@salesforce/ui-bundle-template-feature-react-mfa 11.48.0

package/LICENSE.txt

@@ -0,0 +1,82 @@
+Terms of Use
+
+Copyright 2026 Salesforce, Inc. All rights reserved.
+
+These Terms of Use govern the download, installation, and/or use of this
+software provided by Salesforce, Inc. ("Salesforce") (the "Software"), were
+last updated on April 15, 2025, and constitute a legally binding
+agreement between you and Salesforce. If you do not agree to these Terms of
+Use, do not install or use the Software.
+
+Salesforce grants you a worldwide, non-exclusive, no-charge, royalty-free
+copyright license to reproduce, prepare derivative works of, publicly
+display, publicly perform, sublicense, and distribute the Software and
+derivative works subject to these Terms. These Terms shall be included in
+all copies or substantial portions of the Software.
+
+Subject to the limited rights expressly granted hereunder, Salesforce
+reserves all rights, title, and interest in and to all intellectual
+property subsisting in the Software. No rights are granted to you hereunder
+other than as expressly set forth herein. Users residing in countries on
+the United States Office of Foreign Assets Control sanction list, or which
+are otherwise subject to a US export embargo, may not use the Software.
+
+Implementation of the Software may require development work, for which you
+are responsible. The Software may contain bugs, errors and
+incompatibilities and is made available on an AS IS basis without support,
+updates, or service level commitments.
+
+Salesforce reserves the right at any time to modify, suspend, or
+discontinue, the Software (or any part thereof) with or without notice. You
+agree that Salesforce shall not be liable to you or to any third party for
+any modification, suspension, or discontinuance.
+
+You agree to defend Salesforce against any claim, demand, suit or
+proceeding made or brought against Salesforce by a third party arising out
+of or accruing from (a) your use of the Software, and (b) any application
+you develop with the Software that infringes any copyright, trademark,
+trade secret, trade dress, patent, or other intellectual property right of
+any person or defames any person or violates their rights of publicity or
+privacy (each a "Claim Against Salesforce"), and will indemnify Salesforce
+from any damages, attorney fees, and costs finally awarded against
+Salesforce as a result of, or for any amounts paid by Salesforce under a
+settlement approved by you in writing of, a Claim Against Salesforce,
+provided Salesforce (x) promptly gives you written notice of the Claim
+Against Salesforce, (y) gives you sole control of the defense and
+settlement of the Claim Against Salesforce (except that you may not settle
+any Claim Against Salesforce unless it unconditionally releases Salesforce
+of all liability), and (z) gives you all reasonable assistance, at your
+expense.
+
+WITHOUT LIMITING THE GENERALITY OF THE FOREGOING, THE SOFTWARE IS NOT
+SUPPORTED AND IS PROVIDED "AS IS," WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED. IN NO EVENT SHALL SALESFORCE HAVE ANY LIABILITY FOR ANY DAMAGES,
+INCLUDING, BUT NOT LIMITED TO, DIRECT, INDIRECT, SPECIAL, INCIDENTAL,
+PUNITIVE, OR CONSEQUENTIAL DAMAGES, OR DAMAGES BASED ON LOST PROFITS, DATA,
+OR USE, IN CONNECTION WITH THE SOFTWARE, HOWEVER CAUSED AND WHETHER IN
+CONTRACT, TORT, OR UNDER ANY OTHER THEORY OF LIABILITY, WHETHER OR NOT YOU
+HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+
+These Terms of Use shall be governed exclusively by the internal laws of
+the State of California, without regard to its conflicts of laws
+rules. Each party hereby consents to the exclusive jurisdiction of the
+state and federal courts located in San Francisco County, California to
+adjudicate any dispute arising out of or relating to these Terms of Use and
+the download, installation, and/or use of the Software. Except as expressly
+stated herein, these Terms of Use constitute the entire agreement between
+the parties, and supersede all prior and contemporaneous agreements,
+proposals, or representations, written or oral, concerning their subject
+matter. No modification, amendment, or waiver of any provision of these
+Terms of Use shall be effective unless it is by an update to these Terms of
+Use that Salesforce makes available, or is in writing and signed by the
+party against whom the modification, amendment, or waiver is to be
+asserted.
+
+Data Privacy: Salesforce may collect, process, and store device,
+system, and other information related to your use of the Software. This
+information includes, but is not limited to, IP address, user metrics, and
+other data ("Usage Data"). Salesforce may use Usage Data for analytics,
+product development, and marketing purposes. You acknowledge that files
+generated in conjunction with the Software may contain sensitive or
+confidential data, and you are solely responsible for anonymizing and
+protecting such data.

package/README.md

@@ -0,0 +1,159 @@
+# feature-react-mfa
+
+Enable Multi-Factor Authentication (MFA) for React-based Experience Cloud sites.
+
+## What it does
+
+Deploys two permission sets that enable platform-handled MFA for community users:
+
+| Permission Set               | Permission       | Purpose                                 |
+| ---------------------------- | ---------------- | --------------------------------------- |
+| `MFA_Required_For_Community` | `ForceTwoFactor` | Enforces MFA challenge at login         |
+| `API_Enabled_For_Community`  | `ApiEnabled`     | Enables REST API access for React sites |
+
+## How MFA works on Experience Sites
+
+The Salesforce platform handles the entire MFA flow:
+
+1. User logs in via the site login page
+2. Platform detects `ForceTwoFactor` permission on the user
+3. Platform renders an MFA challenge page (on the `vforcesite` domain)
+4. User completes verification (TOTP, Authenticator, WebAuthn, SMS, or Email)
+5. User is redirected to the React app, fully authenticated
+
+**No custom React UI is needed.** The platform handles the challenge page rendering.
+
+## Prerequisites
+
+Before installing this feature, ensure the following are already in place:
+
+| Prerequisite                                                       | Why                                                                                               |
+| ------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------- |
+| **Experience Cloud site deployed and active**                      | MFA applies to community login — no site means no login flow to protect                           |
+| **Customer Community or Customer Community Login license enabled** | Required for community user profiles — without it, user creation and profile deployment will fail |
+| **Community users exist** (or will self-register)                  | Permission sets are assigned to community users; the site must have a community-enabled profile   |
+| **Network/Site published at least once**                           | The site must be reachable at its URL for login + MFA challenge to appear                         |
+| **Target org accessible via `sf` CLI**                             | Deployment and assignment commands require CLI authentication                                     |
+
+> **Note:** This feature does NOT handle org setup, license provisioning, or Experience Cloud site creation. If these prerequisites are missing, deploy the base app template (e.g. `propertyrentalapp`) first, then enable the Community license in Setup > Feature Settings > Digital Experiences.
+
+## Installation
+
+### Via features-cli (recommended)
+
+```bash
+npx @salesforce/ui-bundle-features install mfa --ui-bundle-dir <your-ui-bundle-name>
+```
+
+### Via patches (build-time composition)
+
+Add to your app's `patches.ts`:
+
+```typescript
+dependencies: ["packages/template/feature/feature-react-mfa"];
+```
+
+## Post-Install Setup
+
+After installing the permission set metadata:
+
+1. **Deploy to your org:**
+
+   ```bash
+   sf project deploy start --source-dir force-app/main/default/permissionsets \
+     --target-org <org-alias> --test-level NoTestRun --wait 10
+   ```
+
+   Or deploy and verify manually:
+
+   ```bash
+   sf project deploy start --source-dir force-app/main/default/permissionsets \
+     --target-org <org-alias> --test-level NoTestRun
+
+   # Wait for deployment to complete, then verify
+   sf project deploy report --target-org <org-alias>
+   ```
+
+2. **Verify deployment succeeded:**
+
+   ```bash
+   sf org list metadata --metadata-type PermissionSet --target-org <org-alias> | grep MFA
+   ```
+
+3. **Assign permission sets to community users:**
+
+   ```bash
+   sf org assign permset --name MFA_Required_For_Community --target-org <org-alias>
+   sf org assign permset --name API_Enabled_For_Community --target-org <org-alias>
+   ```
+
+4. **Publish the site:**
+
+   ```bash
+   sf community publish --name "<site-name>" --target-org <org-alias>
+   ```
+
+5. **Verify:** Open an incognito browser, navigate to the site, log in, and confirm the MFA challenge page appears.
+
+6. **(Optional) Customize MFA/login page branding:**
+   For site containers, use the Setup UI (Administration → Branding) once the platform fix (W-23140888) ships. For headless LWR sites, deploy `NetworkBranding` metadata via Metadata API to customize logo, colors, and footer text on the platform-rendered MFA challenge page.
+
+## Verification Methods
+
+The platform supports these MFA verification methods (configured at the org level):
+
+- Authenticator App (TOTP)
+- Salesforce Authenticator
+- WebAuthn Platform (Touch ID / Face ID)
+- WebAuthn Roaming (Security Key)
+- SMS
+- Email OTP
+
+## Troubleshooting
+
+| Problem                            | Solution                                                           |
+| ---------------------------------- | ------------------------------------------------------------------ |
+| No MFA challenge appears           | Verify `MFA_Required_For_Community` is assigned to the user        |
+| `API_DISABLED_FOR_ORG` after login | Assign `API_Enabled_For_Community` permission set                  |
+| MFA page shows default branding    | Deploy `NetworkBranding` metadata via Metadata API                 |
+| `vforcesite` in MFA page URL       | Expected behavior — platform serves MFA from Force.com Site domain |
+
+## Emergency Rollback
+
+If MFA breaks site login and locks out all community users, follow these steps to quickly disable MFA:
+
+### Option 1: Remove Permission Set Assignments (Fastest)
+
+```bash
+# List assignment record Ids for users with MFA permission set assigned
+sf data query --query "SELECT Id, AssigneeId, Assignee.Username FROM PermissionSetAssignment WHERE PermissionSet.Name = 'MFA_Required_For_Community'" --target-org <org-alias>
+
+# Remove the assignment for each affected user (sf org assign permset has no --unassign flag;
+# deleting the PermissionSetAssignment record is the supported way to unassign)
+sf data delete record --sobject PermissionSetAssignment --record-id <assignment-id> --target-org <org-alias>
+```
+
+For bulk removal, use Data Loader:
+
+1. Export `PermissionSetAssignment` records where `PermissionSet.Name = 'MFA_Required_For_Community'`
+2. Delete those records via Data Loader
+
+### Option 2: Delete the Permission Set Metadata
+
+```bash
+# Delete from org
+sf project delete source --metadata PermissionSet:MFA_Required_For_Community --target-org <org-alias> --no-prompt
+
+# Remove from source (if needed)
+rm -rf force-app/main/default/permissionsets/MFA_Required_For_Community.permissionset-meta.xml
+```
+
+### Prevention Checklist
+
+Before deploying MFA to production:
+
+- [ ] Verify at least one MFA verification method is enabled in Setup → Identity → Multi-Factor Authentication
+- [ ] Test with a dedicated test community user (NOT your admin account)
+- [ ] Ensure test user has registered an MFA verification method
+- [ ] Document your rollback plan and share with team
+- [ ] Have a System Admin ready to execute rollback if needed

package/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "@salesforce/ui-bundle-template-feature-react-mfa",
+  "version": "11.48.0",
+  "description": "MFA enablement for React Experience Cloud sites",
+  "license": "SEE LICENSE IN LICENSE.txt",
+  "author": "",
+  "type": "module",
+  "main": "index.js",
+  "files": [
+    "src"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "clean": "rm -rf dist"
+  },
+  "nx": {
+    "targets": {
+      "build": {
+        "executor": "nx:run-commands",
+        "options": {
+          "command": "echo 'metadata-only, no build needed'",
+          "cwd": "packages/template/feature/feature-react-mfa"
+        }
+      },
+      "watch": {
+        "executor": "@salesforce/ui-bundle-template-cli:watch-patches"
+      }
+    }
+  }
+}

package/src/force-app/main/default/permissionsets/API_Enabled_For_Community.permissionset-meta.xml

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<PermissionSet xmlns="http://soap.sforce.com/2006/04/metadata">
+    <label>API Enabled For Community</label>
+    <description>Grants API Enabled permission for community users on React-based Experience Sites. Required for sites that make REST or Connect API calls. Without this permission, post-login API calls return API_DISABLED_FOR_ORG.</description>
+    <hasActivationRequired>false</hasActivationRequired>
+    <userPermissions>
+        <enabled>true</enabled>
+        <name>ApiEnabled</name>
+    </userPermissions>
+</PermissionSet>

package/src/force-app/main/default/permissionsets/MFA_Required_For_Community.permissionset-meta.xml

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<PermissionSet xmlns="http://soap.sforce.com/2006/04/metadata">
+    <label>MFA Required For Community</label>
+    <description>Enforces Multi-Factor Authentication at UI login for assigned Experience Site users. Assign to individual community users to require MFA on login.</description>
+    <hasActivationRequired>false</hasActivationRequired>
+    <userPermissions>
+        <enabled>true</enabled>
+        <name>ForceTwoFactor</name>
+    </userPermissions>
+</PermissionSet>