pgkiln 0.65.0 → 0.67.0

package/SECURITY.md

@@ -117,6 +117,7 @@ first version (MVP). Every finding below has a regression test in
 | Passkey sign-in without a password, workspace rule (0.62.0) | *Sign in with a passkey* asks the browser for any passkey of this site (empty allow list) with `userVerification: required`, and the server refuses an answer whose authenticator data lacks the user-verified flag, so the passkey alone stands for possession plus a fingerprint, face or PIN. The credential id is looked up for this relying party only; a user handle, when the browser sends one, must be the developer's (a SHA-256-derived handle, not the user name). The same one-time challenge, origin, RP ID hash, signature and counter checks as at the second step apply; failures are logged as `login_failed` with the developer's name when the key is known and count for the per-user and per-IP lockout. Administrators turn it off in Instance settings. A workspace's rule (administrators and its own administrators only, CSRF-checked) can only add a requirement; `pgkiln admin set-2fa-policy off` clears every workspace's rule. While a second factor is required of a developer, a sign-in with the default password leads only to the password change. |
 | Single sign-on for developers (0.63.0) | A provider or directory signs developers in only with *builder* turned on. The flow is the applications' (state, PKCE, nonce, browser-binding cookie, ID token or SAML assertion checks) with a pending row without an application; developers are found by the provider's stable subject in `meta.developer_identity`, never by a name alone. An existing developer is linked by name only when the administrator allows it, once, never a break-glass administrator, and an e-mail user name only when verified; otherwise the developer links the identity on Security, which needs their session and CSRF token to start and the same browser to finish, and one identity can't be linked to two developers. Automatic accounts need the developers group when one is set and start as developers; the administrators group decides the role at every sign-in but never demotes a break-glass administrator. A workspace's single sign-on rule (administrators and its own administrators, CSRF-checked) refuses the pgkiln password and a passkey alone, after the password check so it reveals nothing; it can only be turned on while a break-glass administrator exists and by someone who could still sign in; the last break-glass administrator and a developer's last identity can't be removed while it applies. Failures are logged as `login_failed` with the reason. |
 | Two-factor sign-in for application users (0.64.0) | Per application (`meta.app.mfa`: off, optional, required, required for roles). The account's TOTP secrets are encrypted with `PGKILN_SECRET_KEY` and stored only after a code confirms them; recovery codes are SHA-256 and used up atomically; each 30-second step once, one step either side. A password or LDAP sign-in that needs the step creates no session: the pending sign-in (5 minutes, 10 while adding an app) lives in the signed-out session, bound to it and to the page's CSRF token, and a forged token ends it. Wrong codes count as failed sign-ins (the per-user and per-IP lockout). A *Keep me signed in* or session-sharing token stands in for the step only when its method ends in `+2fa`; an identity provider's sign-in is left to the provider. Without the instance key the step can't be required and enrolment refuses rather than skips. Removing an app needs a current or recovery code and is refused for the last app while the application requires it; a developer's reset (Users, with a reason) removes the apps and codes and ends the account's sessions, remembered and shared sign-ins. Every enrolment, removal, reset and used recovery code is in the activity log. The factor tables are closed to the runtime roles. |
+| Lockout checks and key rotation (0.67.0) | Only administrators see the checks and confirm a key backup (CSRF); the page shows a 16-character fingerprint of `PGKILN_SECRET_KEY` from a separate derivation, never the key; values from the database (RP IDs, names) are escaped. `pgkiln admin rotate-key` reads both keys from the environment (never arguments, so not in the shell history or the process list), decrypts every secret before it writes, and changes everything or nothing in one transaction; it is logged and mailed to the administrators. The runtime role reads none of the encrypted columns (tested for every `*_enc` column) |
 
 ## Findings of the MVP review and their fixes
 

package/db/migrations/134_idp_mfa.sql

@@ -0,0 +1,46 @@
+-- ---------------------------------------------------------------------
+-- 134: make sure an identity provider really did multi-factor sign-in
+-- (sprint 132, SEC-4; beyond APEX, which trusts the IdP's sign-on policy).
+--
+-- meta.auth_provider:
+--   mfa_required       refuse a sign-in (to applications and to the builder)
+--                      unless the provider says it asked for a second factor:
+--                      OpenID Connect through the ID token's amr or acr claim,
+--                      SAML through the assertion's AuthnContextClassRef.
+--   mfa_request        what to ask the provider for, space separated: OpenID
+--                      Connect acr_values, or SAML AuthnContextClassRef values
+--                      (a RequestedAuthnContext). null: ask for nothing.
+--   mfa_values         the amr / acr / AuthnContextClassRef values that count
+--                      as a second factor (any one of them is enough).
+--   local_second_step  after a sign-in through this provider, pgkiln asks its
+--                      own second step as after a password (the application's
+--                      two-step rule; the developer's factor for the builder),
+--                      for providers that cannot enforce MFA themselves.
+--
+-- meta.sso_pending.stepup_session: a step-up through the provider (an
+-- authorization scheme with mfa_minutes, 133): the signed-in session the
+-- provider's fresh multi-factor sign-in confirms. The provider is asked to
+-- sign the user in again (prompt=login / max_age=0, SAML ForceAuthn).
+-- ---------------------------------------------------------------------
+alter table meta.auth_provider
+  add column mfa_required      boolean not null default false,
+  add column mfa_request       text check (length(mfa_request) <= 500),
+  add column mfa_values        text[] not null default array[
+    'mfa',
+    'http://schemas.microsoft.com/claims/multipleauthn',
+    'urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorContract',
+    'urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorUnregistered'],
+  add column local_second_step boolean not null default false;
+comment on column meta.auth_provider.mfa_required is
+  'Refuse sign-ins the provider does not mark as multi-factor (amr / acr, SAML AuthnContextClassRef; 134).';
+comment on column meta.auth_provider.mfa_request is
+  'acr_values (OpenID Connect) or AuthnContextClassRef values (SAML) to request, space separated (134).';
+comment on column meta.auth_provider.mfa_values is
+  'amr / acr / AuthnContextClassRef values that count as a second factor (134).';
+comment on column meta.auth_provider.local_second_step is
+  'After a sign-in through this provider, pgkiln asks its own second step too (134).';
+
+alter table meta.sso_pending
+  add column stepup_session uuid references meta.session (id) on delete cascade;
+comment on column meta.sso_pending.stepup_session is
+  'A step-up through the provider: the signed-in session it confirms (134).';

package/docs/apex-feature-parity.md

@@ -138,7 +138,7 @@ the 26.2 comparison.)
 | APEX accounts | ✅ | Instance-wide user directory, bcrypt, session rotation, idle and absolute timeouts |
 | Application Access Control (roles per app, any-user switch) | ✅ | Access control per application |
 | Social sign-in / OpenID Connect | ✅ | Any OIDC provider (Entra ID, Google, Okta, Keycloak, …): PKCE, group → role mapping, account linking, automatic accounts |
-| Multi-factor authentication | ✅ | As in APEX: through the identity provider (OpenID Connect, SAML). Beyond APEX (sprints 126–128): the builder itself has two-factor sign-in with passkeys (WebAuthn, also on their own without a password), authenticator apps (TOTP) and recovery codes, trusted browsers, an instance and per-workspace policy with a grace period and lockout recovery ([chapter 3](guide/03-builder.md#two-factor-sign-in)). Sprint 130: application users too, per application (off, optional, required, required for roles) with authenticator apps and recovery codes, added while signing in or on My account, reset from Users; sprint 131: passkeys, e-mail codes as a fallback, step-up per authorization scheme and REST API tokens only after a second step ([chapter 8](guide/08-security.md#two-factor-sign-in)) |
+| Multi-factor authentication | ✅ | As in APEX: through the identity provider (OpenID Connect, SAML). Beyond APEX (sprints 126–128): the builder itself has two-factor sign-in with passkeys (WebAuthn, also on their own without a password), authenticator apps (TOTP) and recovery codes, trusted browsers, an instance and per-workspace policy with a grace period and lockout recovery ([chapter 3](guide/03-builder.md#two-factor-sign-in)). Sprint 130: application users too, per application (off, optional, required, required for roles) with authenticator apps and recovery codes, added while signing in or on My account, reset from Users; sprint 131: passkeys, e-mail codes as a fallback, step-up per authorization scheme and REST API tokens only after a second step ([chapter 8](guide/08-security.md#two-factor-sign-in)). Sprint 132: pgkiln checks that the identity provider did multi-factor sign-in (`amr` / `acr`, SAML `AuthnContextClassRef`), requests it, steps up through the provider, or asks its own second step after it ([chapter 8](guide/08-security.md#multi-factor-sign-in-at-the-identity-provider)). Sprint 133: lockout checks (instance key and its backup, clock, passkey domain, break-glass administrators) and `pgkiln admin rotate-key` ([chapter 3](guide/03-builder.md#lockout-checks)) |
 | Change own password | ✅ | A built-in *My account* page (APEX offers the API `CHANGE_CURRENT_USER_PW`) |
 | Password expiry, change on first use, admin reset, complexity | ✅ | Lifetime in days, expire/unexpire, admin reset, length and letters+digits rules, unlock |
 | Lockout after failed sign-ins | ✅ | Per user and per IP, time-based (APEX: until an administrator unlocks) |
@@ -305,6 +305,15 @@ Small but real differences, for teams comparing the two:
   before sensitive pages (an authorization scheme's *Second step within*) and REST API tokens only after a second step
   ([chapter 8](guide/08-security.md#two-factor-sign-in)).
   APEX's application authentication schemes have no second factor.
+- (sprint 132) **Proof that the identity provider did multi-factor sign-in**: a provider can be required to say so in
+  the ID token's `amr` / `acr` or the SAML `AuthnContextClassRef`, step-up goes back to it for a fresh multi-factor
+  sign-in, and pgkiln's own second step can follow a provider that cannot enforce MFA
+  ([chapter 8](guide/08-security.md#multi-factor-sign-in-at-the-identity-provider)). APEX trusts the provider's policy.
+- (sprint 133) **Lockout checks**: Instance settings and `pgkiln admin check` warn before anyone is locked out: secrets
+  the instance key can't decrypt, a key without a confirmed backup, clock drift that breaks authenticator codes,
+  passkeys of another domain (also before a move, with `--url`) and single sign-on without a break-glass
+  administrator; `pgkiln admin rotate-key` changes the instance key in one transaction
+  ([chapter 3](guide/03-builder.md#lockout-checks)).
 - One RLS policy set protects both the web UI and the REST API.
 - An import can be checked before it commits (`pgkiln import --check`): SQL that names a missing
   table or column refuses the deployment instead of failing at run time.

package/docs/guide/01-installation.md

@@ -185,7 +185,8 @@ which is read at startup; real environment variables take precedence.
 | `OPENAI_API_KEY` | *(none)* | Default API key of AI services with the provider OpenAI that have no key of their own |
 | `GEMINI_API_KEY` | *(none)* | (sprint 111) Default API key of AI services with the provider Gemini that have no key of their own |
 | `OPENAI_COMPATIBLE_API_KEY` | *(none)* | (sprint 111) Default API key of OpenAI-compatible AI services (Ollama, vLLM, Azure OpenAI) that have no key of their own; without either, no key is sent (`none`) |
-| `PGKILN_SECRET_KEY` | *(none)* | Encrypts the secrets of web credentials and the API keys of AI services; at least 32 characters (e.g. `openssl rand -base64 32`). Keep it outside the database; changing it means entering the secrets again ([chapter 19](19-rest-data-sources.md)) |
+| `PGKILN_SECRET_KEY` | *(none)* | Encrypts the secrets of web credentials and the API keys of AI services; at least 32 characters (e.g. `openssl rand -base64 32`). Keep it outside the database; change it with `pgkiln admin rotate-key` ([chapter 3](03-builder.md#lockout-checks)), otherwise the secrets must be entered again |
+| `PGKILN_OLD_SECRET_KEY` | *(none)* | (0.67) Only for `pgkiln admin rotate-key`: the key the secrets are stored with now |
 | `PGKILN_REST_ALLOWED_HOSTS` | *(none: no outgoing calls)* | Hosts REST data sources and `invoke_api` may call: `api.example.com`, `*.example.com`, `host:8443`, `*` (any public host) ([chapter 19](19-rest-data-sources.md#server-configuration-and-the-allow-list)); a workspace's [network access list](03-builder.md#network-access) can narrow it, and the SMTP server of a workspace's own mail service must be on it |
 | `PGKILN_REST_PRIVATE_HOSTS` | *(none)* | Hosts that may resolve to private, loopback or link-local addresses (also allows them) |
 | `PGKILN_PUSH_HOSTS` | the browsers' push services | The hosts push notifications may be posted to: `fcm.googleapis.com,updates.push.services.mozilla.com,web.push.apple.com,*.notify.windows.com` when unset ([chapter 17](17-mobile.md#push-notifications)) |
@@ -272,7 +273,9 @@ fixed version in `PGKILN_IMAGE`, change it first); `up -d` replaces the containe
 container migrates the database before it starts serving. A `compose.yaml` from pgkiln 0.51.0 or older has
 `pull_policy: missing` under `pgkiln`, which makes `docker compose pull` skip an image that is already present:
 delete that line (or take the current `deploy/compose.yaml`) before the first upgrade this way. Back up first (`docker compose exec db pg_dump -U pgkiln pgkiln > backup.sql`).
-Keep `PGKILN_SECRET_KEY`: without it, stored secrets (web credentials, AI keys, push keys) can't be decrypted.
+Keep `PGKILN_SECRET_KEY`: without it, stored secrets (web credentials, AI keys, push keys, authenticator apps) can't
+be decrypted. Keep a copy outside the server and confirm it on Instance settings; to change it, use
+`pgkiln admin rotate-key` ([chapter 3](03-builder.md#lockout-checks)).
 
 ## Upgrading
 

package/docs/guide/03-builder.md

@@ -138,7 +138,11 @@ started it (in the same browser). The region lists linked identities, with **Unl
 developers linked to it; administrators unlink any of them.
 
 Signing in through a provider skips pgkiln's own second step and the enrolment on Security: the provider decides on
-the second factor. A directory checks a password, so pgkiln's second step follows as with the pgkiln password.
+the second factor. (0.66) The provider's *Require multi-factor sign-in at this provider* makes pgkiln check that it
+did (the ID token's `amr` / `acr`, SAML's `AuthnContextClassRef`) and refuse the sign-in otherwise; *Ask pgkiln's own
+second step after this provider* makes a developer with a second factor give it after the provider too
+([chapter 8](08-security.md#multi-factor-sign-in-at-the-identity-provider)). A directory checks a password, so
+pgkiln's second step follows as with the pgkiln password.
 
 **Requiring it per workspace.** A workspace's page (*Preferences* → *Single sign-on*) has *This workspace's
 developers must sign in through an identity provider* (or a directory). Its developers' pgkiln password and a passkey
@@ -166,13 +170,46 @@ Sign-ins are in the activity log as `login` with *builder sso:company* or *build
 | No administrator can sign in | On the server: `pgkiln admin reset-2fa <developer> --reason "…"` ([chapter 18](18-cli.md)), then sign in with the password |
 | The policy locks everyone out | On the server: `pgkiln admin set-2fa-policy off` (also clears the workspaces' own rules) |
 | The identity provider is down and a workspace requires single sign-on | A break-glass administrator signs in with the password and turns the workspace's rule off; without one, on the server: `pgkiln admin builder-sign-in password` |
-| Codes are always wrong | Check the time on the phone and on the server (codes allow 30 seconds either way) |
-| The instance key was lost or changed | The apps' secrets can't be read: reset the developers (`pgkiln admin reset-2fa`); recovery codes still work |
+| Codes are always wrong | Check the time on the phone and on the server (codes allow 30 seconds either way); *Lockout checks* compares the server's clock |
+| The instance key was changed | Set the old key again and rotate properly: `pgkiln admin rotate-key` ([below](#lockout-checks)) |
+| The instance key was lost | The apps' secrets can't be read: reset the developers (`pgkiln admin reset-2fa`); passkeys and recovery codes still work |
 
 The command line needs the owner's database connection (`DATABASE_URL`), so only someone with access to the server
 can use it. It writes to the activity log and mails the administrators too. With Docker:
 `docker compose exec pgkiln node bin/pgkiln.js admin reset-2fa admin`.
 
+### Lockout checks
+
+(0.67) **Instance settings** starts with *Lockout checks*: what could keep developers or application users out later,
+found before it happens. The Workspace home tells administrators how many need attention.
+
+| Check | Needs attention when |
+|---|---|
+| Instance key | Secrets are stored but `PGKILN_SECRET_KEY` is not set, or some can't be decrypted with it (the key changed without a rotation) |
+| Instance key backed up | No administrator confirmed a copy of the current key (*I have a copy of this key*, or `pgkiln admin key-backed-up`). The confirmation is kept per key fingerprint, so a new key asks again |
+| Clock | The server's clock is 10 seconds or more off the database's, or GitHub's when the [release check](#workspace-home) is on; from 30 seconds authenticator codes fail |
+| Passkey domain | Passkeys were made for another domain than `PUBLIC_URL` (or `PGKILN_RP_ID`) gives, with the number of people who have no other factor |
+| Break-glass administrators | A workspace requires single sign-on and there is no break-glass administrator, or one without a second factor while two-factor sign-in is required |
+
+The server writes the same problems to its log when it starts, and `pgkiln admin check` prints them on the server
+(exit code 1 when one needs attention). **Before moving to another address**, run `pgkiln admin check --url
+https://new.example.com`: it lists the passkeys that won't work there and who has no other factor, so they can add an
+authenticator app or keep their recovery codes at hand first.
+
+**Rotating the instance key.** Authenticator apps of developers and app users, web credentials, mail and AI keys and
+the push key are encrypted with `PGKILN_SECRET_KEY`; passkeys and recovery codes are not. To change the key, stop the
+servers (or accept that sign-ins with an authenticator app fail for the minute in between), then on the server:
+
+```bash
+PGKILN_OLD_SECRET_KEY='the current key' PGKILN_SECRET_KEY='the new key' pgkiln admin rotate-key --dry-run
+PGKILN_OLD_SECRET_KEY='the current key' PGKILN_SECRET_KEY='the new key' pgkiln admin rotate-key
+```
+
+It re-encrypts every stored secret in one transaction: a secret that neither key decrypts stops it and nothing
+changes; a secret already under the new key is left alone, so running it twice is harmless. Start the servers with the
+new key (an isolated workspace's database logins get their new passwords on first use), keep a copy of it and confirm
+that on Instance settings. The rotation is in the activity log (`secret_key`) and mailed to the administrators.
+
 ## Workspaces
 
 A workspace (APEX: a workspace) groups applications and the developers who build them, for example per team or

package/docs/guide/08-security.md

@@ -244,6 +244,40 @@ psql "$DATABASE_URL" -f examples/keycloak-saml.sql    # reads Keycloak's signing
 
 The HR login page then offers *Sign in with Keycloak (SAML)*, with the same Keycloak users.
 
+### Multi-factor sign-in at the identity provider
+
+With single sign-on the provider asks for the second factor, in its own sign-on policy (Entra ID Conditional Access,
+Okta and Keycloak authentication flows, OCI IAM sign-on policies). APEX trusts that policy blindly; pgkiln (0.66) can
+check that the provider really did it. On the provider (**Users → Identity providers**), under *Multi-factor sign-in*:
+
+| Field | Meaning |
+|---|---|
+| Require multi-factor sign-in at this provider | Refuse every sign-in through this provider, to applications and to the builder, that the provider does not mark as multi-factor. The user sees *The identity provider did not confirm a second factor*; the Activity monitor logs it as a failed sign-in |
+| Ask the provider for | Sent with every sign-in: OpenID Connect `acr_values`, or SAML `AuthnContextClassRef` values (a `RequestedAuthnContext`, comparison *exact*), separated by spaces. Empty: nothing is asked for |
+| Values that mean multi-factor | The values that count, separated by spaces; any one is enough. OpenID Connect: an entry of the ID token's `amr` claim (RFC 8176) or its `acr`. SAML: the assertion's `AuthnContextClassRef` |
+| Ask pgkiln's own second step after this provider | For providers that cannot require MFA themselves: see below |
+
+The default values are `mfa` (Entra ID, Okta and Auth0 put it in `amr` after a second factor), Entra ID's SAML
+`http://schemas.microsoft.com/claims/multipleauthn`, and SAML's `MobileTwoFactorContract` and
+`MobileTwoFactorUnregistered`. For Keycloak, name the level of your step-up flow (for example request and accept
+`gold`, or `2` with the default level-of-authentication mapping); for a SAML IdP, the class it sends after a second
+factor. Without *Require*, a provider that does say `mfa` still counts: the session then has a recent second step for
+[step-up](#asking-again-before-a-sensitive-page-step-up), and the Activity monitor shows `sso:<provider> (mfa)`.
+
+**Step-up through the provider.** A user who signed in through a provider and opens a page behind an authorization
+scheme with *Second step within (minutes)* goes back to that provider, which is asked to sign them in again
+(OpenID Connect `prompt=login` and `max_age=0`; SAML `ForceAuthn`) with the requested context. The answer must carry
+one of the multi-factor values, a sign-in time (`auth_time`, or the SAML `AuthnInstant`) of the last ten minutes,
+and the identity already linked to the signed-in account; nothing is created or linked on the way. The page then
+opens.
+
+**pgkiln's own second step after the provider.** With *Ask pgkiln's own second step after this provider* on, a sign-in
+through the provider is followed by the application's [two-factor rule](#two-factor-sign-in) exactly as after a
+password (users add an app or a passkey on *My account*, or while signing in when the application requires one), and
+step-up asks for that factor instead of going back to the provider. For the builder, a developer with a second factor
+gives it after the provider; one without is treated like a password sign-in, so a two-factor rule of the instance or
+workspace makes them add one.
+
 ### LDAP and Active Directory
 
 Applications can check passwords against **LDAP directories** (OpenLDAP, Active Directory,
@@ -426,7 +460,8 @@ sign-on policy asks for one, or a hand-written TOTP check in a custom authentica
 How it works:
 
 - The second step follows the user directory's **password** and **LDAP** directories. An identity provider
-  ([OpenID Connect](#single-sign-on-openid-connect), [SAML](#single-sign-on-saml-20)) asks for its own second factor;
+  ([OpenID Connect](#single-sign-on-openid-connect), [SAML](#single-sign-on-saml-20)) asks for its own second factor,
+  which pgkiln can [check](#multi-factor-sign-in-at-the-identity-provider), or leaves it to pgkiln's second step;
   database accounts, custom authentication and HTTP header authentication are not covered.
 - The code comes from any authenticator app (TOTP, RFC 6238: Google Authenticator, Microsoft Authenticator,
   1Password …), each code once, one 30-second step either side for clock drift. A **recovery code** (ten per account,
@@ -472,7 +507,9 @@ An authorization scheme's **Second step within (minutes)** makes it pass only wh
 the scheme otherwise to *Confirm it's you* (the second-step page) and back to the page afterwards; regions, buttons and
 processes behind it stay hidden or skipped until then. A user without a factor is told to add one on *My account*.
 Typical: `SALARY_EDIT` (role `hr_manager`, second step within 15 minutes) on the page that changes salaries. A
-*Keep me signed in*, shared or single sign-on session has no recent second step of pgkiln's own, so it is asked too.
+*Keep me signed in* or shared session has no recent second step of pgkiln's own, so it is asked too; a single sign-on
+session goes back to its [identity provider](#multi-factor-sign-in-at-the-identity-provider) for a new multi-factor
+sign-in (or to pgkiln's own second step, when the provider leaves it to pgkiln).
 A form posted after the time ran out is not processed: the user confirms, comes back to the page and submits again.
 
 #### REST API tokens
@@ -493,7 +530,8 @@ application users, so nothing to cover there.
 - **Stale sessions**: 60 minutes idle or 8 hours total (configurable).
 - **Stolen passwords**: [two-factor sign-in](#two-factor-sign-in) asks for a code from an authenticator app or a
   passkey, for every user or for some roles, and again before sensitive pages ([step-up](#asking-again-before-a-sensitive-page-step-up)); with an identity provider ([OpenID Connect](#single-sign-on-openid-connect),
-  [SAML](#single-sign-on-saml-20)) the provider asks for its own. Developers have
+  [SAML](#single-sign-on-saml-20)) the provider asks for its own, and pgkiln
+  [checks that it did](#multi-factor-sign-in-at-the-identity-provider). Developers have
   [two-factor sign-in](03-builder.md#two-factor-sign-in) for the builder too.
 
 All sign-ins, failures and lockouts appear in the **Activity** monitor.

package/docs/guide/12-development.md

@@ -22,6 +22,10 @@ src/
   env.ts                   .env loader (imported first)
   migrate.ts               applies db/migrations and examples (scripts/migrate.ts, pgkiln migrate); logs each run that applies
   instance.ts              instance settings (meta.setting over environment variables, cached 30 s) and the configuration overview
+  instance-checks.ts       (sprint 133, SEC-6) lockout checks: instance key (unreadable secrets, backup confirmed per fingerprint in
+                           meta.setting secret_key_backup), clock against the database and GitHub's Date header, passkeys of another
+                           RP ID, break-glass administrators; rotateKey() re-encrypts every *_enc column in one transaction;
+                           used by Instance settings, the Workspace home (cached count), server start-up and `pgkiln admin check`
   release-check.ts         (sprint 109) "pgkiln X is available": meta.setting 'release_check' over PGKILN_RELEASE_CHECK (off by default);
                            GitHub's releases/latest (PGKILN_RELEASE_URL in tests), 5 s timeout, 1 MB, cached a day per process,
                            never under node --test without PGKILN_RELEASE_URL; parseRelease keeps a semver and an https link only
@@ -143,7 +147,8 @@ src/
                            nextRuns in a time zone, describeSchedule in words, the builder's presets and fields
   pgcron.ts                (sprint 101, DA-12) pg_cron for SQL Workshop → Scheduling: cronState (installed, loaded, cron.database_name,
                            access), jobs and runs, jobSql/activeSql/unscheduleSql/purgeSql (reviewed, then applySql), runNow
-  secrets.ts               secrets at rest (web credentials): AES-256-GCM with PGKILN_SECRET_KEY
+  secrets.ts               secrets at rest (web credentials): AES-256-GCM with PGKILN_SECRET_KEY (or a key given, for rotate-key);
+                           keyFingerprint()
   websources.ts            web credentials (OAuth2 client credentials/password/refresh token grants, token cache, stored refresh
                            tokens) and REST data sources: requests, JSON paths, typed rows, response cache, write-back operations
                            (callOperation); invoke(): the invoke API call shared by the invoke_api process and workflow step
@@ -420,7 +425,8 @@ src/
                            write-back operations, synchronisation settings, Synchronise now and run history
     templates.ts           template components: preview, plug-in export/import, region settings, report column templates
     code-editor.ts         code fields (data-code marks), /builder/code/completions (scoped to the app's role), /builder/code/check
-    instance.ts            Workspace utilities → Instance settings (src/instance.ts: session and sign-in settings, configuration overview)
+    instance.ts            Workspace utilities → Instance settings (src/instance.ts: session and sign-in settings, configuration overview;
+                           Lockout checks from src/instance-checks.ts and POST /instance/key-backup)
     gallery.ts             the App Gallery (sprint 61, 120): examples/gallery/gallery.json, sample apps (administrators: migrate --example,
                            or one SQL file of examples/ or examples/gallery/samples/ in one transaction), starter and utility apps
                            (blueprints of starters/ and utilities/ → openBlueprint's review), custom apps (the workspace's boilerplates);

package/docs/guide/18-cli.md

@@ -55,6 +55,9 @@ any (see [what is not exported](03-builder.md#export-format)).
 | `pgkiln admin reset-2fa <developer> [--reason <text>]` | (0.60) Removes a developer's authenticator apps and recovery codes and ends their builder sessions: [locked out?](03-builder.md#locked-out) |
 | `pgkiln admin set-2fa-policy off\|admins\|all [--grace <days>]` | (0.60) Sets the builder's [two-factor policy](03-builder.md#two-factor-sign-in); `off` always works (and, 0.62, clears every workspace's own rule), the others need two administrators with an app |
 | `pgkiln admin builder-sign-in password` | (0.63) Turns off every workspace's [single sign-on rule](03-builder.md#single-sign-on-for-developers), so developers may sign in with the pgkiln password again; logged and mailed to the administrators |
+| `pgkiln admin rotate-key [--dry-run]` | (0.67) Re-encrypts every stored secret from `PGKILN_OLD_SECRET_KEY` to `PGKILN_SECRET_KEY` in one transaction ([rotating the instance key](03-builder.md#lockout-checks)); logged and mailed to the administrators |
+| `pgkiln admin key-backed-up` | (0.67) Records that a copy of the current `PGKILN_SECRET_KEY` is kept outside the server |
+| `pgkiln admin check [--url <address>]` | (0.67) Prints the [lockout checks](03-builder.md#lockout-checks); `--url` checks passkeys against a new public address. Exit code 1 when one needs attention |
 
 `users` reads the password from standard input (the first line, e.g. from a secret store:
 `printf '%s\n' "$PW" | pgkiln users add ops --developer`) or asks for it twice on a terminal. It is

package/docs/guide/19-rest-data-sources.md

@@ -63,8 +63,8 @@ sources (including write-back, synchronisation and the response cache), `meta.we
 API, token endpoints, object storage and REST source catalogs. Refusals are logged in the
 application's debug log and listed under *Refused calls*.
 
-**Changing `PGKILN_SECRET_KEY`** makes the stored secrets unreadable: pgkiln then reports that
-the secret must be entered again. Keep the key with your other server secrets, outside the
+**Changing `PGKILN_SECRET_KEY`** without `pgkiln admin rotate-key` ([chapter 3](03-builder.md#lockout-checks))
+makes the stored secrets unreadable: pgkiln then reports that the secret must be entered again. Keep the key with your other server secrets, outside the
 database: a database dump alone does not reveal the secrets.
 
 ## Web credentials

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pgkiln",
-  "version": "0.65.0",
+  "version": "0.67.0",
   "description": "Open source low-code, SQL-driven application builder for PostgreSQL, inspired by Oracle APEX",
   "keywords": [
     "postgresql",

package/public/builder.css

@@ -1576,3 +1576,9 @@ pre.wrap-pre { white-space: pre-wrap; overflow-wrap: anywhere; }
 .mfa-steps { padding-left: 1.25rem; }
 .mfa-codes { columns: 2; column-gap: 2rem; padding-left: 1.5rem; font-size: 1.05em; }
 @media (max-width: 480px) { .mfa-codes { columns: 1; } }
+
+/* Settings → Sign-in: a checkbox under a grid of fields gets room, and long help stays readable */
+.settings-panel[data-tab="signin"] .form-grid + .field { margin-top: 0.75rem; }
+.settings-panel[data-tab="signin"] .field > .help,
+.settings-panel[data-tab="signin"] p.small { max-width: 75ch; }
+.settings-panel[data-tab="signin"] h3:not(:first-child) { margin-top: 1.5rem; }

package/src/builder/i18n/de.ts

@@ -171,6 +171,8 @@ export const de: BuilderMessages = {
   'wh.how_upgrade': 'So aktualisieren Sie',
   'wh.upgrade_steps': 'Zum Aktualisieren: Sichern Sie die Datenbank, installieren Sie die neue Version ({npm} oder das Docker-Image {docker}), führen Sie {migrate} aus und starten Sie den Server neu.',
   'wh.check_off': 'Die Prüfung auf neue Versionen ist deaktiviert.',
+  'wh.lockout': 'Prüfungen gegen Aussperren, die Aufmerksamkeit brauchen: {count}.',
+  'wh.lockout_open': 'Instanzeinstellungen',
   'wh.check_failed': 'Die letzte Prüfung ist fehlgeschlagen ({error}).',
   'wh.check_failed_older': 'Die letzte Prüfung ist fehlgeschlagen ({error}); das obige Ergebnis ist älter.',
   'wh.checked': 'Geprüft {ago}.',
@@ -1295,6 +1297,9 @@ export const de: BuilderMessages = {
   'st.custom_post_help': 'Optionales PL/pgSQL nach einer erfolgreichen Prüfung, mit p_username (und meta.app_user()), z. B. um die letzte Anmeldung zu speichern. Eine Exception lehnt die Anmeldung ab. Anwendungsprozesse „after login“ laufen danach wie gewohnt.',
   'st.signin': 'Anmeldung',
   'st.methods': 'Anmeldemethoden',
+  'st.signin_page': 'Anmeldeseite',
+  'st.staying': 'Angemeldet bleiben',
+  'st.two_factor': 'Zwei-Faktor-Anmeldung',
   'st.local': 'Benutzername und Passwort',
   'st.ldap': 'Passwörter aus LDAP: {name}',
   'st.disabled': '(deaktiviert)',
@@ -1509,6 +1514,16 @@ export const de: BuilderMessages = {
   'idp.disabled_s': 'deaktiviert',
   'idp.auto_s': 'automatisch anlegen',
   'idp.links_s': 'verknüpft vorhandene Konten',
+  'idp.mfa_title': 'Mehrstufige Anmeldung',
+  'idp.mfa_required': 'Mehrstufige Anmeldung bei diesem Anbieter verlangen',
+  'idp.mfa_required_help': 'Anmeldungen (bei Anwendungen und im Builder) ablehnen, die der Anbieter nicht als mehrstufig kennzeichnet: bei OpenID Connect über den amr- oder acr-Claim des ID-Tokens, bei SAML über die AuthnContextClassRef.',
+  'idp.mfa_request': 'Beim Anbieter anfordern',
+  'idp.mfa_request_help': 'OpenID-Connect-acr_values oder SAML-AuthnContextClassRef-Werte, durch Leerzeichen getrennt. Leer: nichts anfordern.',
+  'idp.mfa_values': 'Werte, die mehrstufig bedeuten',
+  'idp.mfa_values_help': 'amr-, acr- oder AuthnContextClassRef-Werte, durch Leerzeichen getrennt; einer davon genügt. Entra ID und Okta setzen „mfa“ in amr.',
+  'idp.local_step': 'Nach diesem Anbieter den eigenen zweiten Schritt von pgkiln verlangen',
+  'idp.local_step_help': 'Für Anbieter, die keine mehrstufige Anmeldung erzwingen können: Die Zwei-Schritt-Regel der Anwendung gilt wie nach einem Passwort, und Entwickler mit einem zweiten Faktor geben ihn ebenfalls an. Eine erneute Bestätigung fragt dann nach dem Faktor in pgkiln, statt sich erneut beim Anbieter anzumelden.',
+  'idp.mfa_s': 'verlangt MFA',
   'idp.none': 'Noch keine Identitätsanbieter.',
   'idp.settings': 'Einstellungen',
   'idp.delete_confirm': '{name} löschen? Verknüpfte Identitäten werden entfernt; die Konten bleiben.',

package/src/builder/i18n/en.ts

@@ -174,6 +174,8 @@ export const en = {
   'wh.how_upgrade': 'How to upgrade',
   'wh.upgrade_steps': 'To upgrade: back up the database, install the new version ({npm}, or the Docker image {docker}), run {migrate} and restart the server.',
   'wh.check_off': 'The check for new versions is off.',
+  'wh.lockout': 'Lockout checks that need attention: {count}.',
+  'wh.lockout_open': 'Instance settings',
   'wh.check_failed': 'The last check failed ({error}).',
   'wh.check_failed_older': 'The last check failed ({error}); the result above is older.',
   'wh.checked': 'Checked {ago}.',
@@ -1298,6 +1300,9 @@ export const en = {
   'st.custom_post_help': 'Optional PL/pgSQL run after a successful check, with p_username (and meta.app_user()), e.g. to record the last sign-in. Raising an exception refuses the sign-in. Application processes "after login" run afterwards as usual.',
   'st.signin': 'Sign-in',
   'st.methods': 'Sign-in methods',
+  'st.signin_page': 'Sign-in page',
+  'st.staying': 'Staying signed in',
+  'st.two_factor': 'Two-factor sign-in',
   'st.local': 'Username and password',
   'st.ldap': 'Passwords from LDAP: {name}',
   'st.disabled': '(disabled)',
@@ -1512,6 +1517,16 @@ export const en = {
   'idp.disabled_s': 'disabled',
   'idp.auto_s': 'auto-create',
   'idp.links_s': 'links existing accounts',
+  'idp.mfa_title': 'Multi-factor sign-in',
+  'idp.mfa_required': 'Require multi-factor sign-in at this provider',
+  'idp.mfa_required_help': "Refuse sign-ins (to applications and to the builder) that the provider does not mark as multi-factor: OpenID Connect through the ID token's amr or acr claim, SAML through the AuthnContextClassRef.",
+  'idp.mfa_request': 'Ask the provider for',
+  'idp.mfa_request_help': 'OpenID Connect acr_values or SAML AuthnContextClassRef values, separated by spaces. Empty: ask for nothing.',
+  'idp.mfa_values': 'Values that mean multi-factor',
+  'idp.mfa_values_help': 'amr, acr or AuthnContextClassRef values, separated by spaces; any one of them is enough. Entra ID and Okta put "mfa" in amr.',
+  'idp.local_step': "Ask pgkiln's own second step after this provider",
+  'idp.local_step_help': "For providers that cannot require multi-factor sign-in: the application's two-step rule applies as after a password, and developers with a second factor give it too. Step-up then asks for pgkiln's factor instead of signing in at the provider again.",
+  'idp.mfa_s': 'requires MFA',
   'idp.none': 'No identity providers yet.',
   'idp.settings': 'Settings',
   'idp.delete_confirm': 'Delete {name}? Linked identities are removed; accounts stay.',

package/src/builder/i18n/es.ts

@@ -171,6 +171,8 @@ export const es: BuilderMessages = {
   'wh.how_upgrade': 'Cómo actualizar',
   'wh.upgrade_steps': 'Para actualizar: haga una copia de seguridad de la base de datos, instale la nueva versión ({npm}, o la imagen Docker {docker}), ejecute {migrate} y reinicie el servidor.',
   'wh.check_off': 'La comprobación de nuevas versiones está desactivada.',
+  'wh.lockout': 'Comprobaciones de bloqueo que requieren atención: {count}.',
+  'wh.lockout_open': 'Ajustes de la instancia',
   'wh.check_failed': 'La última comprobación ha fallado ({error}).',
   'wh.check_failed_older': 'La última comprobación ha fallado ({error}); el resultado anterior es más antiguo.',
   'wh.checked': 'Comprobado {ago}.',
@@ -1295,6 +1297,9 @@ export const es: BuilderMessages = {
   'st.custom_post_help': 'PL/pgSQL opcional que se ejecuta tras una comprobación correcta, con p_username (y meta.app_user()), p. ej. para registrar el último inicio de sesión. Lanzar una excepción rechaza el inicio de sesión. Los procesos de aplicación «after login» se ejecutan después como siempre.',
   'st.signin': 'Inicio de sesión',
   'st.methods': 'Métodos de inicio de sesión',
+  'st.signin_page': 'Página de inicio de sesión',
+  'st.staying': 'Mantener la sesión',
+  'st.two_factor': 'Inicio de sesión en dos pasos',
   'st.local': 'Nombre de usuario y contraseña',
   'st.ldap': 'Contraseñas de LDAP: {name}',
   'st.disabled': '(desactivado)',
@@ -1509,6 +1514,16 @@ export const es: BuilderMessages = {
   'idp.disabled_s': 'desactivado',
   'idp.auto_s': 'creación automática',
   'idp.links_s': 'vincula cuentas existentes',
+  'idp.mfa_title': 'Inicio de sesión multifactor',
+  'idp.mfa_required': 'Exigir inicio de sesión multifactor en este proveedor',
+  'idp.mfa_required_help': 'Rechaza los inicios de sesión (en aplicaciones y en el builder) que el proveedor no marca como multifactor: en OpenID Connect por el claim amr o acr del token de ID, en SAML por el AuthnContextClassRef.',
+  'idp.mfa_request': 'Solicitar al proveedor',
+  'idp.mfa_request_help': 'Valores acr_values de OpenID Connect o AuthnContextClassRef de SAML, separados por espacios. Vacío: no solicitar nada.',
+  'idp.mfa_values': 'Valores que significan multifactor',
+  'idp.mfa_values_help': 'Valores amr, acr o AuthnContextClassRef, separados por espacios; basta con uno. Entra ID y Okta ponen «mfa» en amr.',
+  'idp.local_step': 'Pedir el segundo paso propio de pgkiln después de este proveedor',
+  'idp.local_step_help': 'Para proveedores que no pueden exigir multifactor: la regla de dos pasos de la aplicación se aplica como después de una contraseña, y los desarrolladores con un segundo factor también lo indican. La nueva confirmación pide entonces el factor de pgkiln en lugar de volver a iniciar sesión en el proveedor.',
+  'idp.mfa_s': 'exige MFA',
   'idp.none': 'Todavía no hay proveedores de identidad.',
   'idp.settings': 'Ajustes',
   'idp.delete_confirm': '¿Eliminar {name}? Se quitan las identidades vinculadas; las cuentas se mantienen.',

package/src/builder/i18n/fr.ts

@@ -171,6 +171,8 @@ export const fr: BuilderMessages = {
   'wh.how_upgrade': 'Comment mettre à niveau',
   'wh.upgrade_steps': "Pour mettre à niveau : sauvegardez la base de données, installez la nouvelle version ({npm}, ou l'image Docker {docker}), exécutez {migrate} et redémarrez le serveur.",
   'wh.check_off': 'La recherche de nouvelles versions est désactivée.',
+  'wh.lockout': 'Contrôles contre le verrouillage à examiner : {count}.',
+  'wh.lockout_open': 'Paramètres de l’instance',
   'wh.check_failed': 'La dernière vérification a échoué ({error}).',
   'wh.check_failed_older': 'La dernière vérification a échoué ({error}) ; le résultat ci-dessus est plus ancien.',
   'wh.checked': 'Vérifié {ago}.',
@@ -1295,6 +1297,9 @@ export const fr: BuilderMessages = {
   'st.custom_post_help': 'PL/pgSQL facultatif exécuté après une vérification réussie, avec p_username (et meta.app_user()), p. ex. pour enregistrer la dernière connexion. Lever une exception refuse la connexion. Les processus d’application « after login » s’exécutent ensuite comme d’habitude.',
   'st.signin': 'Connexion',
   'st.methods': 'Méthodes de connexion',
+  'st.signin_page': 'Page de connexion',
+  'st.staying': 'Rester connecté',
+  'st.two_factor': 'Connexion en deux étapes',
   'st.local': 'Nom d’utilisateur et mot de passe',
   'st.ldap': 'Mots de passe LDAP : {name}',
   'st.disabled': '(désactivé)',
@@ -1509,6 +1514,16 @@ export const fr: BuilderMessages = {
   'idp.disabled_s': 'désactivé',
   'idp.auto_s': 'création automatique',
   'idp.links_s': 'lie les comptes existants',
+  'idp.mfa_title': 'Connexion multifacteur',
+  'idp.mfa_required': 'Exiger une connexion multifacteur chez ce fournisseur',
+  'idp.mfa_required_help': 'Refuser les connexions (aux applications et au builder) que le fournisseur ne marque pas comme multifacteur : en OpenID Connect par le claim amr ou acr du jeton d’identité, en SAML par l’AuthnContextClassRef.',
+  'idp.mfa_request': 'Demander au fournisseur',
+  'idp.mfa_request_help': 'Valeurs acr_values (OpenID Connect) ou AuthnContextClassRef (SAML), séparées par des espaces. Vide : ne rien demander.',
+  'idp.mfa_values': 'Valeurs qui signifient multifacteur',
+  'idp.mfa_values_help': 'Valeurs amr, acr ou AuthnContextClassRef, séparées par des espaces ; une seule suffit. Entra ID et Okta mettent « mfa » dans amr.',
+  'idp.local_step': 'Demander la deuxième étape de pgkiln après ce fournisseur',
+  'idp.local_step_help': 'Pour les fournisseurs qui ne peuvent pas exiger le multifacteur : la règle de connexion en deux étapes de l’application s’applique comme après un mot de passe, et les développeurs ayant un second facteur le donnent aussi. Une nouvelle confirmation demande alors le facteur de pgkiln au lieu de se reconnecter chez le fournisseur.',
+  'idp.mfa_s': 'exige la MFA',
   'idp.none': 'Pas encore de fournisseurs d’identité.',
   'idp.settings': 'Paramètres',
   'idp.delete_confirm': 'Supprimer {name} ? Les identités liées sont retirées ; les comptes restent.',

package/src/builder/i18n/nl.ts

@@ -171,6 +171,8 @@ export const nl: BuilderMessages = {
   'wh.how_upgrade': 'Zo upgrade je',
   'wh.upgrade_steps': 'Upgraden: maak een back-up van de database, installeer de nieuwe versie ({npm}, of de Docker-image {docker}), voer {migrate} uit en herstart de server.',
   'wh.check_off': 'Het controleren op nieuwe versies staat uit.',
+  'wh.lockout': 'Controles tegen buitensluiten die aandacht nodig hebben: {count}.',
+  'wh.lockout_open': 'Instantie-instellingen',
   'wh.check_failed': 'De laatste controle is mislukt ({error}).',
   'wh.check_failed_older': 'De laatste controle is mislukt ({error}); het resultaat hierboven is ouder.',
   'wh.checked': '{ago} gecontroleerd.',
@@ -1295,6 +1297,9 @@ export const nl: BuilderMessages = {
   'st.custom_post_help': 'Optionele PL/pgSQL die draait na een geslaagde controle, met p_username (en meta.app_user()), bijv. om de laatste aanmelding vast te leggen. Een exception weigert de aanmelding. Applicatieprocessen “after login” draaien daarna zoals gewoonlijk.',
   'st.signin': 'Aanmelden',
   'st.methods': 'Aanmeldmethoden',
+  'st.signin_page': 'Aanmeldpagina',
+  'st.staying': 'Aangemeld blijven',
+  'st.two_factor': 'Aanmelden in twee stappen',
   'st.local': 'Gebruikersnaam en wachtwoord',
   'st.ldap': 'Wachtwoorden uit LDAP: {name}',
   'st.disabled': '(uitgeschakeld)',
@@ -1509,6 +1514,16 @@ export const nl: BuilderMessages = {
   'idp.disabled_s': 'uitgeschakeld',
   'idp.auto_s': 'automatisch aanmaken',
   'idp.links_s': 'koppelt bestaande accounts',
+  'idp.mfa_title': 'Meervoudige aanmelding',
+  'idp.mfa_required': 'Meervoudige aanmelding bij deze provider vereisen',
+  'idp.mfa_required_help': 'Aanmeldingen (bij applicaties en in de builder) weigeren die de provider niet als meervoudig aanmerkt: bij OpenID Connect via de amr- of acr-claim van het ID-token, bij SAML via de AuthnContextClassRef.',
+  'idp.mfa_request': 'Vragen aan de provider',
+  'idp.mfa_request_help': 'OpenID Connect-acr_values of SAML-AuthnContextClassRef-waarden, gescheiden door spaties. Leeg: niets vragen.',
+  'idp.mfa_values': 'Waarden die meervoudig betekenen',
+  'idp.mfa_values_help': 'amr-, acr- of AuthnContextClassRef-waarden, gescheiden door spaties; één ervan is genoeg. Entra ID en Okta zetten "mfa" in amr.',
+  'idp.local_step': 'Na deze provider ook de eigen tweede stap van pgkiln vragen',
+  'idp.local_step_help': 'Voor providers die geen meervoudige aanmelding kunnen afdwingen: de tweestapsregel van de applicatie geldt zoals na een wachtwoord, en ontwikkelaars met een tweede factor geven die ook. Opnieuw bevestigen vraagt dan de factor in pgkiln in plaats van opnieuw aanmelden bij de provider.',
+  'idp.mfa_s': 'vereist MFA',
   'idp.none': 'Nog geen identiteitsproviders.',
   'idp.settings': 'Instellingen',
   'idp.delete_confirm': '{name} verwijderen? Gekoppelde identiteiten worden verwijderd; de accounts blijven.',

package/src/builder/i18n/pt.ts

@@ -171,6 +171,8 @@ export const pt: BuilderMessages = {
   'wh.how_upgrade': 'Como atualizar',
   'wh.upgrade_steps': 'Para atualizar: faça backup do banco de dados, instale a nova versão ({npm}, ou a imagem Docker {docker}), execute {migrate} e reinicie o servidor.',
   'wh.check_off': 'A verificação de novas versões está desativada.',
+  'wh.lockout': 'Verificações contra bloqueio que precisam de atenção: {count}.',
+  'wh.lockout_open': 'Configurações da instância',
   'wh.check_failed': 'A última verificação falhou ({error}).',
   'wh.check_failed_older': 'A última verificação falhou ({error}); o resultado acima é mais antigo.',
   'wh.checked': 'Verificado {ago}.',
@@ -1295,6 +1297,9 @@ export const pt: BuilderMessages = {
   'st.custom_post_help': 'PL/pgSQL opcional executado após uma verificação bem-sucedida, com p_username (e meta.app_user()), por exemplo para registrar o último login. Lançar uma exceção recusa o login. Processos de aplicação “after login” são executados depois, como de costume.',
   'st.signin': 'Login',
   'st.methods': 'Métodos de login',
+  'st.signin_page': 'Página de acesso',
+  'st.staying': 'Manter o acesso',
+  'st.two_factor': 'Acesso em duas etapas',
   'st.local': 'Nome de usuário e senha',
   'st.ldap': 'Senhas do LDAP: {name}',
   'st.disabled': '(desativado)',
@@ -1509,6 +1514,16 @@ export const pt: BuilderMessages = {
   'idp.disabled_s': 'desativado',
   'idp.auto_s': 'criação automática',
   'idp.links_s': 'vincula contas existentes',
+  'idp.mfa_title': 'Acesso multifator',
+  'idp.mfa_required': 'Exigir acesso multifator neste provedor',
+  'idp.mfa_required_help': 'Recusar acessos (às aplicações e ao builder) que o provedor não marca como multifator: no OpenID Connect pelo claim amr ou acr do token de ID, no SAML pelo AuthnContextClassRef.',
+  'idp.mfa_request': 'Pedir ao provedor',
+  'idp.mfa_request_help': 'Valores acr_values do OpenID Connect ou AuthnContextClassRef do SAML, separados por espaços. Vazio: não pedir nada.',
+  'idp.mfa_values': 'Valores que significam multifator',
+  'idp.mfa_values_help': 'Valores amr, acr ou AuthnContextClassRef, separados por espaços; basta um deles. Entra ID e Okta colocam "mfa" em amr.',
+  'idp.local_step': 'Pedir a segunda etapa do próprio pgkiln após este provedor',
+  'idp.local_step_help': 'Para provedores que não conseguem exigir multifator: a regra de duas etapas da aplicação vale como após uma senha, e desenvolvedores com um segundo fator também o informam. A nova confirmação pede então o fator do pgkiln em vez de entrar de novo no provedor.',
+  'idp.mfa_s': 'exige MFA',
   'idp.none': 'Ainda não há provedores de identidade.',
   'idp.settings': 'Configurações',
   'idp.delete_confirm': 'Excluir {name}? As identidades vinculadas são removidas; as contas ficam.',