialog()\n\n  const isSuperAdmin = !!data.isSuperAdmin\n\n  const fetchData = React.useCallback(async () => {\n    setIsLoading(true)\n    const params = new URLSearchParams()\n    params.set('page', String(page))\n    params.set('pageSize', '50')\n    if (search) params.set('search', search)\n\n    const call = await apiCall<ListResponse>(`/api/sso/config?${params}`, undefined, { fallback })\n    if (call.ok && call.result) {\n      setData(call.result)\n    }\n    setIsLoading(false)\n  }, [page, search])\n\n  React.useEffect(() => { fetchData() }, [fetchData])\n\n  const handleDelete = async (row: SsoConfigRow) => {\n    if (row.isActive) {\n      flash(t('sso.admin.error.deleteActive', 'Cannot delete an active SSO configuration \u2014 deactivate it first'), 'error')\n      return\n    }\n\n    const confirmed = await confirm({\n      title: t('sso.admin.delete.title', 'Delete SSO Configuration'),\n      text: t('sso.admin.delete.confirm', 'Are you sure? This will remove the SSO configuration. Users with linked SSO identities will need to use password login.'),\n      confirmText: t('common.delete', 'Delete'),\n      variant: 'destructive',\n    })\n\n    if (!confirmed) return\n\n    await apiCallOrThrow(`/api/sso/config/${row.id}`, { method: 'DELETE' }, {\n      errorMessage: t('sso.admin.error.deleteFailed', 'Failed to delete SSO configuration'),\n    })\n    flash(t('sso.admin.delete.success', 'SSO configuration deleted'), 'success')\n    fetchData()\n  }\n\n  const handleToggleActivation = async (row: SsoConfigRow) => {\n    try {\n      await apiCallOrThrow(\n        `/api/sso/config/${row.id}/activate`,\n        {\n          method: 'POST',\n          headers: { 'content-type': 'application/json' },\n          body: JSON.stringify({ active: !row.isActive }),\n        },\n        { errorMessage: t('sso.admin.error.activationFailed', 'Failed to update activation status') },\n      )\n      flash(\n        row.isActive\n          ? t('sso.admin.deactivated', 'SSO configuration deactivated')\n          : t('sso.admin.activated', 'SSO configuration activated'),\n        'success',\n      )\n      fetchData()\n    } catch {\n      // apiCallOrThrow already flashes the error\n    }\n  }\n\n  const handleTestConnection = async (row: SsoConfigRow) => {\n    try {\n      const call = await apiCallOrThrow<{ ok: boolean; error?: string }>(\n        `/api/sso/config/${row.id}/test`,\n        { method: 'POST' },\n        { errorMessage: t('sso.admin.error.testFailed', 'Connection test failed') },\n      )\n      if (call.result?.ok) {\n        flash(t('sso.admin.test.success', 'Discovery successful \u2014 issuer is reachable'), 'success')\n      } else {\n        flash(call.result?.error || t('sso.admin.test.failed', 'Discovery failed'), 'error')\n      }\n    } catch {\n      // apiCallOrThrow already flashes the error\n    }\n  }\n\n  const columns = React.useMemo<ColumnDef<SsoConfigRow>[]>(() => {\n    const cols: ColumnDef<SsoConfigRow>[] = [\n      {\n        accessorKey: 'name',\n        header: t('sso.admin.column.name', 'Name'),\n        cell: ({ row }) => row.original.name || row.original.issuer || '\u2014',\n      },\n      {\n        accessorKey: 'protocol',\n        header: t('sso.admin.column.protocol', 'Protocol'),\n        cell: ({ row }) => row.original.protocol.toUpperCase(),\n      },\n      {\n        accessorKey: 'allowedDomains',\n        header: t('sso.admin.column.domains', 'Domains'),\n        cell: ({ row }) => row.original.allowedDomains.join(', ') || '\u2014',\n      },\n      {\n        accessorKey: 'isActive',\n        header: t('sso.admin.column.status', 'Status'),\n        cell: ({ row }) => (\n          <span className={`inline-flex items-center rounded-full px-2 py-1 text-xs font-medium ${row.original.isActive ? 'bg-green-50 text-green-700' : 'bg-gray-100 text-gray-600'}`}>\n            {row.original.isActive\n              ? t('sso.admin.status.active', 'Active')\n              : t('sso.admin.status.inactive', 'Inactive')}\n          </span>\n        ),\n      },\n      {\n        accessorKey: 'createdAt',\n        header: t('sso.admin.column.created', 'Created'),\n        cell: ({ row }) => new Date(row.original.createdAt).toLocaleDateString(),\n      },\n    ]\n\n    return cols\n  }, [t, isSuperAdmin])\n\n  const hasConfigs = data.items.length > 0 || search\n  const canCreateNew = isSuperAdmin || data.items.length === 0\n\n  return (\n    <Page>\n      <PageBody>\n        {!hasConfigs && !isLoading ? (\n          <div className=\"flex flex-col items-center justify-center py-16 text-center\">\n            <h3 className=\"text-lg font-semibold mb-2\">\n              {t('sso.admin.empty.title', 'No SSO configured')}\n            </h3>\n            <p className=\"text-muted-foreground mb-4 max-w-md\">\n              {t('sso.admin.empty.description', 'Configure Single Sign-On to let your users authenticate with your identity provider.')}\n            </p>\n            <Button asChild>\n              <Link href=\"/backend/sso/config/new\">\n                {t('sso.admin.empty.cta', 'Configure SSO')}\n              </Link>\n            </Button>\n          </div>\n        ) : (\n          <DataTable<SsoConfigRow>\n            title={t('sso.admin.title', 'Single Sign-On')}\n            actions={canCreateNew ? (\n              <Button asChild size=\"sm\">\n                <Link href=\"/backend/sso/config/new\">\n                  {t('sso.admin.new', 'New SSO Config')}\n                </Link>\n              </Button>\n            ) : undefined}\n            columns={columns}\n            data={data.items}\n            searchValue={search}\n            onSearchChange={(value) => { setSearch(value); setPage(1) }}\n            searchPlaceholder={t('sso.admin.search', 'Search by name or issuer...')}\n            onRowClick={(row) => router.push(`/backend/sso/config/${row.id}`)}\n            rowActions={(row) => (\n              <RowActions\n                items={[\n                  { id: 'edit', label: t('common.edit', 'Edit'), onSelect: () => router.push(`/backend/sso/config/${row.id}`) },\n                  { id: 'test', label: t('sso.admin.action.test', 'Verify Discovery'), onSelect: () => handleTestConnection(row) },\n                  {\n                    id: 'toggle',\n                    label: row.isActive\n                      ? t('sso.admin.action.deactivate', 'Deactivate')\n                      : t('sso.admin.action.activate', 'Activate'),\n                    onSelect: () => handleToggleActivation(row),\n                  },\n                  { id: 'delete', label: t('common.delete', 'Delete'), destructive: true, onSelect: () => handleDelete(row) },\n                ]}\n              />\n            )}\n            pagination={{\n              page,\n              pageSize: 50,\n              total: data.total,\n              totalPages: data.totalPages,\n              onPageChange: setPage,\n            }}\n            isLoading={isLoading}\n          />\n        )}\n        {ConfirmDialogElement}\n      </PageBody>\n    </Page>\n  )\n}\n"],
-  "mappings": ";AAoJU,cAwBA,YAxBA;AAlJV,OAAO,WAAW;AAClB,SAAS,iBAAiB;AAE1B,SAAS,MAAM,gBAAgB;AAC/B,SAAS,iBAAiB;AAC1B,SAAS,kBAAkB;AAC3B,SAAS,cAAc;AACvB,SAAS,SAAS,sBAAsB;AACxC,SAAS,aAAa;AACtB,SAAS,wBAAwB;AACjC,SAAS,YAAY;AACrB,OAAO,UAAU;AAsBjB,MAAM,WAAyB,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,YAAY,EAAE;AAErD,SAAR,oBAAqC;AAC1C,QAAM,SAAS,UAAU;AACzB,QAAM,IAAI,KAAK;AAEf,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAuB,QAAQ;AAC7D,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAS,IAAI;AACrD,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAS,CAAC;AACxC,QAAM,CAAC,QAAQ,SAAS,IAAI,MAAM,SAAS,EAAE;AAC7C,QAAM,EAAE,SAAS,qBAAqB,IAAI,iBAAiB;AAE3D,QAAM,eAAe,CAAC,CAAC,KAAK;AAE5B,QAAM,YAAY,MAAM,YAAY,YAAY;AAC9C,iBAAa,IAAI;AACjB,UAAM,SAAS,IAAI,gBAAgB;AACnC,WAAO,IAAI,QAAQ,OAAO,IAAI,CAAC;AAC/B,WAAO,IAAI,YAAY,IAAI;AAC3B,QAAI,OAAQ,QAAO,IAAI,UAAU,MAAM;AAEvC,UAAM,OAAO,MAAM,QAAsB,mBAAmB,MAAM,IAAI,QAAW,EAAE,SAAS,CAAC;AAC7F,QAAI,KAAK,MAAM,KAAK,QAAQ;AAC1B,cAAQ,KAAK,MAAM;AAAA,IACrB;AACA,iBAAa,KAAK;AAAA,EACpB,GAAG,CAAC,MAAM,MAAM,CAAC;AAEjB,QAAM,UAAU,MAAM;AAAE,cAAU;AAAA,EAAE,GAAG,CAAC,SAAS,CAAC;AAElD,QAAM,eAAe,OAAO,QAAsB;AAChD,QAAI,IAAI,UAAU;AAChB,YAAM,EAAE,gCAAgC,sEAAiE,GAAG,OAAO;AACnH;AAAA,IACF;AAEA,UAAM,YAAY,MAAM,QAAQ;AAAA,MAC9B,OAAO,EAAE,0BAA0B,0BAA0B;AAAA,MAC7D,MAAM,EAAE,4BAA4B,yHAAyH;AAAA,MAC7J,aAAa,EAAE,iBAAiB,QAAQ;AAAA,MACxC,SAAS;AAAA,IACX,CAAC;AAED,QAAI,CAAC,UAAW;AAEhB,UAAM,eAAe,mBAAmB,IAAI,EAAE,IAAI,EAAE,QAAQ,SAAS,GAAG;AAAA,MACtE,cAAc,EAAE,gCAAgC,oCAAoC;AAAA,IACtF,CAAC;AACD,UAAM,EAAE,4BAA4B,2BAA2B,GAAG,SAAS;AAC3E,cAAU;AAAA,EACZ;AAEA,QAAM,yBAAyB,OAAO,QAAsB;AAC1D,QAAI;AACF,YAAM;AAAA,QACJ,mBAAmB,IAAI,EAAE;AAAA,QACzB;AAAA,UACE,QAAQ;AAAA,UACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,UAC9C,MAAM,KAAK,UAAU,EAAE,QAAQ,CAAC,IAAI,SAAS,CAAC;AAAA,QAChD;AAAA,QACA,EAAE,cAAc,EAAE,oCAAoC,oCAAoC,EAAE;AAAA,MAC9F;AACA;AAAA,QACE,IAAI,WACA,EAAE,yBAAyB,+BAA+B,IAC1D,EAAE,uBAAuB,6BAA6B;AAAA,QAC1D;AAAA,MACF;AACA,gBAAU;AAAA,IACZ,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,QAAM,uBAAuB,OAAO,QAAsB;AACxD,QAAI;AACF,YAAM,OAAO,MAAM;AAAA,QACjB,mBAAmB,IAAI,EAAE;AAAA,QACzB,EAAE,QAAQ,OAAO;AAAA,QACjB,EAAE,cAAc,EAAE,8BAA8B,wBAAwB,EAAE;AAAA,MAC5E;AACA,UAAI,KAAK,QAAQ,IAAI;AACnB,cAAM,EAAE,0BAA0B,iDAA4C,GAAG,SAAS;AAAA,MAC5F,OAAO;AACL,cAAM,KAAK,QAAQ,SAAS,EAAE,yBAAyB,kBAAkB,GAAG,OAAO;AAAA,MACrF;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,QAAM,UAAU,MAAM,QAAmC,MAAM;AAC7D,UAAM,OAAkC;AAAA,MACtC;AAAA,QACE,aAAa;AAAA,QACb,QAAQ,EAAE,yBAAyB,MAAM;AAAA,QACzC,MAAM,CAAC,EAAE,IAAI,MAAM,IAAI,SAAS,QAAQ,IAAI,SAAS,UAAU;AAAA,MACjE;AAAA,MACA;AAAA,QACE,aAAa;AAAA,QACb,QAAQ,EAAE,6BAA6B,UAAU;AAAA,QACjD,MAAM,CAAC,EAAE,IAAI,MAAM,IAAI,SAAS,SAAS,YAAY;AAAA,MACvD;AAAA,MACA;AAAA,QACE,aAAa;AAAA,QACb,QAAQ,EAAE,4BAA4B,SAAS;AAAA,QAC/C,MAAM,CAAC,EAAE,IAAI,MAAM,IAAI,SAAS,eAAe,KAAK,IAAI,KAAK;AAAA,MAC/D;AAAA,MACA;AAAA,QACE,aAAa;AAAA,QACb,QAAQ,EAAE,2BAA2B,QAAQ;AAAA,QAC7C,MAAM,CAAC,EAAE,IAAI,MACX,oBAAC,UAAK,WAAW,uEAAuE,IAAI,SAAS,WAAW,+BAA+B,2BAA2B,IACvK,cAAI,SAAS,WACV,EAAE,2BAA2B,QAAQ,IACrC,EAAE,6BAA6B,UAAU,GAC/C;AAAA,MAEJ;AAAA,MACA;AAAA,QACE,aAAa;AAAA,QACb,QAAQ,EAAE,4BAA4B,SAAS;AAAA,QAC/C,MAAM,CAAC,EAAE,IAAI,MAAM,IAAI,KAAK,IAAI,SAAS,SAAS,EAAE,mBAAmB;AAAA,MACzE;AAAA,IACF;AAEA,WAAO;AAAA,EACT,GAAG,CAAC,GAAG,YAAY,CAAC;AAEpB,QAAM,aAAa,KAAK,MAAM,SAAS,KAAK;AAC5C,QAAM,eAAe,gBAAgB,KAAK,MAAM,WAAW;AAE3D,SACE,oBAAC,QACC,+BAAC,YACE;AAAA,KAAC,cAAc,CAAC,YACf,qBAAC,SAAI,WAAU,+DACb;AAAA,0BAAC,QAAG,WAAU,8BACX,YAAE,yBAAyB,mBAAmB,GACjD;AAAA,MACA,oBAAC,OAAE,WAAU,uCACV,YAAE,+BAA+B,sFAAsF,GAC1H;AAAA,MACA,oBAAC,UAAO,SAAO,MACb,8BAAC,QAAK,MAAK,2BACR,YAAE,uBAAuB,eAAe,GAC3C,GACF;AAAA,OACF,IAEA;AAAA,MAAC;AAAA;AAAA,QACC,OAAO,EAAE,mBAAmB,gBAAgB;AAAA,QAC5C,SAAS,eACP,oBAAC,UAAO,SAAO,MAAC,MAAK,MACnB,8BAAC,QAAK,MAAK,2BACR,YAAE,iBAAiB,gBAAgB,GACtC,GACF,IACE;AAAA,QACJ;AAAA,QACA,MAAM,KAAK;AAAA,QACX,aAAa;AAAA,QACb,gBAAgB,CAAC,UAAU;AAAE,oBAAU,KAAK;AAAG,kBAAQ,CAAC;AAAA,QAAE;AAAA,QAC1D,mBAAmB,EAAE,oBAAoB,6BAA6B;AAAA,QACtE,YAAY,CAAC,QAAQ,OAAO,KAAK,uBAAuB,IAAI,EAAE,EAAE;AAAA,QAChE,YAAY,CAAC,QACX;AAAA,UAAC;AAAA;AAAA,YACC,OAAO;AAAA,cACL,EAAE,IAAI,QAAQ,OAAO,EAAE,eAAe,MAAM,GAAG,UAAU,MAAM,OAAO,KAAK,uBAAuB,IAAI,EAAE,EAAE,EAAE;AAAA,cAC5G,EAAE,IAAI,QAAQ,OAAO,EAAE,yBAAyB,kBAAkB,GAAG,UAAU,MAAM,qBAAqB,GAAG,EAAE;AAAA,cAC/G;AAAA,gBACE,IAAI;AAAA,gBACJ,OAAO,IAAI,WACP,EAAE,+BAA+B,YAAY,IAC7C,EAAE,6BAA6B,UAAU;AAAA,gBAC7C,UAAU,MAAM,uBAAuB,GAAG;AAAA,cAC5C;AAAA,cACA,EAAE,IAAI,UAAU,OAAO,EAAE,iBAAiB,QAAQ,GAAG,aAAa,MAAM,UAAU,MAAM,aAAa,GAAG,EAAE;AAAA,YAC5G;AAAA;AAAA,QACF;AAAA,QAEF,YAAY;AAAA,UACV;AAAA,UACA,UAAU;AAAA,UACV,OAAO,KAAK;AAAA,UACZ,YAAY,KAAK;AAAA,UACjB,cAAc;AAAA,QAChB;AAAA,QACA;AAAA;AAAA,IACF;AAAA,IAED;AAAA,KACH,GACF;AAEJ;",
+  "sourcesContent": ["'use client'\n\nimport React from 'react'\nimport { useRouter } from 'next/navigation'\nimport type { LegacyColumnDef as ColumnDef } from '@tanstack/react-table/legacy'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { DataTable } from '@open-mercato/ui/backend/DataTable'\nimport { RowActions } from '@open-mercato/ui/backend/RowActions'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { apiCall, apiCallOrThrow } from '@open-mercato/ui/backend/utils/apiCall'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport Link from 'next/link'\n\ninterface SsoConfigRow {\n  id: string\n  name: string | null\n  protocol: string\n  issuer: string | null\n  allowedDomains: string[]\n  isActive: boolean\n  hasClientSecret: boolean\n  organizationId: string\n  tenantId: string | null\n  createdAt: string\n}\n\ninterface ListResponse {\n  items: SsoConfigRow[]\n  total: number\n  totalPages: number\n  totalIsCapped?: boolean\n  isSuperAdmin?: boolean\n}\n\nconst fallback: ListResponse = { items: [], total: 0, totalPages: 1 }\n\nexport default function SsoConfigListPage() {\n  const router = useRouter()\n  const t = useT()\n\n  const [data, setData] = React.useState<ListResponse>(fallback)\n  const [isLoading, setIsLoading] = React.useState(true)\n  const [page, setPage] = React.useState(1)\n  const [search, setSearch] = React.useState('')\n  const { confirm, ConfirmDialogElement } = useConfirmDialog()\n\n  const isSuperAdmin = !!data.isSuperAdmin\n\n  const fetchData = React.useCallback(async () => {\n    setIsLoading(true)\n    const params = new URLSearchParams()\n    params.set('page', String(page))\n    params.set('pageSize', '50')\n    if (search) params.set('search', search)\n\n    const call = await apiCall<ListResponse>(`/api/sso/config?${params}`, undefined, { fallback })\n    if (call.ok && call.result) {\n      setData(call.result)\n    }\n    setIsLoading(false)\n  }, [page, search])\n\n  React.useEffect(() => { fetchData() }, [fetchData])\n\n  const handleDelete = async (row: SsoConfigRow) => {\n    if (row.isActive) {\n      flash(t('sso.admin.error.deleteActive', 'Cannot delete an active SSO configuration \u2014 deactivate it first'), 'error')\n      return\n    }\n\n    const confirmed = await confirm({\n      title: t('sso.admin.delete.title', 'Delete SSO Configuration'),\n      text: t('sso.admin.delete.confirm', 'Are you sure? This will remove the SSO configuration. Users with linked SSO identities will need to use password login.'),\n      confirmText: t('common.delete', 'Delete'),\n      variant: 'destructive',\n    })\n\n    if (!confirmed) return\n\n    await apiCallOrThrow(`/api/sso/config/${row.id}`, { method: 'DELETE' }, {\n      errorMessage: t('sso.admin.error.deleteFailed', 'Failed to delete SSO configuration'),\n    })\n    flash(t('sso.admin.delete.success', 'SSO configuration deleted'), 'success')\n    fetchData()\n  }\n\n  const handleToggleActivation = async (row: SsoConfigRow) => {\n    try {\n      await apiCallOrThrow(\n        `/api/sso/config/${row.id}/activate`,\n        {\n          method: 'POST',\n          headers: { 'content-type': 'application/json' },\n          body: JSON.stringify({ active: !row.isActive }),\n        },\n        { errorMessage: t('sso.admin.error.activationFailed', 'Failed to update activation status') },\n      )\n      flash(\n        row.isActive\n          ? t('sso.admin.deactivated', 'SSO configuration deactivated')\n          : t('sso.admin.activated', 'SSO configuration activated'),\n        'success',\n      )\n      fetchData()\n    } catch {\n      // apiCallOrThrow already flashes the error\n    }\n  }\n\n  const handleTestConnection = async (row: SsoConfigRow) => {\n    try {\n      const call = await apiCallOrThrow<{ ok: boolean; error?: string }>(\n        `/api/sso/config/${row.id}/test`,\n        { method: 'POST' },\n        { errorMessage: t('sso.admin.error.testFailed', 'Connection test failed') },\n      )\n      if (call.result?.ok) {\n        flash(t('sso.admin.test.success', 'Discovery successful \u2014 issuer is reachable'), 'success')\n      } else {\n        flash(call.result?.error || t('sso.admin.test.failed', 'Discovery failed'), 'error')\n      }\n    } catch {\n      // apiCallOrThrow already flashes the error\n    }\n  }\n\n  const columns = React.useMemo<ColumnDef<SsoConfigRow>[]>(() => {\n    const cols: ColumnDef<SsoConfigRow>[] = [\n      {\n        accessorKey: 'name',\n        header: t('sso.admin.column.name', 'Name'),\n        cell: ({ row }) => row.original.name || row.original.issuer || '\u2014',\n      },\n      {\n        accessorKey: 'protocol',\n        header: t('sso.admin.column.protocol', 'Protocol'),\n        cell: ({ row }) => row.original.protocol.toUpperCase(),\n      },\n      {\n        accessorKey: 'allowedDomains',\n        header: t('sso.admin.column.domains', 'Domains'),\n        cell: ({ row }) => row.original.allowedDomains.join(', ') || '\u2014',\n      },\n      {\n        accessorKey: 'isActive',\n        header: t('sso.admin.column.status', 'Status'),\n        cell: ({ row }) => (\n          <span className={`inline-flex items-center rounded-full px-2 py-1 text-xs font-medium ${row.original.isActive ? 'bg-green-50 text-green-700' : 'bg-gray-100 text-gray-600'}`}>\n            {row.original.isActive\n              ? t('sso.admin.status.active', 'Active')\n              : t('sso.admin.status.inactive', 'Inactive')}\n          </span>\n        ),\n      },\n      {\n        accessorKey: 'createdAt',\n        header: t('sso.admin.column.created', 'Created'),\n        cell: ({ row }) => new Date(row.original.createdAt).toLocaleDateString(),\n      },\n    ]\n\n    return cols\n  }, [t, isSuperAdmin])\n\n  const hasConfigs = data.items.length > 0 || search\n  const canCreateNew = isSuperAdmin || data.items.length === 0\n\n  return (\n    <Page>\n      <PageBody>\n        {!hasConfigs && !isLoading ? (\n          <div className=\"flex flex-col items-center justify-center py-16 text-center\">\n            <h3 className=\"text-lg font-semibold mb-2\">\n              {t('sso.admin.empty.title', 'No SSO configured')}\n            </h3>\n            <p className=\"text-muted-foreground mb-4 max-w-md\">\n              {t('sso.admin.empty.description', 'Configure Single Sign-On to let your users authenticate with your identity provider.')}\n            </p>\n            <Button asChild>\n              <Link href=\"/backend/sso/config/new\">\n                {t('sso.admin.empty.cta', 'Configure SSO')}\n              </Link>\n            </Button>\n          </div>\n        ) : (\n          <DataTable<SsoConfigRow>\n            title={t('sso.admin.title', 'Single Sign-On')}\n            actions={canCreateNew ? (\n              <Button asChild size=\"sm\">\n                <Link href=\"/backend/sso/config/new\">\n                  {t('sso.admin.new', 'New SSO Config')}\n                </Link>\n              </Button>\n            ) : undefined}\n            columns={columns}\n            data={data.items}\n            searchValue={search}\n            onSearchChange={(value) => { setSearch(value); setPage(1) }}\n            searchPlaceholder={t('sso.admin.search', 'Search by name or issuer...')}\n            onRowClick={(row) => router.push(`/backend/sso/config/${row.id}`)}\n            rowActions={(row) => (\n              <RowActions\n                items={[\n                  { id: 'edit', label: t('common.edit', 'Edit'), onSelect: () => router.push(`/backend/sso/config/${row.id}`) },\n                  { id: 'test', label: t('sso.admin.action.test', 'Verify Discovery'), onSelect: () => handleTestConnection(row) },\n                  {\n                    id: 'toggle',\n                    label: row.isActive\n                      ? t('sso.admin.action.deactivate', 'Deactivate')\n                      : t('sso.admin.action.activate', 'Activate'),\n                    onSelect: () => handleToggleActivation(row),\n                  },\n                  { id: 'delete', label: t('common.delete', 'Delete'), destructive: true, onSelect: () => handleDelete(row) },\n                ]}\n              />\n            )}\n            pagination={{\n              page,\n              pageSize: 50,\n              total: data.total,\n              totalPages: data.totalPages,\n              totalIsCapped: data?.totalIsCapped === true,\n              onPageChange: setPage,\n            }}\n            isLoading={isLoading}\n          />\n        )}\n        {ConfirmDialogElement}\n      </PageBody>\n    </Page>\n  )\n}\n"],
+  "mappings": ";AAqJU,cAwBA,YAxBA;AAnJV,OAAO,WAAW;AAClB,SAAS,iBAAiB;AAE1B,SAAS,MAAM,gBAAgB;AAC/B,SAAS,iBAAiB;AAC1B,SAAS,kBAAkB;AAC3B,SAAS,cAAc;AACvB,SAAS,SAAS,sBAAsB;AACxC,SAAS,aAAa;AACtB,SAAS,wBAAwB;AACjC,SAAS,YAAY;AACrB,OAAO,UAAU;AAuBjB,MAAM,WAAyB,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,YAAY,EAAE;AAErD,SAAR,oBAAqC;AAC1C,QAAM,SAAS,UAAU;AACzB,QAAM,IAAI,KAAK;AAEf,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAuB,QAAQ;AAC7D,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAS,IAAI;AACrD,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAS,CAAC;AACxC,QAAM,CAAC,QAAQ,SAAS,IAAI,MAAM,SAAS,EAAE;AAC7C,QAAM,EAAE,SAAS,qBAAqB,IAAI,iBAAiB;AAE3D,QAAM,eAAe,CAAC,CAAC,KAAK;AAE5B,QAAM,YAAY,MAAM,YAAY,YAAY;AAC9C,iBAAa,IAAI;AACjB,UAAM,SAAS,IAAI,gBAAgB;AACnC,WAAO,IAAI,QAAQ,OAAO,IAAI,CAAC;AAC/B,WAAO,IAAI,YAAY,IAAI;AAC3B,QAAI,OAAQ,QAAO,IAAI,UAAU,MAAM;AAEvC,UAAM,OAAO,MAAM,QAAsB,mBAAmB,MAAM,IAAI,QAAW,EAAE,SAAS,CAAC;AAC7F,QAAI,KAAK,MAAM,KAAK,QAAQ;AAC1B,cAAQ,KAAK,MAAM;AAAA,IACrB;AACA,iBAAa,KAAK;AAAA,EACpB,GAAG,CAAC,MAAM,MAAM,CAAC;AAEjB,QAAM,UAAU,MAAM;AAAE,cAAU;AAAA,EAAE,GAAG,CAAC,SAAS,CAAC;AAElD,QAAM,eAAe,OAAO,QAAsB;AAChD,QAAI,IAAI,UAAU;AAChB,YAAM,EAAE,gCAAgC,sEAAiE,GAAG,OAAO;AACnH;AAAA,IACF;AAEA,UAAM,YAAY,MAAM,QAAQ;AAAA,MAC9B,OAAO,EAAE,0BAA0B,0BAA0B;AAAA,MAC7D,MAAM,EAAE,4BAA4B,yHAAyH;AAAA,MAC7J,aAAa,EAAE,iBAAiB,QAAQ;AAAA,MACxC,SAAS;AAAA,IACX,CAAC;AAED,QAAI,CAAC,UAAW;AAEhB,UAAM,eAAe,mBAAmB,IAAI,EAAE,IAAI,EAAE,QAAQ,SAAS,GAAG;AAAA,MACtE,cAAc,EAAE,gCAAgC,oCAAoC;AAAA,IACtF,CAAC;AACD,UAAM,EAAE,4BAA4B,2BAA2B,GAAG,SAAS;AAC3E,cAAU;AAAA,EACZ;AAEA,QAAM,yBAAyB,OAAO,QAAsB;AAC1D,QAAI;AACF,YAAM;AAAA,QACJ,mBAAmB,IAAI,EAAE;AAAA,QACzB;AAAA,UACE,QAAQ;AAAA,UACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,UAC9C,MAAM,KAAK,UAAU,EAAE,QAAQ,CAAC,IAAI,SAAS,CAAC;AAAA,QAChD;AAAA,QACA,EAAE,cAAc,EAAE,oCAAoC,oCAAoC,EAAE;AAAA,MAC9F;AACA;AAAA,QACE,IAAI,WACA,EAAE,yBAAyB,+BAA+B,IAC1D,EAAE,uBAAuB,6BAA6B;AAAA,QAC1D;AAAA,MACF;AACA,gBAAU;AAAA,IACZ,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,QAAM,uBAAuB,OAAO,QAAsB;AACxD,QAAI;AACF,YAAM,OAAO,MAAM;AAAA,QACjB,mBAAmB,IAAI,EAAE;AAAA,QACzB,EAAE,QAAQ,OAAO;AAAA,QACjB,EAAE,cAAc,EAAE,8BAA8B,wBAAwB,EAAE;AAAA,MAC5E;AACA,UAAI,KAAK,QAAQ,IAAI;AACnB,cAAM,EAAE,0BAA0B,iDAA4C,GAAG,SAAS;AAAA,MAC5F,OAAO;AACL,cAAM,KAAK,QAAQ,SAAS,EAAE,yBAAyB,kBAAkB,GAAG,OAAO;AAAA,MACrF;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,QAAM,UAAU,MAAM,QAAmC,MAAM;AAC7D,UAAM,OAAkC;AAAA,MACtC;AAAA,QACE,aAAa;AAAA,QACb,QAAQ,EAAE,yBAAyB,MAAM;AAAA,QACzC,MAAM,CAAC,EAAE,IAAI,MAAM,IAAI,SAAS,QAAQ,IAAI,SAAS,UAAU;AAAA,MACjE;AAAA,MACA;AAAA,QACE,aAAa;AAAA,QACb,QAAQ,EAAE,6BAA6B,UAAU;AAAA,QACjD,MAAM,CAAC,EAAE,IAAI,MAAM,IAAI,SAAS,SAAS,YAAY;AAAA,MACvD;AAAA,MACA;AAAA,QACE,aAAa;AAAA,QACb,QAAQ,EAAE,4BAA4B,SAAS;AAAA,QAC/C,MAAM,CAAC,EAAE,IAAI,MAAM,IAAI,SAAS,eAAe,KAAK,IAAI,KAAK;AAAA,MAC/D;AAAA,MACA;AAAA,QACE,aAAa;AAAA,QACb,QAAQ,EAAE,2BAA2B,QAAQ;AAAA,QAC7C,MAAM,CAAC,EAAE,IAAI,MACX,oBAAC,UAAK,WAAW,uEAAuE,IAAI,SAAS,WAAW,+BAA+B,2BAA2B,IACvK,cAAI,SAAS,WACV,EAAE,2BAA2B,QAAQ,IACrC,EAAE,6BAA6B,UAAU,GAC/C;AAAA,MAEJ;AAAA,MACA;AAAA,QACE,aAAa;AAAA,QACb,QAAQ,EAAE,4BAA4B,SAAS;AAAA,QAC/C,MAAM,CAAC,EAAE,IAAI,MAAM,IAAI,KAAK,IAAI,SAAS,SAAS,EAAE,mBAAmB;AAAA,MACzE;AAAA,IACF;AAEA,WAAO;AAAA,EACT,GAAG,CAAC,GAAG,YAAY,CAAC;AAEpB,QAAM,aAAa,KAAK,MAAM,SAAS,KAAK;AAC5C,QAAM,eAAe,gBAAgB,KAAK,MAAM,WAAW;AAE3D,SACE,oBAAC,QACC,+BAAC,YACE;AAAA,KAAC,cAAc,CAAC,YACf,qBAAC,SAAI,WAAU,+DACb;AAAA,0BAAC,QAAG,WAAU,8BACX,YAAE,yBAAyB,mBAAmB,GACjD;AAAA,MACA,oBAAC,OAAE,WAAU,uCACV,YAAE,+BAA+B,sFAAsF,GAC1H;AAAA,MACA,oBAAC,UAAO,SAAO,MACb,8BAAC,QAAK,MAAK,2BACR,YAAE,uBAAuB,eAAe,GAC3C,GACF;AAAA,OACF,IAEA;AAAA,MAAC;AAAA;AAAA,QACC,OAAO,EAAE,mBAAmB,gBAAgB;AAAA,QAC5C,SAAS,eACP,oBAAC,UAAO,SAAO,MAAC,MAAK,MACnB,8BAAC,QAAK,MAAK,2BACR,YAAE,iBAAiB,gBAAgB,GACtC,GACF,IACE;AAAA,QACJ;AAAA,QACA,MAAM,KAAK;AAAA,QACX,aAAa;AAAA,QACb,gBAAgB,CAAC,UAAU;AAAE,oBAAU,KAAK;AAAG,kBAAQ,CAAC;AAAA,QAAE;AAAA,QAC1D,mBAAmB,EAAE,oBAAoB,6BAA6B;AAAA,QACtE,YAAY,CAAC,QAAQ,OAAO,KAAK,uBAAuB,IAAI,EAAE,EAAE;AAAA,QAChE,YAAY,CAAC,QACX;AAAA,UAAC;AAAA;AAAA,YACC,OAAO;AAAA,cACL,EAAE,IAAI,QAAQ,OAAO,EAAE,eAAe,MAAM,GAAG,UAAU,MAAM,OAAO,KAAK,uBAAuB,IAAI,EAAE,EAAE,EAAE;AAAA,cAC5G,EAAE,IAAI,QAAQ,OAAO,EAAE,yBAAyB,kBAAkB,GAAG,UAAU,MAAM,qBAAqB,GAAG,EAAE;AAAA,cAC/G;AAAA,gBACE,IAAI;AAAA,gBACJ,OAAO,IAAI,WACP,EAAE,+BAA+B,YAAY,IAC7C,EAAE,6BAA6B,UAAU;AAAA,gBAC7C,UAAU,MAAM,uBAAuB,GAAG;AAAA,cAC5C;AAAA,cACA,EAAE,IAAI,UAAU,OAAO,EAAE,iBAAiB,QAAQ,GAAG,aAAa,MAAM,UAAU,MAAM,aAAa,GAAG,EAAE;AAAA,YAC5G;AAAA;AAAA,QACF;AAAA,QAEF,YAAY;AAAA,UACV;AAAA,UACA,UAAU;AAAA,UACV,OAAO,KAAK;AAAA,UACZ,YAAY,KAAK;AAAA,UACjB,eAAe,MAAM,kBAAkB;AAAA,UACvC,cAAc;AAAA,QAChB;AAAA,QACA;AAAA;AAAA,IACF;AAAA,IAED;AAAA,KACH,GACF;AAEJ;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/enterprise",
-  "version": "0.7.0",
+  "version": "0.7.1-develop.7102.1.b41f7e3e51",
   "license": "SEE LICENSE IN LICENSE.md",
   "type": "module",
   "main": "./dist/index.js",
@@ -65,8 +65,8 @@
     }
   },
   "dependencies": {
-    "@open-mercato/core": "0.7.0",
-    "@open-mercato/ui": "0.7.0",
+    "@open-mercato/core": "0.7.1-develop.7102.1.b41f7e3e51",
+    "@open-mercato/ui": "0.7.1-develop.7102.1.b41f7e3e51",
     "@simplewebauthn/browser": "^13.3.0",
     "@simplewebauthn/server": "^13.3.2",
     "@simplewebauthn/types": "^12.0.0",
@@ -76,12 +76,12 @@
     "qrcode": "^1.5.4"
   },
   "peerDependencies": {
-    "@open-mercato/shared": "0.7.0",
+    "@open-mercato/shared": "0.7.1-develop.7102.1.b41f7e3e51",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.7.0",
+    "@open-mercato/shared": "0.7.1-develop.7102.1.b41f7e3e51",
     "@types/jest": "^30.0.0",
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
@@ -98,5 +98,6 @@
     "type": "git",
     "url": "https://github.com/open-mercato/open-mercato",
     "directory": "packages/enterprise"
-  }
+  },
+  "stableVersion": "0.7.0"
 }

package/src/modules/security/api/interceptors.ts

@@ -1,6 +1,6 @@
 import type { ApiInterceptor } from '@open-mercato/shared/lib/crud/api-interceptor'
 import { signJwt, verifyJwt } from '@open-mercato/shared/lib/auth/jwt'
-import { readSecurityModuleConfig } from '../lib/security-config'
+import { emitMfaEmergencyBypassActiveWarning, readSecurityModuleConfig } from '../lib/security-config'
 
 type JwtClaims = {
   sub: string
@@ -59,7 +59,6 @@ export const interceptors: ApiInterceptor[] = [
       if (response.statusCode !== 200) return {}
       if (response.body.ok !== true || response.body.mfa_required === true) return {}
       if (typeof response.body.token !== 'string' || response.body.token.length === 0) return {}
-      if (readSecurityModuleConfig().mfa.emergencyBypass) return {}
 
       const claims = readClaims(response.body.token)
       if (!claims) return {}
@@ -67,6 +66,11 @@ export const interceptors: ApiInterceptor[] = [
       const mfaVerificationService = resolveMfaVerificationService(context.container as { resolve: (name: string) => unknown })
       if (!mfaVerificationService) return {}
 
+      if (readSecurityModuleConfig().mfa.emergencyBypass) {
+        emitMfaEmergencyBypassActiveWarning('login MFA challenge bypassed', { userId: claims.sub })
+        return {}
+      }
+
       try {
         const challenge = await mfaVerificationService.createChallenge(claims.sub)
         const pendingToken = signJwt(