@open-mercato/shared 0.6.8-develop.7099.1.7ba2771d06 → 0.7.0

package/src/lib/auth/__tests__/server.apiKeyCache.test.ts

@@ -94,244 +94,6 @@ describe('resolveApiKeyAuth caching + lastUsedAt debounce', () => {
     expect(emFlush).toHaveBeenCalledTimes(1)
   })
 
-  it('retains the creator identity for a regular tenant-scoped key', async () => {
-    const { getAuthFromRequest } = await import('@open-mercato/shared/lib/auth/server')
-    findApiKeyBySecret.mockResolvedValue({
-      id: 'key-tenant-scoped',
-      name: 'tenant scoped',
-      tenantId: 'tenant-1',
-      organizationId: null,
-      rolesJson: [],
-      sessionToken: null,
-      sessionUserId: null,
-      sessionSecretEncrypted: null,
-      opencodeSessionId: null,
-      createdBy: 'creator-1',
-      expiresAt: null,
-      lastUsedAt: null,
-    })
-    emFindOne.mockImplementation(async (_entity: unknown, where: Record<string, unknown>) => {
-      if (where.id === 'tenant-1' && where.isActive === true) return { id: 'tenant-1' }
-      if (where.id === 'creator-1') {
-        return { id: 'creator-1', tenantId: 'tenant-1', organizationId: 'creator-org' }
-      }
-      return null
-    })
-
-    const auth = await getAuthFromRequest(buildRequest('tenant-scoped-secret'))
-
-    expect(auth).toMatchObject({
-      sub: 'api_key:key-tenant-scoped',
-      tenantId: 'tenant-1',
-      orgId: null,
-      isApiKey: true,
-      keyId: 'key-tenant-scoped',
-      userId: 'creator-1',
-    })
-    // The creator remains the key's legacy identity, but its concrete
-    // organization does not narrow a tenant-scoped key.
-    expect(emFindOne).toHaveBeenCalledWith(
-      expect.anything(),
-      { id: 'creator-1', deletedAt: null },
-    )
-  })
-
-  it('rejects a tenant-scoped regular key once its creator is soft-deleted', async () => {
-    const { getAuthFromRequest } = await import('@open-mercato/shared/lib/auth/server')
-    findApiKeyBySecret.mockResolvedValue({
-      id: 'key-deleted-creator',
-      name: 'deleted creator',
-      tenantId: 'tenant-1',
-      organizationId: null,
-      rolesJson: [],
-      sessionToken: null,
-      sessionUserId: null,
-      sessionSecretEncrypted: null,
-      opencodeSessionId: null,
-      createdBy: 'creator-1',
-      expiresAt: null,
-      lastUsedAt: null,
-    })
-    emFindOne.mockImplementation(async (_entity: unknown, where: Record<string, unknown>) => {
-      if (where.id === 'tenant-1' && where.isActive === true) return { id: 'tenant-1' }
-      return null
-    })
-
-    await expect(
-      getAuthFromRequest(buildRequest('deleted-creator-secret')),
-    ).resolves.toBeNull()
-  })
-
-  it('rejects a tenant-scoped regular key whose creator moved to another tenant', async () => {
-    const { getAuthFromRequest } = await import('@open-mercato/shared/lib/auth/server')
-    findApiKeyBySecret.mockResolvedValue({
-      id: 'key-foreign-creator',
-      name: 'foreign creator',
-      tenantId: 'tenant-1',
-      organizationId: null,
-      rolesJson: [],
-      sessionToken: null,
-      sessionUserId: null,
-      sessionSecretEncrypted: null,
-      opencodeSessionId: null,
-      createdBy: 'creator-1',
-      expiresAt: null,
-      lastUsedAt: null,
-    })
-    emFindOne.mockImplementation(async (_entity: unknown, where: Record<string, unknown>) => {
-      if (where.id === 'tenant-1' && where.isActive === true) return { id: 'tenant-1' }
-      if (where.id === 'creator-1') {
-        return { id: 'creator-1', tenantId: 'tenant-2', organizationId: null }
-      }
-      return null
-    })
-
-    await expect(
-      getAuthFromRequest(buildRequest('foreign-creator-secret')),
-    ).resolves.toBeNull()
-  })
-
-  it('accepts a tenant-scoped regular key that records no creator', async () => {
-    const { getAuthFromRequest } = await import('@open-mercato/shared/lib/auth/server')
-    findApiKeyBySecret.mockResolvedValue({
-      id: 'key-no-creator',
-      name: 'no creator',
-      tenantId: 'tenant-1',
-      organizationId: null,
-      rolesJson: [],
-      sessionToken: null,
-      sessionUserId: null,
-      sessionSecretEncrypted: null,
-      opencodeSessionId: null,
-      createdBy: null,
-      expiresAt: null,
-      lastUsedAt: null,
-    })
-    emFindOne.mockImplementation(async (_entity: unknown, where: Record<string, unknown>) => {
-      if (where.id === 'tenant-1' && where.isActive === true) return { id: 'tenant-1' }
-      return null
-    })
-
-    await expect(
-      getAuthFromRequest(buildRequest('no-creator-secret')),
-    ).resolves.toMatchObject({ keyId: 'key-no-creator', tenantId: 'tenant-1' })
-  })
-
-  it('retains the creator identity for an organization-scoped regular key', async () => {
-    const { getAuthFromRequest } = await import('@open-mercato/shared/lib/auth/server')
-    findApiKeyBySecret.mockResolvedValue({
-      id: 'key-organization-scoped',
-      name: 'organization scoped',
-      tenantId: 'tenant-1',
-      organizationId: 'org-1',
-      rolesJson: [],
-      sessionToken: null,
-      sessionUserId: null,
-      sessionSecretEncrypted: null,
-      opencodeSessionId: null,
-      createdBy: 'creator-1',
-      expiresAt: null,
-      lastUsedAt: null,
-    })
-    emFindOne.mockImplementation(async (_entity: unknown, where: Record<string, unknown>) => {
-      if (where.id === 'creator-1') {
-        return { id: 'creator-1', tenantId: 'tenant-1', organizationId: 'org-1' }
-      }
-      return null
-    })
-
-    await expect(
-      getAuthFromRequest(buildRequest('organization-scoped-secret')),
-    ).resolves.toMatchObject({
-      sub: 'api_key:key-organization-scoped',
-      tenantId: 'tenant-1',
-      orgId: 'org-1',
-      userId: 'creator-1',
-    })
-  })
-
-  it('rejects an organization-scoped regular key when its creator scope no longer matches', async () => {
-    const { getAuthFromRequest } = await import('@open-mercato/shared/lib/auth/server')
-    findApiKeyBySecret.mockResolvedValue({
-      id: 'key-organization-mismatch',
-      name: 'organization mismatch',
-      tenantId: 'tenant-1',
-      organizationId: 'org-1',
-      rolesJson: [],
-      sessionToken: null,
-      sessionUserId: null,
-      sessionSecretEncrypted: null,
-      opencodeSessionId: null,
-      createdBy: 'creator-1',
-      expiresAt: null,
-      lastUsedAt: null,
-    })
-    emFindOne.mockImplementation(async (_entity: unknown, where: Record<string, unknown>) => {
-      if (where.id === 'creator-1') {
-        return { id: 'creator-1', tenantId: 'tenant-1', organizationId: 'org-2' }
-      }
-      return null
-    })
-
-    await expect(
-      getAuthFromRequest(buildRequest('organization-scope-mismatch-secret')),
-    ).resolves.toBeNull()
-  })
-
-  it('keeps session keys strictly bound to their persisted user and scope', async () => {
-    const { getAuthFromRequest } = await import('@open-mercato/shared/lib/auth/server')
-    findApiKeyBySecret.mockResolvedValue({
-      id: 'key-session-scoped',
-      name: 'session scoped',
-      tenantId: 'tenant-1',
-      organizationId: null,
-      rolesJson: [],
-      sessionToken: 'sess_123',
-      sessionUserId: 'session-user-1',
-      sessionSecretEncrypted: null,
-      opencodeSessionId: null,
-      createdBy: 'session-user-1',
-      expiresAt: null,
-      lastUsedAt: null,
-    })
-    emFindOne.mockImplementation(async (_entity: unknown, where: Record<string, unknown>) => {
-      if (where.id === 'session-user-1') {
-        return { id: 'session-user-1', tenantId: 'tenant-1', organizationId: 'user-org' }
-      }
-      return null
-    })
-
-    await expect(
-      getAuthFromRequest(buildRequest('session-scope-mismatch-secret')),
-    ).resolves.toBeNull()
-  })
-
-  it('fails closed when a row has session markers but no bound session user', async () => {
-    const { getAuthFromRequest } = await import('@open-mercato/shared/lib/auth/server')
-    findApiKeyBySecret.mockResolvedValue({
-      id: 'key-malformed-session',
-      name: 'malformed session',
-      tenantId: 'tenant-1',
-      organizationId: null,
-      rolesJson: [],
-      sessionToken: 'sess_missing_user',
-      sessionUserId: null,
-      sessionSecretEncrypted: null,
-      opencodeSessionId: null,
-      createdBy: 'creator-1',
-      expiresAt: null,
-      lastUsedAt: null,
-    })
-
-    await expect(
-      getAuthFromRequest(buildRequest('malformed-session-secret')),
-    ).resolves.toBeNull()
-    expect(emFindOne).not.toHaveBeenCalledWith(
-      expect.anything(),
-      expect.objectContaining({ id: 'creator-1' }),
-    )
-  })
-
   it('caches negative lookups so invalid keys skip the bcrypt+DB path', async () => {
     const { getAuthFromRequest } = await import('@open-mercato/shared/lib/auth/server')
     findApiKeyBySecret.mockResolvedValue(null)
@@ -366,90 +128,4 @@ describe('resolveApiKeyAuth caching + lastUsedAt debounce', () => {
     await getAuthFromRequest(buildRequest('secret-invalidate'))
     expect(findApiKeyBySecret).toHaveBeenCalledTimes(2)
   })
-
-  describe('super-admin bit stays bounded by the effective key scope', () => {
-    async function resolveWithSuperAdminRole(input: {
-      secret: string
-      keyId: string
-      keyOrganizationId: string | null
-      aclOrganizations: string[] | null
-    }) {
-      const { RoleAcl } = await import('@open-mercato/core/modules/auth/data/entities')
-      const { Organization, Tenant } = await import('@open-mercato/core/modules/directory/data/entities')
-      const { getAuthFromRequest } = await import('@open-mercato/shared/lib/auth/server')
-      // A creator-less key is validated against a live tenant (and organization when bound).
-      emFindOne.mockImplementation(async (entity: unknown) => {
-        if (entity === Tenant) return { id: 'tenant-1' }
-        if (entity === Organization) return { id: input.keyOrganizationId, tenant: { id: 'tenant-1' } }
-        return null
-      })
-      findApiKeyBySecret.mockResolvedValue({
-        id: input.keyId,
-        name: 'super admin key',
-        tenantId: 'tenant-1',
-        organizationId: input.keyOrganizationId,
-        rolesJson: ['role-super'],
-        sessionToken: null,
-        sessionUserId: null,
-        sessionSecretEncrypted: null,
-        opencodeSessionId: null,
-        createdBy: null,
-        expiresAt: null,
-        lastUsedAt: null,
-      })
-      emFind.mockImplementation(async (entity: unknown) => {
-        if (entity === RoleAcl) {
-          return [{ isSuperAdmin: true, organizationsJson: input.aclOrganizations }]
-        }
-        return []
-      })
-      return getAuthFromRequest(buildRequest(input.secret))
-    }
-
-    it('withholds it from an organization-bound key even when a role grants it', async () => {
-      // Generic guards trust this bit before live RBAC, so an organization-restricted key must
-      // never take super-admin shortcuts outside its own scope.
-      const auth = await resolveWithSuperAdminRole({
-        secret: 'super-bound',
-        keyId: 'key-super-bound',
-        keyOrganizationId: 'org-1',
-        aclOrganizations: null,
-      })
-
-      expect(auth).toMatchObject({ isApiKey: true, isSuperAdmin: false })
-    })
-
-    it('withholds it when the granting role ACL is itself organization-restricted', async () => {
-      const auth = await resolveWithSuperAdminRole({
-        secret: 'super-restricted',
-        keyId: 'key-super-restricted',
-        keyOrganizationId: null,
-        aclOrganizations: ['org-1'],
-      })
-
-      expect(auth).toMatchObject({ isApiKey: true, isSuperAdmin: false })
-    })
-
-    it('grants it for an unbound key with an unrestricted role grant', async () => {
-      const auth = await resolveWithSuperAdminRole({
-        secret: 'super-global',
-        keyId: 'key-super-global',
-        keyOrganizationId: null,
-        aclOrganizations: null,
-      })
-
-      expect(auth).toMatchObject({ isApiKey: true, isSuperAdmin: true })
-    })
-
-    it('grants it for an unbound key whose role ACL uses the __all__ sentinel', async () => {
-      const auth = await resolveWithSuperAdminRole({
-        secret: 'super-all-sentinel',
-        keyId: 'key-super-all-sentinel',
-        keyOrganizationId: null,
-        aclOrganizations: ['__all__'],
-      })
-
-      expect(auth).toMatchObject({ isApiKey: true, isSuperAdmin: true })
-    })
-  })
 })

package/src/lib/auth/__tests__/server.test.ts

@@ -10,7 +10,6 @@ jest.mock('next/headers', () => ({
 }))
 
 jest.mock('@open-mercato/shared/lib/auth/jwt', () => ({
-  ...jest.requireActual('@open-mercato/shared/lib/auth/jwt'),
   verifyJwt: (...args: unknown[]) => verifyJwt(...args),
 }))
 
@@ -163,109 +162,6 @@ describe('auth server integrity checks', () => {
     await expect(getAuthFromRequest(request)).resolves.toBeNull()
   })
 
-  describe('mfa-pending staff tokens', () => {
-    const pendingAuth = {
-      sub: '11111111-1111-4111-8111-111111111111',
-      sid: '44444444-4444-4444-8444-444444444444',
-      tenantId: '22222222-2222-4222-8222-222222222222',
-      orgId: '33333333-3333-4333-8333-333333333333',
-      roles: ['admin'],
-      mfa_pending: true,
-      mfa_verified: false,
-    }
-
-    function mfaPendingRequest(path: string, method: string): Request {
-      return new Request(`https://example.test${path}`, {
-        method,
-        headers: { authorization: `Bearer pending-token` },
-      })
-    }
-
-    beforeEach(async () => {
-      // The registry ships empty; completion routes are registered by their owning module
-      // (enterprise security). Register equivalent fixtures to exercise resolver mechanics.
-      const { registerMfaPendingAccessRoutes } = await import('../mfaPendingAccess')
-      registerMfaPendingAccessRoutes([
-        { path: '/api/security/mfa/prepare', methods: ['POST'] },
-        { path: '/api/security/mfa/verify', methods: ['POST'] },
-        { path: '/api/security/mfa/recovery', methods: ['POST'] },
-      ])
-      verifyJwt.mockReturnValue(pendingAuth)
-      resolveCanonicalStaffAuthContext.mockResolvedValue({ ...pendingAuth })
-    })
-
-    it('rejects a pending token on a general staff API before roles are restored', async () => {
-      const { resolveAuthFromRequestDetailed } = await import('@open-mercato/shared/lib/auth/server')
-
-      await expect(resolveAuthFromRequestDetailed(mfaPendingRequest('/api/customers/people', 'GET')))
-        .resolves.toEqual({ auth: null, status: 'invalid' })
-      expect(resolveCanonicalStaffAuthContext).not.toHaveBeenCalled()
-    })
-
-    it('still resolves a pending token on the registered MFA completion routes (POST)', async () => {
-      const { resolveAuthFromRequestDetailed } = await import('@open-mercato/shared/lib/auth/server')
-
-      for (const path of ['/api/security/mfa/prepare', '/api/security/mfa/verify', '/api/security/mfa/recovery']) {
-        resolveCanonicalStaffAuthContext.mockClear()
-        const resolution = await resolveAuthFromRequestDetailed(mfaPendingRequest(path, 'POST'))
-        expect(resolution.status).toBe('authenticated')
-        expect(resolution.auth).toEqual({ ...pendingAuth })
-        expect(resolveCanonicalStaffAuthContext).toHaveBeenCalledWith(em, pendingAuth)
-      }
-    })
-
-    it('rejects a pending token with a non-completion method on a completion route', async () => {
-      const { resolveAuthFromRequestDetailed } = await import('@open-mercato/shared/lib/auth/server')
-
-      await expect(resolveAuthFromRequestDetailed(mfaPendingRequest('/api/security/mfa/verify', 'GET')))
-        .resolves.toEqual({ auth: null, status: 'invalid' })
-      expect(resolveCanonicalStaffAuthContext).not.toHaveBeenCalled()
-    })
-
-    it('resolves the verified replacement token like a normal login', async () => {
-      const { getAuthFromRequest } = await import('@open-mercato/shared/lib/auth/server')
-      const verifiedAuth = { ...pendingAuth, mfa_pending: false, mfa_verified: true }
-      verifyJwt.mockReturnValue(verifiedAuth)
-      resolveCanonicalStaffAuthContext.mockResolvedValue({ ...verifiedAuth, roles: ['employee'] })
-
-      const request = new Request('https://example.test/api/customers/people', {
-        headers: { authorization: 'Bearer verified-token' },
-      })
-
-      await expect(getAuthFromRequest(request)).resolves.toEqual({ ...verifiedAuth, roles: ['employee'] })
-      expect(resolveCanonicalStaffAuthContext).toHaveBeenCalledWith(em, verifiedAuth)
-    })
-
-    it('leaves tokens without MFA claims untouched', async () => {
-      const { getAuthFromRequest } = await import('@open-mercato/shared/lib/auth/server')
-      const plainAuth = {
-        sub: '11111111-1111-4111-8111-111111111111',
-        tenantId: '22222222-2222-4222-8222-222222222222',
-        orgId: '33333333-3333-4333-8333-333333333333',
-        roles: [],
-      }
-      verifyJwt.mockReturnValue(plainAuth)
-      resolveCanonicalStaffAuthContext.mockResolvedValue(plainAuth)
-
-      const request = new Request('https://example.test/api/test', {
-        headers: { cookie: 'auth_token=jwt-token' },
-      })
-
-      await expect(getAuthFromRequest(request)).resolves.toEqual(plainAuth)
-    })
-
-    it('rejects a pending token from cookie-based page resolution unconditionally', async () => {
-      const { getAuthFromCookies, resolveAuthFromCookiesDetailed } = await import('@open-mercato/shared/lib/auth/server')
-      cookieStore.get.mockImplementation((name: string) => {
-        if (name === 'auth_token') return { value: 'pending-jwt-token' }
-        return undefined
-      })
-
-      await expect(getAuthFromCookies()).resolves.toBeNull()
-      await expect(resolveAuthFromCookiesDetailed()).resolves.toEqual({ auth: null, status: 'invalid' })
-      expect(resolveCanonicalStaffAuthContext).not.toHaveBeenCalled()
-    })
-  })
   it('reports a transient DB failure on the api-key path as "error" (retryable 503)', async () => {
     const { resolveAuthFromRequestDetailed } = await import('@open-mercato/shared/lib/auth/server')
     // Distinct secret so the shared api-key auth cache does not serve a prior miss.

package/src/lib/auth/jwt.ts

@@ -377,20 +377,3 @@ export function signAudienceJwt(
 export function verifyAudienceJwt(audience: string, token: string): JwtPayload | null {
   return verifyJwt(token, { audience })
 }
-
-/**
- * True when a verified JWT payload represents an MFA challenge in progress: the second factor
- * has not been completed yet (`mfa_pending: true`, `mfa_verified` not `true`). Such tokens are
- * provisional — general staff APIs must reject them and only the MFA completion routes may
- * accept them (see `@open-mercato/shared/lib/auth/mfaPendingAccess`).
- *
- * The predicate keys on `mfa_pending` alone by design. `mfa_verified` is NOT a durable session
- * property: routes that legitimately re-sign a staff token (`PUT /api/auth/profile`,
- * `GET|POST /api/auth/session/refresh`) rebuild the claims without it. Tightening this to require
- * `mfa_verified === true` would therefore silently downgrade those sessions.
- */
-export function isMfaPendingJwtPayload(payload: unknown): boolean {
-  if (!payload || typeof payload !== 'object') return false
-  const record = payload as Record<string, unknown>
-  return record.mfa_pending === true && record.mfa_verified !== true
-}

package/src/lib/auth/organizationAccess.ts

@@ -4,15 +4,6 @@ export type OrganizationAccessDecisionInput = {
   targetOrganizationId: string | null
 }
 
-export type UnrestrictedOrganizationScopeInput = {
-  isSuperAdmin: boolean
-  allowedOrganizationIds: readonly string[] | null | undefined
-}
-
-export function isUnrestrictedOrganizationScope(input: UnrestrictedOrganizationScopeInput): boolean {
-  return input.isSuperAdmin || input.allowedOrganizationIds === null
-}
-
 /**
  * Fail-closed organization-access predicate. The single source of truth for
  * "may this principal act on `targetOrganizationId`".
@@ -24,7 +15,8 @@ export function isUnrestrictedOrganizationScope(input: UnrestrictedOrganizationS
  * - restricted + target org            -> allow iff the target is a member of the allowed set
  */
 export function isOrganizationAccessAllowed(input: OrganizationAccessDecisionInput): boolean {
-  if (isUnrestrictedOrganizationScope(input)) return true
+  if (input.isSuperAdmin) return true
+  if (input.allowedOrganizationIds === null) return true
   if (!input.targetOrganizationId) return false
-  return (input.allowedOrganizationIds ?? []).includes(input.targetOrganizationId)
+  return input.allowedOrganizationIds.includes(input.targetOrganizationId)
 }

package/src/lib/auth/server.ts

@@ -1,18 +1,9 @@
 import { cookies } from 'next/headers.js'
 import type { EntityManager } from '@mikro-orm/postgresql'
-import { isMfaPendingJwtPayload, verifyJwt } from './jwt'
-import { isMfaPendingAccessAllowed } from './mfaPendingAccess'
+import { verifyJwt } from './jwt'
 import { getSharedApiKeyAuthCache } from './apiKeyAuthCache'
 import { isTransientDbError } from '@open-mercato/shared/lib/db/pg-errors'
 
-function readRequestPathname(req: Request): string | null {
-  try {
-    return new URL(req.url).pathname
-  } catch {
-    return null
-  }
-}
-
 const TENANT_COOKIE_NAME = 'om_selected_tenant'
 const ORGANIZATION_COOKIE_NAME = 'om_selected_org'
 const ALL_ORGANIZATIONS_COOKIE_VALUE = '__all__'
@@ -68,16 +59,6 @@ export type TrustedAuthContextEnvelope = {
   status?: AuthResolutionStatus
 }
 
-/**
- * Attach an already-resolved auth context to a synthetic request.
- *
- * INVARIANT callers MUST uphold: `envelope.auth` has to be the product of a gated resolution —
- * `getAuthFromRequest` / `getAuthFromCookies` (or an equivalently validated principal such as an
- * API-key record). The envelope short-circuits `resolveAuthFromRequestDetailed` ahead of both the
- * MFA-pending gate and `resolveCanonicalStaffAuthContext`, so an envelope built straight from an
- * unvalidated JWT would reinstate the MFA bypass this module closes and skip session-revocation
- * checks as well. Never populate it from raw request credentials.
- */
 export function attachTrustedAuthContext(
   request: Request,
   envelope: TrustedAuthContextEnvelope
@@ -214,33 +195,13 @@ async function resolveApiKeyAuth(secret: string): Promise<AuthContext> {
       : []
     const roleNames = roles.map((role) => role.name).filter((name): name is string => typeof name === 'string' && name.length > 0)
 
-    // A role-level super-admin grant is authorization-grade only when it is genuinely
-    // unrestricted: the grant itself must not be organization-scoped, it must belong to the
-    // key's tenant, and the key must not be bound to a single organization. RbacService applies
-    // the same intersection when projecting the scoped ACL, but generic guards
-    // (tenantAccess.resolveIsSuperAdmin, the scoped-API helpers) trust this raw bit *before*
-    // live RBAC runs — so an organization-restricted key must never carry it.
     let keyIsSuperAdmin = false
-    const keyOrganizationId = typeof record.organizationId === 'string' && record.organizationId.trim().length > 0
-      ? record.organizationId.trim()
-      : null
-    if (roleIds.length && !keyOrganizationId) {
-      const superAcls = await em.find(
+    if (roleIds.length) {
+      const superAcl = await em.findOne(
         RoleAcl,
-        {
-          role: { $in: roleIds } as any,
-          tenantId: record.tenantId ?? null,
-          isSuperAdmin: true,
-          deletedAt: null,
-        } as any,
+        { role: { $in: roleIds } as any, isSuperAdmin: true, deletedAt: null } as any,
       )
-      keyIsSuperAdmin = superAcls.some((acl) => {
-        const organizations = Array.isArray((acl as { organizationsJson?: string[] | null }).organizationsJson)
-          ? (acl as { organizationsJson?: string[] | null }).organizationsJson as string[]
-          : null
-        // An empty list means "inherit the key's own binding"; with no binding that is tenant-wide.
-        return !organizations || organizations.length === 0 || organizations.includes('__all__')
-      })
+      keyIsSuperAdmin = !!(superAcl && (superAcl as { isSuperAdmin?: boolean }).isSuperAdmin)
     }
 
     if (cache.shouldWriteLastUsed(record.id)) {
@@ -252,25 +213,8 @@ async function resolveApiKeyAuth(secret: string): Promise<AuthContext> {
       }
     }
 
-    // Ephemeral session keys are always user-bound. Regular keys retain their
-    // legacy creator identity, while tenant-scoped regular keys ignore only the
-    // creator's concrete organization when validating the wider key scope.
-    // Keep every session marker fail-closed so a malformed session key cannot
-    // fall back to the regular key path and escape its user/scope binding.
-    const isSessionBoundKey = Boolean(
-      record.sessionToken
-      || record.sessionUserId
-      || record.sessionSecretEncrypted
-      || record.opencodeSessionId
-    )
-    const actualUserId = isSessionBoundKey
-      ? record.sessionUserId ?? null
-      : record.createdBy ?? null
-
-    if (isSessionBoundKey && !actualUserId) {
-      cache.setMiss(secret)
-      return null
-    }
+    // For session keys, use sessionUserId; for regular keys, use createdBy
+    const actualUserId = record.sessionUserId ?? record.createdBy ?? null
 
     if (actualUserId) {
       const user = await em.findOne(User, { id: actualUserId, deletedAt: null })
@@ -282,8 +226,7 @@ async function resolveApiKeyAuth(secret: string): Promise<AuthContext> {
         cache.setMiss(secret)
         return null
       }
-      const requiresExactOrganization = isSessionBoundKey || Boolean(record.organizationId)
-      if (requiresExactOrganization && (user.organizationId ?? null) !== (record.organizationId ?? null)) {
+      if ((user.organizationId ?? null) !== (record.organizationId ?? null)) {
         cache.setMiss(secret)
         return null
       }
@@ -372,9 +315,6 @@ export async function resolveAuthFromCookiesDetailed(): Promise<AuthResolution>
     const payload = verifyJwt(token) as AuthContext
     if (!payload) return { auth: null, status: 'invalid' }
     if (payload.type === 'customer') return { auth: null, status: 'invalid' }
-    // MFA-pending tokens are provisional: pages never complete the second factor, so they
-    // must not resolve to an authenticated context anywhere in the RSC/page flow.
-    if (isMfaPendingJwtPayload(payload)) return { auth: null, status: 'invalid' }
     const canonicalAuth = await resolveCanonicalInteractiveAuthContext(payload)
     if (!canonicalAuth) return { auth: null, status: 'invalid' }
     const tenantCookie = cookieStore.get(TENANT_COOKIE_NAME)?.value
@@ -394,8 +334,6 @@ export async function getAuthFromCookies(): Promise<AuthContext> {
 }
 
 export async function resolveAuthFromRequestDetailed(req: Request): Promise<AuthResolution> {
-  // Deliberately ahead of the MFA-pending gate below: the envelope carries a context that was
-  // already gated by its producer (see `attachTrustedAuthContext`), not raw request credentials.
   const trusted = readTrustedAuthContext(req)
   if (trusted) {
     return {
@@ -419,14 +357,6 @@ export async function resolveAuthFromRequestDetailed(req: Request): Promise<Auth
     try {
       const payload = verifyJwt(token) as AuthContext
       if (payload && payload.type === 'customer') return { auth: null, status: 'invalid' }
-      if (payload && isMfaPendingJwtPayload(payload)) {
-        // MFA-pending tokens authenticate only the registered challenge-completion routes;
-        // everywhere else they resolve to `invalid` so the dispatcher answers 401 (clearing
-        // staff auth cookies) instead of restoring the account's roles/features.
-        if (!isMfaPendingAccessAllowed(req.method, readRequestPathname(req))) {
-          return { auth: null, status: 'invalid' }
-        }
-      }
       if (payload) {
         const canonicalAuth = await resolveCanonicalInteractiveAuthContext(payload)
         if (canonicalAuth) {