pgkiln 0.61.0 → 0.63.0

package/src/builder/routes.ts

@@ -27,10 +27,16 @@ import { appFromFileRoutes } from './appfromfile.ts';
 import { clearDevbar } from '../runtime/devbar.ts';
 import { EMAIL } from './find-workspace.ts';
 import { cookieLanguage, LANG_COOKIE, tr, translatorFor, validBuilderLanguage } from './i18n.ts';
-import { checkSecondFactor, codesLeft, forgetBrowsers, hasFactor, isTrustedBrowser, leavesTooFewAdmins, passkeysOf, trustBrowser, trustDays, usePasskey } from '../mfa.ts';
+import { checkSecondFactor, codesLeft, forgetBrowsers, hasFactor, isTrustedBrowser, leavesTooFewAdmins, passkeyByCredential, passkeySignin, passkeysOf, trustBrowser, trustDays, usePasskey, userHandle } from '../mfa.ts';
+import { isIP } from 'node:net';
 import { giveChallenge, takeChallenge } from './security.ts';
 import { relyingParty, verifyAssertion, WebAuthnError } from '../webauthn.ts';
 import { chooseLanguage, langCookieOptions, languageRoutes, signInLanguageLinks } from './language.ts';
+import { builderSsoRoutes, leavesNoBreakGlass } from './builder-sso.ts';
+import { builderDirectory, builderProvider, builderSources, linkDeveloper, resolveDeveloper, ssoRequired } from '../devsso.ts';
+import { ldapAuthenticate, LdapError } from '../ldap.ts';
+import { onBuilderSso, SsoError, startSignIn } from '../sso.ts';
+import { startSamlSignIn } from '../saml.ts';
 
 // Builder pages: sign-in, workspace and app home, settings, activity and
 // developers. Shared Components, the page designer and the SQL Workshop
@@ -67,6 +73,10 @@ export async function builderRoutes(app: FastifyInstance) {
     await saveState(s);
     const r = remembered(req);
     const next = safeNext(req.query?.next);
+    // (sprint 128) a passkey alone, when the instance allows it and the address is a host name
+    const alone = (await passkeySignin()) && !isIP(relyingParty(req).rpId);
+    // (sprint 129, SEC-1) identity providers and directories that sign developers in
+    const sources = await builderSources();
     const field = (name: string, label: string, ic: string, value: string, opts: { type?: string; required?: boolean; auto?: string; placeholder?: string; reveal?: boolean }) =>
       html`<div class="field signin-field"><label class="sr-only" for="f_${name}">${label}</label>
         <div class="signin-input">${icon(ic)}<input id="f_${name}" name="${name}" type="${opts.type ?? 'text'}" value="${value}" placeholder="${opts.placeholder ?? label}"${opts.required ? raw(' required') : ''}${opts.auto ? raw(` autocomplete="${opts.auto}"`) : ''}>
@@ -88,10 +98,18 @@ export async function builderRoutes(app: FastifyInstance) {
               ${error ? html`<div class="alert alert-error" role="alert">${error}</div>` : ''}
               ${csrf(s)}<input type="hidden" name="next" value="${next}">
               ${field('workspace', tx('signin.workspace'), 'database', r?.w ?? '', { placeholder: tx('signin.workspace_placeholder'), auto: 'organization' })}
+              ${sources.directories.length ? html`<div class="field signin-field"><label class="sr-only" for="f_method">${tx('signin.method')}</label>
+                <div class="signin-input">${icon('server')}<select id="f_method" name="method" aria-label="${tx('signin.method')}">
+                  <option value="">${tx('signin.method_pgkiln')}</option>
+                  ${sources.directories.map((d) => html`<option value="ldap:${d.name}">${d.display_name}</option>`)}</select></div></div>` : ''}
               ${field('username', tx('signin.username'), 'user', r?.u ?? '', { required: true, auto: 'username' })}
               ${field('password', tx('signin.password'), 'key', '', { type: 'password', required: true, auto: 'current-password', reveal: true })}
               <label class="check signin-remember"><input type="checkbox" name="remember" value="1"${r ? raw(' checked') : ''}> ${tx('signin.remember')}</label>
               <button class="btn btn-hot signin-submit">${tx('signin.submit')}</button>
+              ${alone ? html`<input type="hidden" name="credentialId"><input type="hidden" name="clientDataJSON"><input type="hidden" name="authenticatorData"><input type="hidden" name="signature"><input type="hidden" name="userHandle">
+                <button class="btn signin-submit signin-passkey" hidden data-passkey="${BASE}/login/passkey/options" data-passkey-submit="${BASE}/login/passkey" data-passkey-error="${tx('mfa.passkey_failed')}">${icon('fingerprint')} ${tx('signin.passkey')}</button>
+                <p class="small" role="status" data-passkey-status></p>` : ''}
+              ${sources.providers.map((p) => html`<a class="btn signin-submit signin-idp" href="${BASE}/sso/${p.name}${next === `${BASE}/home` ? '' : `?next=${encodeURIComponent(next)}`}">${icon('log-in')} ${tx('signin.with', { provider: p.display_name })}</a>`)}
               <p class="muted small signin-hint">${tx('signin.hint')}</p>
               <nav class="signin-actions" aria-label="${tx('signin.quick')}">
                 <a href="${BASE}/find-workspace">${icon('search')} ${tx('signin.find_ws')}</a>
@@ -129,45 +147,196 @@ export async function builderRoutes(app: FastifyInstance) {
       flash(s, tx('signin.throttled'), 'error');
       return back(reply, s, again);
     }
-    // bcrypt always runs (dummy salt for unknown users) so timing does not reveal accounts
-    const dev = await owner.one(
-      `select d.username, d.language
-         from (select $1::text as u) x
-         left join meta.developer d on d.username = x.u
-        where crypt($2, coalesce(d.password_hash, gen_salt('bf', 10))) = d.password_hash`,
-      [username, password],
-    );
+    // (sprint 129, SEC-1) an LDAP directory checks the password; the developer is the one linked to the entry
+    const method = String(req.body?.method ?? '');
+    const directory = method.startsWith('ldap:') ? await builderDirectory(method.slice(5)) : undefined;
+    if (method && !directory) {
+      flash(s, tx('signin.expired'), 'error');
+      return back(reply, s, again);
+    }
+    let dev: { username: string; language: string | null } | undefined;
+    if (directory) {
+      let why = 'invalid';
+      try {
+        const u = await ldapAuthenticate(directory, username, password);
+        if (u) {
+          const name = await resolveDeveloper({ kind: 'directory', ...directory }, { subject: u.subject, username: u.username, name: u.displayName, email: u.email, mayLink: true, groups: u.groups });
+          dev = await owner.one('select username, language from meta.developer where username = $1', [name]);
+        }
+      } catch (e) {
+        if (!(e instanceof SsoError)) req.log.warn({ err: e, directory: directory.name }, 'builder ldap sign-in failed');
+        why = e instanceof SsoError ? e.message : e instanceof LdapError ? e.message : 'unreachable';
+      }
+      if (!dev) {
+        await logActivity({ username: username.slice(0, 100), event: 'login_failed', ip, detail: `builder ldap:${directory.name}: ${why}` });
+        flash(s, why === 'invalid' ? tx('signin.invalid') : why === 'unreachable' ? tx('signin.ldap_unavailable', { directory: directory.display_name }) : why, 'error');
+        return back(reply, s, again);
+      }
+    } else
+      // bcrypt always runs (dummy salt for unknown users) so timing does not reveal accounts
+      dev = await owner.one(
+        `select d.username, d.language
+           from (select $1::text as u) x
+           left join meta.developer d on d.username = x.u
+          where crypt($2, coalesce(d.password_hash, gen_salt('bf', 10))) = d.password_hash`,
+        [username, password],
+      );
     // a workspace, when given, must be one of the developer's (administrators: any); the same answer otherwise
-    const ws = dev && workspace
-      ? await owner.one<{ id: number }>(
-          `select w.id from meta.workspace w
-            where lower(w.name) = lower($1)
-              and (exists (select 1 from meta.developer d where d.username = $2 and d.is_admin)
-                   or exists (select 1 from meta.workspace_member m where m.workspace_id = w.id and m.username = $2))`,
-          [workspace, dev.username],
-        )
-      : undefined;
+    const ws = dev && workspace ? await workspaceOf(workspace, dev.username) : undefined;
     if (!dev || (workspace && !ws)) {
-      await logActivity({ username: username.slice(0, 100), event: 'login_failed', ip, detail: workspace ? 'builder (workspace)' : 'builder' });
+      await logActivity({ username: username.slice(0, 100), event: 'login_failed', ip, detail: directory ? `builder ldap:${directory.name} (workspace)` : workspace ? 'builder (workspace)' : 'builder' });
       flash(s, tx(workspace ? 'signin.invalid_ws' : 'signin.invalid'), 'error');
       return back(reply, s, again);
     }
+    // (sprint 129) a workspace of the developer requires single sign-on: not the pgkiln password (break-glass excepted)
+    if (!directory && (await ssoRequired(dev.username))) {
+      await logActivity({ username: dev.username, event: 'login_failed', ip, detail: 'builder: single sign-on required' });
+      flash(s, tx('signin.sso_required'), 'error');
+      return back(reply, s, again);
+    }
+    const weak = !directory && (password === 'admin' || password === dev.username);
+    const detail = directory ? `builder ldap:${directory.name}` : 'builder';
     // (sprint 126, SEC-2) a developer with a second factor: the password was right, the session comes after the code;
     // (sprint 127) unless this browser was trusted after a second factor, for the instance's number of days
     if ((await hasFactor(dev.username)) && !(await isTrustedBrowser(dev.username, req.cookies?.[TRUST_COOKIE]))) {
-      s.state.__MFA = JSON.stringify({ u: dev.username, ws: ws ? String(ws.id) : null, w: workspace, next, remember: req.body?.remember === '1', weak: password === 'admin' || password === dev.username, at: Date.now() });
+      s.state.__MFA = JSON.stringify({ u: dev.username, ws: ws ? String(ws.id) : null, w: workspace, next, remember: req.body?.remember === '1', weak, at: Date.now() });
       await saveState(s);
       return reply.redirect(`${BASE}/login/2fa`, 303);
     }
-    return finishSignIn(req, reply, s, { username: dev.username, language: dev.language }, { ws: ws ? String(ws.id) : null, workspace, next, remember: req.body?.remember === '1', weak: password === 'admin' || password === dev.username, picked, detail: 'builder' });
+    return finishSignIn(req, reply, s, { username: dev.username, language: dev.language }, { ws: ws ? String(ws.id) : null, workspace, next, remember: req.body?.remember === '1', weak, picked, detail });
+  });
+
+  /** A workspace by name, when it is one of the developer's (administrators: any). */
+  const workspaceOf = (workspace: string, username: string) =>
+    owner.one<{ id: number }>(
+      `select w.id from meta.workspace w
+        where lower(w.name) = lower($1)
+          and (exists (select 1 from meta.developer d where d.username = $2 and d.is_admin)
+               or exists (select 1 from meta.workspace_member m where m.workspace_id = w.id and m.username = $2))`,
+      [workspace, username],
+    );
+
+  // (sprint 129, SEC-1) signing in through an identity provider (OpenID Connect or SAML; devsso.ts). The
+  // provider returns to the runtime's callback (/sso/…, registered at the provider for applications too),
+  // which hands sign-ins without an application to the function below.
+  const SSO_COOKIE = 'pgkiln_sso';
+  app.get(`${BASE}/sso/:provider`, async (req: Req, reply) => {
+    const p = await builderProvider(String(req.params.provider));
+    if (!p) return reply.code(404).send('Not found');
+    try {
+      const next = safeNext(req.query?.next);
+      const { url, browserKey } = p.protocol === 'saml' ? await startSamlSignIn(p, null, next) : await startSignIn(p, null, next);
+      reply.setCookie(SSO_COOKIE, browserKey, { path: '/sso', httpOnly: true, sameSite: 'lax', secure: process.env.COOKIE_SECURE === 'true', maxAge: 600 });
+      return reply.redirect(url);
+    } catch (e) {
+      req.log.warn({ err: e }, 'builder sso start failed');
+      const s = await getSession(req, reply, null, BASE);
+      flash(s, translatorFor(validBuilderLanguage(s.state.__BLANG) ?? cookieLanguage(req))('signin.sso_unavailable', { provider: p.display_name }), 'error');
+      return back(reply, s, `${BASE}/login`);
+    }
+  });
+  /** Linking an identity from the Security page (security.ts): the signed-in developer starts it. */
+  app.post(`${BASE}/security/link/:provider`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s) return;
+    const p = await builderProvider(String(req.params.provider));
+    if (!p) return reply.code(404).send('Not found');
+    try {
+      const { url, browserKey } = p.protocol === 'saml' ? await startSamlSignIn(p, null, `${BASE}/security`, s.username!) : await startSignIn(p, null, `${BASE}/security`, s.username!);
+      reply.setCookie(SSO_COOKIE, browserKey, { path: '/sso', httpOnly: true, sameSite: 'lax', secure: process.env.COOKIE_SECURE === 'true', maxAge: 600 });
+      return reply.redirect(url, 303);
+    } catch (e) {
+      req.log.warn({ err: e }, 'builder sso link failed');
+      flash(s, tr(s)('signin.sso_unavailable', { provider: p.display_name }), 'error');
+      return back(reply, s, `${BASE}/security`);
+    }
+  });
+  // the end of both (the runtime's callback; SsoError → an error page there)
+  onBuilderSso(async (req: Req, reply, p, result, ip) => {
+    if (!p.builder || !result.identity) throw new SsoError('This identity provider does not sign developers in.');
+    const src = { kind: 'provider' as const, ...p };
+    if (result.link) {
+      // the browser that started this was signed in as result.link (the start needs the session and its CSRF token)
+      await linkDeveloper(src, result.identity.subject, result.link);
+      logActivity({ username: result.link, event: 'sso_linked', ip, detail: p.name });
+      return reply.redirect(`${BASE}/security?linked=${encodeURIComponent(p.name)}`, 303);
+    }
+    const username = await resolveDeveloper(src, { ...result.identity, username: result.username, groups: result.groups });
+    const dev = await owner.one<{ username: string; language: string | null }>('select username, language from meta.developer where username = $1', [username]);
+    if (!dev) throw new SsoError('The developer was removed.');
+    return finishSignIn(req, reply, null, dev, { ws: null, workspace: '', next: safeNext(result.next), remember: false, weak: false, picked: null, detail: `builder sso:${p.name}`, sso: p.name });
   });
 
-  /** The session after a successful sign-in (password, and the second factor when the developer has one). */
-  async function finishSignIn(req: Req, reply: Parameters<typeof back>[0], s: Awaited<ReturnType<typeof getSession>>, dev: { username: string; language: string | null },
-    o: { ws: string | null; workspace: string; next: string; remember: boolean; weak: boolean; picked: ReturnType<typeof validBuilderLanguage>; detail: string }) {
+  // (sprint 128, SEC-2) signing in with a passkey alone: no user name, no password. The browser offers the
+  // passkeys it holds for this site (discoverable credentials); the authenticator must verify the developer
+  // (fingerprint, face, PIN), so the passkey counts as both factors. Failures count with wrong passwords.
+  app.post(`${BASE}/login/passkey/options`, async (req: Req, reply) => {
+    const s = await getSession(req, reply, null, BASE);
+    if (req.body?.__csrf !== s.csrf_token) return reply.code(403).send('Reload the page.');
+    if (!(await passkeySignin())) return reply.code(404).send('Passkey sign-in is off.');
+    const challenge = giveChallenge(s as Parameters<typeof giveChallenge>[0], 'get');
+    await saveState(s);
+    reply.header('cache-control', 'no-store');
+    return reply.send({ mode: 'get', challenge, rpId: relyingParty(req).rpId, allow: [], uv: 'required' });
+  });
+  app.post(`${BASE}/login/passkey`, async (req: Req, reply) => {
+    const s = await getSession(req, reply, null, BASE);
+    const ip = clientIp(req);
+    const picked = validBuilderLanguage(s.state.__BLANG);
+    const tx = translatorFor(picked ?? cookieLanguage(req));
+    const workspace = String(req.body?.workspace ?? '').trim().slice(0, 60);
+    const next = safeNext(req.body?.next);
+    const again = next === `${BASE}/home` ? `${BASE}/login` : `${BASE}/login?next=${encodeURIComponent(next)}`;
+    const challenge = takeChallenge(s as Parameters<typeof takeChallenge>[0], 'get');
+    if (req.body?.__csrf !== s.csrf_token || !(await passkeySignin())) {
+      flash(s, tx('signin.expired'), 'error');
+      return back(reply, s, again);
+    }
+    const rp = relyingParty(req);
+    const key = await passkeyByCredential(String(req.body?.credentialId ?? ''), rp.rpId);
+    const who = key?.username ?? '';
+    if (await loginThrottled(null, who, ip)) {
+      logActivity({ username: who, event: 'login_locked', ip, detail: 'builder passkey' });
+      flash(s, tx('signin.throttled'), 'error');
+      return back(reply, s, again);
+    }
+    let why = key ? '' : 'unknown passkey';
+    if (key && !challenge) why = 'no or an expired challenge';
+    else if (key && req.body?.userHandle && req.body.userHandle !== userHandle(key.username)) why = 'the user handle does not match';
+    else if (key && challenge) {
+      try {
+        const r = verifyAssertion(
+          { clientDataJSON: String(req.body?.clientDataJSON ?? ''), authenticatorData: String(req.body?.authenticatorData ?? ''), signature: String(req.body?.signature ?? '') },
+          { alg: key.alg, jwk: key.public_key, signCount: Number(key.sign_count) }, { challenge, ...rp });
+        if (!r.userVerified) why = 'the authenticator did not verify the user';
+        else if (!(await usePasskey(key.id, key.sign_count, r.signCount))) why = 'used at the same time elsewhere';
+      } catch (e) {
+        why = e instanceof WebAuthnError ? e.message : 'unreadable answer';
+      }
+    }
+    const ws = !why && workspace ? await workspaceOf(workspace, who) : undefined;
+    if (!why && workspace && !ws) why = 'not a workspace of the developer';
+    // (sprint 129) a passkey alone is not single sign-on
+    if (!why && (await ssoRequired(who))) why = 'single sign-on required';
+    if (why) {
+      await logActivity({ username: who.slice(0, 100), event: 'login_failed', ip, detail: `builder passkey: ${why}` });
+      flash(s, tx(why === 'not a workspace of the developer' ? 'signin.invalid_ws' : why === 'single sign-on required' ? 'signin.sso_required' : 'mfa.passkey_failed'), 'error');
+      return back(reply, s, again);
+    }
+    const dev = await owner.one<{ username: string; language: string | null }>('select username, language from meta.developer where username = $1', [who]);
+    if (!dev) return back(reply, s, again);
+    return finishSignIn(req, reply, s, dev, { ws: ws ? String(ws.id) : null, workspace, next, remember: req.body?.remember === '1', weak: false, picked, detail: 'builder passkey' });
+  });
+
+  /**
+   * The session after a successful sign-in (password, and the second factor when the developer has one;
+   * or an identity provider, sso: its name; s null: the sign-in page's session is not at hand there).
+   */
+  async function finishSignIn(req: Req, reply: Parameters<typeof back>[0], s: Awaited<ReturnType<typeof getSession>> | null, dev: { username: string; language: string | null },
+    o: { ws: string | null; workspace: string; next: string; remember: boolean; weak: boolean; picked: ReturnType<typeof validBuilderLanguage>; detail: string; sso?: string }) {
     const ip = clientIp(req);
     const { picked, next, workspace } = o;
-    await destroySession(reply, s, BASE);
+    if (s) await destroySession(reply, s, BASE);
     const ns = await createSession(reply, null, BASE, dev.username);
     // the builder theme chosen earlier on this device
     const theme = validTheme(req.cookies?.[THEME_COOKIE]);
@@ -180,8 +349,12 @@ export async function builderRoutes(app: FastifyInstance) {
       if (dev.language && ns.state.__BLANG !== 'en') reply.setCookie(LANG_COOKIE, ns.state.__BLANG, langCookieOptions());
     }
     if (o.weak) ns.state.__WEAK = '1';
+    // (sprint 129) the identity provider decided on the second factor: no enrolment in pgkiln (ui.ts)
+    if (o.sso) ns.state.__SSO = o.sso;
     await saveState(ns);
-    if (o.remember)
+    if (o.sso) {
+      // the sign-in page's "remember" stays as it was
+    } else if (o.remember)
       reply.setCookie(REMEMBER_COOKIE, Buffer.from(JSON.stringify({ w: workspace, u: dev.username })).toString('base64url'), {
         path: BASE, httpOnly: true, sameSite: 'lax', maxAge: 365 * 24 * 3600, secure: process.env.COOKIE_SECURE === 'true',
       });
@@ -380,6 +553,7 @@ export async function builderRoutes(app: FastifyInstance) {
   await workspaceRoutes(app);
   await instanceRoutes(app);
   await securityRoutes(app);
+  await builderSsoRoutes(app);
   await wizardRoutes(app);
   await appFromFileRoutes(app);
 
@@ -861,7 +1035,10 @@ export async function builderRoutes(app: FastifyInstance) {
   app.get(`${BASE}/developers`, async (req: Req, reply) => {
     const s = await developer(req, reply);
     if (!s) return;
-    const devs = (await owner.query(`select username, is_admin, email, exists (select 1 from meta.developer_factor f where f.username = d.username) as mfa
+    const devs = (await owner.query(`select username, is_admin, email, break_glass, exists (select 1 from meta.developer_factor f where f.username = d.username) as mfa,
+                                            (select string_agg(coalesce(p.display_name, l.display_name), ', ' order by 1) from meta.developer_identity i
+                                               left join meta.auth_provider p on p.id = i.provider_id left join meta.ldap_directory l on l.id = i.directory_id
+                                              where i.username = d.username) as identities
                                        from meta.developer d order by 1`)).rows;
     const admin = devs.some((d) => d.username === s.username && d.is_admin);
     const me = devs.find((d) => d.username === s.username);
@@ -880,7 +1057,7 @@ export async function builderRoutes(app: FastifyInstance) {
         ${region(tx('dev.accounts'), html`
           <p class="muted u-mt0">${tx('dev.accounts_help')}</p>
           <div class="table-wrap"><table class="report report-reflow"><thead><tr><th>${tx('dev.username')}</th><th>${tx('dev.role')}</th><th>${tx('dev.email_col')}</th><th>${tx('mfa.column')}</th><th></th></tr></thead><tbody>
-            ${devs.map((d) => html`<tr><td data-label="${tx('dev.username')}">${d.username}${d.username === s.username ? ` ${tx('dev.you')}` : ''}</td><td data-label="${tx('dev.role')}">${d.is_admin ? tx('dev.administrator') : tx('dev.developer')}</td>
+            ${devs.map((d) => html`<tr><td data-label="${tx('dev.username')}">${d.username}${d.username === s.username ? ` ${tx('dev.you')}` : ''}</td><td data-label="${tx('dev.role')}">${d.is_admin ? tx('dev.administrator') : tx('dev.developer')}${d.break_glass ? html` <span class="badge badge-warn" title="${tx('bsso.break_glass_help')}">${tx('bsso.break_glass')}</span>` : ''}${d.identities ? html`<br><span class="muted small">${icon('log-in')} ${d.identities}</span>` : ''}</td>
               <td data-label="${tx('dev.email_col')}">${admin && d.username !== s.username
                 ? html`<form method="post" action="${BASE}/developers/email" class="search u-m0 u-mwnone">${csrf(s)}<input type="hidden" name="username" value="${d.username}"><input name="email" type="email" value="${d.email ?? ''}" aria-label="${tx('dev.email_of', { user: d.username })}" placeholder="${tx('dev.none')}"><button class="btn">${tx('dev.save')}</button></form>`
                 : html`<span class="wrap-anywhere">${d.email ?? ''}</span>`}</td>
@@ -888,6 +1065,7 @@ export async function builderRoutes(app: FastifyInstance) {
                   ${input(`reason_${d.username}`.replace(/[^\w]/g, '_'), tx('mfa.reason'), '', { required: true, help: tx('mfa.reset_help', { user: d.username }) })}
                   <button class="btn btn-sm btn-danger">${tx('mfa.reset_btn')}</button></form></div></details>` : ''}` : html`<span class="muted">${tx('mfa.off')}</span>`}</td><td>${d.username === s.username || !admin ? '' : html`
               <form method="post" action="${BASE}/developers/admin" class="u-inline">${csrf(s)}<input type="hidden" name="username" value="${d.username}"><input type="hidden" name="is_admin" value="${d.is_admin ? 'false' : 'true'}"><button class="link-button">${d.is_admin ? tx('dev.make_dev') : tx('dev.make_admin')}</button></form>
+              ${d.is_admin ? html`· <form method="post" action="${BASE}/developers/break-glass" class="u-inline">${csrf(s)}<input type="hidden" name="username" value="${d.username}"><input type="hidden" name="break_glass" value="${d.break_glass ? 'false' : 'true'}"><button class="link-button" title="${tx('bsso.break_glass_help')}">${d.break_glass ? tx('bsso.break_glass_remove') : tx('bsso.break_glass_make')}</button></form>` : ''}
               · <form method="post" action="${BASE}/developers/delete" class="u-inline">${csrf(s)}<input type="hidden" name="username" value="${d.username}"><button class="link-button" data-confirm="${tx('dev.remove_confirm', { user: d.username })}">${tx('dev.remove')}</button></form>`}</td></tr>`)}
           </tbody></table></div>
           ${admin
@@ -975,7 +1153,12 @@ export async function builderRoutes(app: FastifyInstance) {
         flash(s, tr(s)('mfa.keep_admins'), 'error');
         return back(reply, s, `${BASE}/developers`);
       }
-      await owner.query('update meta.developer set is_admin = $2 where username = $1', [req.body.username, req.body.is_admin === 'true']);
+      // (sprint 129) break-glass is for administrators: a developer loses it, unless they are the last one needed
+      if (req.body.is_admin !== 'true' && (await leavesNoBreakGlass(req.body.username))) {
+        flash(s, tr(s)('bsso.keep_break_glass'), 'error');
+        return back(reply, s, `${BASE}/developers`);
+      }
+      await owner.query('update meta.developer set is_admin = $2, break_glass = break_glass and $2 where username = $1', [req.body.username, req.body.is_admin === 'true']);
       flash(s, tr(s)('dev.role_changed'));
     }
     return back(reply, s, `${BASE}/developers`);
@@ -986,7 +1169,7 @@ export async function builderRoutes(app: FastifyInstance) {
     if (!s) return;
     if (!(await isAdmin(s.username))) return reply.code(403).send('Only administrators remove developers.');
     if (req.body?.username && req.body.username !== s.username) {
-      if (await leavesTooFewAdmins(req.body.username)) {
+      if ((await leavesTooFewAdmins(req.body.username)) || (await leavesNoBreakGlass(req.body.username))) {
         flash(s, tr(s)('mfa.keep_admins'), 'error');
         return back(reply, s, `${BASE}/developers`);
       }

package/src/builder/security.ts

@@ -1,4 +1,3 @@
-import { createHash } from 'node:crypto';
 import { isIP } from 'node:net';
 import type { FastifyInstance } from 'fastify';
 import { owner } from '../db.ts';
@@ -6,15 +5,16 @@ import { html, raw, type Raw } from '../html.ts';
 import { icon } from '../icons.ts';
 import {
   addPasskey, addTotp, adminEmails, adminFactors, codesLeft, confirmRecoveryCodes, factorsOf, forgetBrowsers, hasFactor, matchTotp, MFA_POLICIES, mfaPolicy,
-  newRecoveryCodes, newTotpSecret, notifyMfa, otpauthUri, passkeysOf, policyProblem, requiredFor, resetFactors, setPolicy, setTrustDays, trustDays,
-  trustedBrowsers, unbase32, type MfaPolicy,
+  newRecoveryCodes, newTotpSecret, notifyMfa, otpauthUri, passkeysOf, policyProblem, requirement, resetFactors, setPolicy, setTrustDays, trustDays,
+  trustedBrowsers, unbase32, userHandle, passkeySignin, setPasskeySignin, type MfaPolicy,
 } from '../mfa.ts';
 import { qrSvg } from '../qrcode.ts';
 import { secretKeyConfigured } from '../secrets.ts';
 import { clientIp, logActivity, saveState, type Session } from '../session.ts';
-import { ALGORITHMS, b64url, newChallenge, relyingParty, verifyRegistration, WebAuthnError } from '../webauthn.ts';
+import { ALGORITHMS, newChallenge, relyingParty, verifyRegistration, WebAuthnError } from '../webauthn.ts';
 import { tr } from './i18n.ts';
 import { isAdmin } from './locks.ts';
+import { identitiesRegion } from './builder-sso.ts';
 import { back, BASE, csrf, developer, flash, input, region, send, shell, type Req } from './ui.ts';
 
 // (sprint 126, SEC-2 and SEC-6) Developer › Security: a developer's second factors (authenticator apps, TOTP)
@@ -59,9 +59,9 @@ export async function securityRoutes(app: FastifyInstance) {
     if (!s) return;
     const tx = tr(s);
     const me = s.username!;
-    const [factors, left, pol, admin, days, trusted] = await Promise.all([factorsOf(me), codesLeft(me), mfaPolicy(), isAdmin(me), trustDays(), trustedBrowsers(me)]);
+    const [factors, left, admin, days, trusted] = await Promise.all([factorsOf(me), codesLeft(me), isAdmin(me), trustDays(), trustedBrowsers(me)]);
     const rp = relyingParty(req);
-    const required = requiredFor(pol.policy, admin);
+    const { required } = await requirement(me, admin);
     const pending = (() => {
       try {
         const p = JSON.parse(String(s.state.__TOTP_NEW ?? ''));
@@ -136,7 +136,8 @@ export async function securityRoutes(app: FastifyInstance) {
           ${days || trusted ? html`<h3>${tx('mfa.trusted_title')}</h3>
             <p class="u-mt0">${days ? tx('mfa.trusted_count', { n: trusted, days }) : tx('mfa.trusted_off')}</p>
             ${trusted ? html`<form method="post" action="${BASE}/security/forget-browsers">${csrf(s)}<button class="btn">${tx('mfa.forget_browsers')}</button></form>` : ''}` : ''}`)}
-      </div>`;
+      </div>
+      ${await identitiesRegion(s, typeof req.query?.linked === 'string' ? req.query.linked : undefined)}`;
     return send(reply, s, shell(s, tx('mfa.title'), [[tx('mfa.title')]], main, 'developers'));
   });
 
@@ -222,7 +223,7 @@ export async function securityRoutes(app: FastifyInstance) {
     if (last) {
       const pol = await mfaPolicy();
       const admin = await isAdmin(me);
-      if (requiredFor(pol.policy, admin)) {
+      if ((await requirement(me, admin)).required) {
         flash(s, tx('mfa.cannot_remove_required'), 'error');
         return back(reply, s, `${BASE}/security`);
       }
@@ -257,7 +258,7 @@ export async function securityRoutes(app: FastifyInstance) {
     return reply.send({
       mode: 'create', challenge, rp: { id: rp.rpId, name: 'pgkiln' }, algs: ALGORITHMS,
       // a stable handle that isn't the user name (the authenticator may show it, but it says nothing)
-      user: { id: b64url(createHash('sha256').update(`pgkiln-developer:${me}`).digest().subarray(0, 16)), name: me, displayName: me },
+      user: { id: userHandle(me), name: me, displayName: me },
       exclude: (await passkeysOf(me, rp.rpId)).map((p) => p.credential_id),
     });
   });
@@ -341,9 +342,11 @@ export async function securityRoutes(app: FastifyInstance) {
       flash(s, tx('mfa.policy_needs_admins'), 'error');
       return back(reply, s, `${BASE}/instance#mfa`);
     }
+    const alone = req.body?.passkey_signin === '1';
     await setPolicy(policy, grace);
     await setTrustDays(trust);
-    await logActivity({ username: s.username, event: '2fa_policy', ip: clientIp(req), detail: `${policy}, grace ${grace} days, trust browsers ${trust} days` });
+    await setPasskeySignin(alone);
+    await logActivity({ username: s.username, event: '2fa_policy', ip: clientIp(req), detail: `${policy}, grace ${grace} days, trust browsers ${trust} days, passkey sign-in ${alone ? 'on' : 'off'}` });
     await notifyMfa(await adminEmails(), `pgkiln: two-factor sign-in policy is now ${policy}`, `${s.username} set the two-factor policy to ${policy} (grace period ${grace} days).`);
     flash(s, tx('mfa.policy_saved'));
     return back(reply, s, `${BASE}/instance#mfa`);
@@ -353,8 +356,8 @@ export async function securityRoutes(app: FastifyInstance) {
 /** The Instance settings region for the policy (administrators). */
 export async function policyRegion(s: Session): Promise<Raw> {
   const tx = tr(s);
-  const [pol, af, days, without] = await Promise.all([
-    mfaPolicy(), adminFactors(), trustDays(),
+  const [pol, af, days, alone, without] = await Promise.all([
+    mfaPolicy(), adminFactors(), trustDays(), passkeySignin(),
     owner.query<{ username: string; is_admin: boolean }>('select username, is_admin from meta.developer d where not exists (select 1 from meta.developer_factor f where f.username = d.username) order by username'),
   ]);
   const opt = (v: MfaPolicy) => html`<option value="${v}"${pol.policy === v ? raw(' selected') : ''}>${tx(({ off: 'mfa.policy_off', admins: 'mfa.policy_admins', all: 'mfa.policy_all' } as const)[v])}</option>`;
@@ -364,6 +367,8 @@ export async function policyRegion(s: Session): Promise<Raw> {
         ${input('grace_days', tx('mfa.grace'), pol.graceDays, { type: 'number', help: tx('mfa.grace_help') })}
         ${input('trust_days', tx('mfa.trust_days'), days, { type: 'number', help: tx('mfa.trust_days_help') })}
       </div>
+      <div class="field"><label class="check"><input type="checkbox" name="passkey_signin" value="1"${alone ? raw(' checked') : ''}> ${tx('mfa.passkey_signin')}</label>
+        <small class="help">${tx('mfa.passkey_signin_help')}</small></div>
       <p class="muted small">${tx('mfa.policy_help', { enrolled: af.enrolled, admins: af.admins })}</p>
       <div class="buttons"><button class="btn btn-hot">${tx('mfa.policy_save')}</button></div></form>
     ${without.rows.length ? html`<p class="small">${tx('mfa.without', { list: without.rows.map((d) => `${d.username}${d.is_admin ? ' (admin)' : ''}`).join(', ') })}</p>` : ''}

package/src/builder/ui.ts

@@ -12,7 +12,7 @@ import { ensureDevbar } from '../runtime/devbar.ts';
 import { noteChange } from './app-updates.ts';
 import { clientTexts, tr } from './i18n.ts';
 import { languageMenu, loadLanguage } from './language.ts';
-import { enrolmentDue } from '../mfa.ts';
+import { enrolmentDue, requirement } from '../mfa.ts';
 
 // Shared building blocks of the builder UI.
 
@@ -323,9 +323,20 @@ export async function developer(req: Req, reply: FastifyReply) {
   if (s.state.__BLANG === undefined) await loadLanguage(s);
   // (sprint 126, SEC-2) the two-factor policy: a banner during the grace period, then only the Security page until they enrol
   delete s.state.__MFA_DUE;
-  const due = await enrolmentDue(s.username, await isAdmin(s.username));
+  const admin = await isAdmin(s.username);
+  // (sprint 128) signed in with the default password while a second factor is required: change it first
+  // (on Developers), then the enrolment below
+  const weakFirst = !!s.state.__WEAK && (await requirement(s.username, admin)).required;
+  if (weakFirst && !/^\/builder\/(developers|logout|language|theme)(?:[/?#]|$)/.test(req.url)) {
+    flash(s, tr(s)('mfa.weak_required'), 'error');
+    await saveState(s);
+    reply.redirect(`${BASE}/developers`);
+    return null;
+  }
+  // (sprint 129) signed in through an identity provider: it decides on the second factor
+  const due = s.state.__SSO ? null : await enrolmentDue(s.username, admin);
   if (due?.due === 'grace') s.state.__MFA_DUE = due.until.toISOString();
-  else if (due && !/^\/builder\/(security|logout|language|theme)(?:[/?]|$)/.test(req.url)) {
+  else if (due && !weakFirst && !/^\/builder\/(security|logout|language|theme)(?:[/?]|$)/.test(req.url)) {
     reply.redirect(`${BASE}/security`);
     return null;
   }

package/src/builder/users.ts

@@ -7,6 +7,7 @@ import { accountSettings, clearAccountSettings, passwordProblem } from '../accou
 import { loginMaxFailuresPerUser, loginWindowMinutes } from '../security.ts';
 import { acsUrl, metadataUrl, spEntityId } from '../saml.ts';
 import { discover, publicUrl, redirectUri } from '../sso.ts';
+import { builderSignInRegion } from './builder-sso.ts';
 import { administrator, back, BASE, csrf, developer, flash, input, region, select, send, shell, type Req } from './ui.ts';
 
 // The workspace user directory (like APEX's workspace users with
@@ -476,6 +477,7 @@ export async function usersRoutes(app: FastifyInstance) {
           <p class="muted">${tx.rich('idp.public_url', { env: html`<code>PUBLIC_URL</code>` })}</p>
           <p>${tx.rich('idp.grant', { type: html`<b>${tx('idp.auth_code')}</b>`, scopes: html`<code>${pr.scopes}</code>`, claim: html`<code>${pr.groups_claim}</code>` })}</p>
           <form method="post" action="${BASE}/users/providers/${pr.id}/test">${csrf(s)}<button class="btn">${tx('idp.test')}</button></form>`)}
+        ${await builderSignInRegion(s, 'provider', pr)}
       </div>`;
     return send(reply, s, shell(s, pr.display_name, [['Users', `${BASE}/users`], [tx('idp.title'), `${BASE}/users/providers`], [pr.display_name]], main, 'users'));
   });

package/src/builder/workspaces.ts

@@ -8,6 +8,8 @@ import { html, raw } from '../html.ts';
 import { icon } from '../icons.ts';
 import { clientIp, logActivity, type BuilderWorkspace, type Session } from '../session.ts';
 import { isAdmin } from './locks.ts';
+import { setWorkspaceRequired } from '../mfa.ts';
+import { breakGlassAdmins } from '../devsso.ts';
 import { back, BANNER_COLORS, BASE, csrf, developer, flash, input, region, select, send, shell, type Req } from './ui.ts';
 
 // Workspaces (064; APEX: workspaces). A workspace groups applications and the
@@ -215,7 +217,7 @@ function serviceRegion(s: Session, w: { id: number; message: string | null; bann
 }
 
 /** (093) Workspace preferences: the SQL Workshop and the applications' REST modules on or off. */
-function preferencesRegion(s: Session, w: { id: number; sql_workshop: boolean; rest_services: boolean; builder_home: string | null }) {
+function preferencesRegion(s: Session, w: { id: number; sql_workshop: boolean; rest_services: boolean; builder_home: string | null; mfa_required_since: Date | null; sso_only: boolean }, without: string[], unlinked: string[]) {
   const check = (name: string, on: boolean, label: string, help: string) =>
     html`<div class="field"><label class="check"><input type="checkbox" name="${name}" value="true"${on ? raw(' checked') : ''}> ${label}</label><small class="help">${help}</small></div>`;
   const tx = tr(s);
@@ -223,7 +225,17 @@ function preferencesRegion(s: Session, w: { id: number; sql_workshop: boolean; r
       ${check('sql_workshop', w.sql_workshop, tx('wsp.sql_on'), tx('wsp.sql_on_help'))}
       ${check('rest_services', w.rest_services, tx('wsp.rest_on'), tx('wsp.rest_on_help', { path: '/a/<alias>/rest/…' }))}
       ${select('builder_home', tx('wsp.builder_home'), w.builder_home === 'home' ? 'home' : 'apps', [['apps', tx('wsp.home.apps')], ['home', tx('wsp.home.home')]], tx('wsp.builder_home_help'))}
-      <div class="buttons"><button class="btn">${tx('wsp.save_prefs')}</button></div></form>`, '', 'preferences');
+      <div class="buttons"><button class="btn">${tx('wsp.save_prefs')}</button></div></form>
+    <h3 id="mfa">${tx('wsp.mfa')}</h3>
+    <form method="post" action="${BASE}/workspaces/${w.id}/mfa">${csrf(s)}
+      ${check('required', !!w.mfa_required_since, tx('wsp.mfa_required'), tx('wsp.mfa_required_help'))}
+      ${w.mfa_required_since ? html`<p class="small">${tx('wsp.mfa_since', { date: new Date(w.mfa_required_since).toISOString().slice(0, 10) })}${without.length ? html` ${tx('wsp.mfa_without', { list: without.join(', ') })}` : ''}</p>` : ''}
+      <div class="buttons"><button class="btn">${tx('wsp.mfa_save')}</button></div></form>
+    <h3 id="sso">${tx('wsp.sso')}</h3>
+    <form method="post" action="${BASE}/workspaces/${w.id}/sso">${csrf(s)}
+      ${check('sso_only', w.sso_only, tx('wsp.sso_only'), tx('wsp.sso_only_help'))}
+      ${w.sso_only && unlinked.length ? html`<p class="small">${tx('wsp.sso_unlinked', { list: unlinked.join(', ') })}</p>` : ''}
+      <div class="buttons"><button class="btn">${tx('wsp.sso_save')}</button></div></form>`, '', 'preferences');
 }
 
 /** (093) Extension links: links to other tools in the builder's Extensions menu. */
@@ -341,6 +353,15 @@ export async function workspaceRoutes(app: FastifyInstance) {
     ]);
     const roles = rolesQ;
     const links = (await owner.query('select id, label, url, description, position from meta.workspace_link where workspace_id = $1 order by position, lower(label)', [w.id])).rows;
+    // (sprint 128) the members still without a second factor
+    const without = (await owner.query<{ username: string }>(
+      `select m.username from meta.workspace_member m where m.workspace_id = $1
+          and not exists (select 1 from meta.developer_factor f where f.username = m.username) order by 1`, [w.id])).rows.map((r) => r.username);
+    // (sprint 129) the members who could not sign in while single sign-on is required: no linked identity, not break-glass
+    const unlinked = (await owner.query<{ username: string }>(
+      `select m.username from meta.workspace_member m join meta.developer d on d.username = m.username
+        where m.workspace_id = $1 and not d.break_glass
+          and not exists (select 1 from meta.developer_identity i where i.username = m.username) order by 1`, [w.id])).rows.map((r) => r.username);
     const main = html`
       <div class="title-row"><h1>${w.name}</h1></div>
       <div class="columns wide-left">
@@ -365,7 +386,7 @@ export async function workspaceRoutes(app: FastifyInstance) {
       </div>
       ${serviceRegion(s, w)}
       ${region(tx('wsp.mail_net'), html`<p class="u-mt0">${tx.rich('wsp.mail_net_text', { mail: html`<a href="${BASE}/workspaces/${w.id}/mail">${tx('wsp.mail_service')}</a>`, network: html`<a href="${BASE}/network?ws=${w.id}">${tx('wsp.network')}</a>`, queue: html`<a href="${BASE}/mail-queue${full ? `?ws=${w.id}` : ''}">${tx('wsp.queue')}</a>` })}</p>`, '', 'mail-network')}
-      <div class="columns">${preferencesRegion(s, w)}${linksRegion(s, w, links)}</div>
+      <div class="columns">${preferencesRegion(s, w, without, unlinked)}${linksRegion(s, w, links)}</div>
       ${full ? isolationRegion(s, w, roles.rows) : region(tx('wsp.isolation'), html`<p class="u-mt0">${w.isolated ? tx('wsp.iso_short_on') : tx('wsp.iso_short_off')} ${tx('wsp.admins_change')}</p>`)}
       ${!full ? '' : region(tx('wsp.applications'), html`<div class="table-wrap"><table class="report report-reflow">
         <thead><tr><th>${tx('wsp.application')}</th><th>${tx('wsp.move_to')}</th></tr></thead>
@@ -559,6 +580,40 @@ export async function workspaceRoutes(app: FastifyInstance) {
     return back(reply, s, `${BASE}/workspaces/${req.params.id}`);
   });
 
+  // (sprint 128, SEC-2) a workspace requires a second factor of its developers (the instance's grace period from now)
+  app.post(`${BASE}/workspaces/:id(^\\d{1,9}$)/mfa`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s || !(await workspaceAdminOnly(s, reply, req.params.id))) return;
+    const on = req.body?.required === 'true';
+    if (!(await setWorkspaceRequired(Number(req.params.id), on))) return reply.code(404).send('Not found');
+    await logActivity({ appId: null, username: s.username, event: '2fa_policy', ip: clientIp(req), detail: `workspace ${req.params.id}: two-factor sign-in ${on ? 'required' : 'not required'}` });
+    flash(s, tr(s)(on ? 'wsp.mfa_on' : 'wsp.mfa_off'));
+    return back(reply, s, `${BASE}/workspaces/${req.params.id}#mfa`);
+  });
+
+  // (sprint 129, SEC-1) a workspace requires single sign-on of its developers: not while no break-glass
+  // administrator could sign in with the password, and not by someone who would lock themselves out
+  app.post(`${BASE}/workspaces/:id(^\\d{1,9}$)/sso`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s || !(await workspaceAdminOnly(s, reply, req.params.id))) return;
+    const tx = tr(s);
+    const on = req.body?.sso_only === 'true';
+    if (on && !(await breakGlassAdmins()).length) {
+      flash(s, tx('wsp.sso_no_break_glass'), 'error');
+      return back(reply, s, `${BASE}/workspaces/${req.params.id}#sso`);
+    }
+    if (on && !(await owner.one(`select 1 as ok from meta.developer d where d.username = $1
+        and (d.break_glass or exists (select 1 from meta.developer_identity i where i.username = d.username))`, [s.username]))) {
+      flash(s, tx('wsp.sso_link_first'), 'error');
+      return back(reply, s, `${BASE}/workspaces/${req.params.id}#sso`);
+    }
+    const r = await owner.query('update meta.workspace set sso_only = $2 where id = $1', [req.params.id, on]);
+    if (!r.rowCount) return reply.code(404).send('Not found');
+    await logActivity({ appId: null, username: s.username, event: 'sso_policy', ip: clientIp(req), detail: `workspace ${req.params.id}: single sign-on ${on ? 'required' : 'not required'}` });
+    flash(s, tx(on ? 'wsp.sso_on' : 'wsp.sso_off'));
+    return back(reply, s, `${BASE}/workspaces/${req.params.id}#sso`);
+  });
+
   // (093) extension links
   app.post(`${BASE}/workspaces/:id(^\\d{1,9}$)/links`, async (req: Req, reply) => {
     const s = await developer(req, reply);