@open-mercato/enterprise 0.7.0 → 0.7.1-develop.7102.1.b41f7e3e51

package/src/modules/security/api/mfa/_shared.ts

@@ -3,6 +3,7 @@ import { z } from 'zod'
 import type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import '../../lib/mfaCompletionRoutes'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { signJwt } from '@open-mercato/shared/lib/auth/jwt'
 import type { MfaService, MfaServiceError } from '../../services/MfaService'

package/src/modules/security/data/entities.ts

@@ -174,6 +174,21 @@ export class SudoSession {
   @Property({ name: 'tenant_id', type: 'uuid' })
   tenantId!: string
 
+  @Property({ name: 'scope_tenant_id', type: 'uuid', nullable: true })
+  scopeTenantId?: string | null
+
+  @Property({ name: 'scope_organization_id', type: 'uuid', nullable: true })
+  scopeOrganizationId?: string | null
+
+  @Property({ name: 'target_identifier', type: 'text', nullable: true })
+  targetIdentifier?: string | null
+
+  @Property({ name: 'sudo_config_id', type: 'uuid', nullable: true })
+  sudoConfigId?: string | null
+
+  @Property({ name: 'sudo_config_updated_at', type: Date, nullable: true })
+  sudoConfigUpdatedAt?: Date | null
+
   @Property({ name: 'session_token', type: 'text' })
   sessionToken!: string
 
@@ -183,6 +198,9 @@ export class SudoSession {
   @Property({ name: 'expires_at', type: Date })
   expiresAt!: Date
 
+  @Property({ name: 'verified_at', type: Date, nullable: true })
+  verifiedAt?: Date | null
+
   @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })
   createdAt: Date = new Date()
 }

package/src/modules/security/index.ts

@@ -1,3 +1,7 @@
+import './lib/mfaCompletionRoutes'
+
+export { registerCanonicalMfaCompletionRoutes } from './lib/mfaCompletionRoutes'
+
 export const metadata = {
   id: 'security',
   version: '0.1.0',

package/src/modules/security/lib/enforcement-redirect.ts

@@ -1,7 +1,7 @@
 import type { AuthContext } from '@open-mercato/shared/lib/auth/server'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 import { isEnforcementDeadlineOverdue } from '../services/MfaEnforcementService'
-import { readSecurityModuleConfig } from './security-config'
+import { emitMfaEmergencyBypassActiveWarning, readSecurityModuleConfig } from './security-config'
 
 const MFA_ENROLLMENT_PATH = '/backend/profile/security/mfa'
 const logger = createLogger('security').child({ component: 'mfa-enforcement-redirect' })
@@ -93,11 +93,20 @@ export async function resolveMfaEnrollmentRedirect(args: {
   if (!auth || typeof auth.sub !== 'string' || auth.sub.length === 0) return null
   if (auth.mfa_pending === true) return null
   if (isExemptPath(pathname)) return null
-  if (readSecurityModuleConfig().mfa.emergencyBypass) return null
+
+  const emergencyBypass = readSecurityModuleConfig().mfa.emergencyBypass
 
   const enforcementService = resolveEnforcementService(container)
   if (!enforcementService.service) {
     if (!canFailClosed(auth)) return null
+    if (emergencyBypass) {
+      emitMfaEmergencyBypassActiveWarning('mfa-enrollment-redirect bypassed', {
+        userId: auth.sub,
+        pathname,
+        reason: 'enforcement-service-unavailable',
+      })
+      return null
+    }
     logger.error('Unable to resolve MFA enforcement service; redirecting to enrollment', {
       err: enforcementService.error,
     })
@@ -111,9 +120,28 @@ export async function resolveMfaEnrollmentRedirect(args: {
     const deadlineState = resolveDeadlineRedirectState(compliance.deadline)
     if (!deadlineState.shouldRedirect) return null
 
+    if (emergencyBypass) {
+      emitMfaEmergencyBypassActiveWarning('mfa-enrollment-redirect bypassed', {
+        userId: auth.sub,
+        pathname,
+        enforced: compliance.enforced,
+        compliant: compliance.compliant,
+        overdue: deadlineState.overdue,
+      })
+      return null
+    }
+
     return createEnrollmentRedirect(pathname, deadlineState.overdue)
   } catch (error) {
     if (canFailClosed(auth)) {
+      if (emergencyBypass) {
+        emitMfaEmergencyBypassActiveWarning('mfa-enrollment-redirect bypassed', {
+          userId: auth.sub,
+          pathname,
+          reason: 'compliance-check-failed',
+        })
+        return null
+      }
       logger.error('Unable to verify MFA enforcement compliance; redirecting to enrollment', { err: error })
       return createEnrollmentRedirect(pathname)
     }

package/src/modules/security/lib/mfaCompletionRoutes.ts

@@ -0,0 +1,25 @@
+import { registerMfaPendingAccessRoutes } from '@open-mercato/shared/lib/auth/mfaPendingAccess'
+
+const CANONICAL_MFA_COMPLETION_ROUTES = [
+  { path: '/api/security/mfa/prepare', methods: ['POST'] },
+  { path: '/api/security/mfa/verify', methods: ['POST'] },
+  { path: '/api/security/mfa/recovery', methods: ['POST'] },
+]
+
+let registered = false
+
+/**
+ * Register the canonical MFA challenge-completion routes with the platform-wide pending-token
+ * allowlist. The enterprise security module owns these routes, so it owns their registration:
+ * shared stays generic (SPEC-ENT-007 § Amendment 2026-08-21). Idempotent; runs once per process
+ * on first import of this module — which happens at security-module bootstrap and, as a
+ * belt-and-braces guarantee, on every load of the completion route modules themselves, so the
+ * routes are always registered before request authentication resolves.
+ */
+export function registerCanonicalMfaCompletionRoutes(): void {
+  if (registered) return
+  registerMfaPendingAccessRoutes(CANONICAL_MFA_COMPLETION_ROUTES)
+  registered = true
+}
+
+registerCanonicalMfaCompletionRoutes()

package/src/modules/security/lib/security-config.ts

@@ -1,4 +1,5 @@
 import { parseBooleanWithDefault } from '@open-mercato/shared/lib/boolean'
+import { createLogger } from '@open-mercato/shared/lib/logger'
 
 const TOTP_PERIOD_SECONDS = 30
 const TOTP_DIGITS = 6
@@ -7,6 +8,9 @@ const DEFAULT_WEBAUTHN_CHALLENGE_TTL_MS = 5 * 60 * 1000
 const DEFAULT_SUDO_PENDING_CHALLENGE_TTL_MS = 10 * 60 * 1000
 const MIN_SUDO_TTL_SECONDS = 30
 
+const securityBypassLogger = createLogger('security').child({ component: 'mfa-emergency-bypass' })
+let startupBypassWarningEmitted = false
+
 export type SecurityModuleConfig = {
   totp: {
     issuer: string
@@ -170,6 +174,31 @@ export function resolveSecurityModuleConfigForRequest(
   }
 }
 
+export function emitMfaEmergencyBypassActiveWarning(context: string, extra?: Record<string, unknown>): void {
+  securityBypassLogger.warn('MFA emergency bypass is active', {
+    emergencyBypass: true,
+    context,
+    ...extra,
+  })
+}
+
+export function emitMfaEmergencyBypassStartupWarningIfNeeded(env: NodeJS.ProcessEnv = process.env): void {
+  if (startupBypassWarningEmitted) return
+  const bypass = parseBooleanWithDefault(
+    env.OM_SECURITY_MFA_EMERGENCY_BYPASS,
+    defaultSecurityModuleConfig.mfa.emergencyBypass,
+  )
+  if (!bypass) return
+  startupBypassWarningEmitted = true
+  emitMfaEmergencyBypassActiveWarning('startup', { startup: true })
+}
+
+export function resetMfaEmergencyBypassStartupWarningForTests(): void {
+  startupBypassWarningEmitted = false
+}
+
+emitMfaEmergencyBypassStartupWarningIfNeeded()
+
 export function readSecuritySetupTokenSecret(env: NodeJS.ProcessEnv = process.env): string {
   const secret = readText(env.OM_SECURITY_MFA_SETUP_SECRET)
     ?? readText(env.AUTH_JWT_SECRET)