feat(auth): per-org MFA + dispatcher/MCP gate (ADR-0069 D3)#2395
Merged
Conversation
Completes enforced MFA with the two remaining tails. - platform-objects: sys_organization.require_mfa (per-org tightening above the global floor). - plugin-auth: computeAuthGate treats the active org's require_mfa as an effective MFA requirement even when global mfaRequired is off; isAuthGateActive consults a 60s-TTL cached "any org requires MFA" flag (lazy background refresh) so the cheap sync check stays honest without per-request org queries. - runtime: enforceAuthGate runs in the dispatcher after resolveExecutionContext, gating MCP/GraphQL/embedded data paths the same way the REST seam gates the Console — reusing the shared core evaluateAuthGate + allow-list. Default-off / additive; ADR-0049. Verified live (dogfood): with GLOBAL mfa off, an org member whose org has require_mfa=true is gated 403 MFA_REQUIRED while an admin with no org is not (per-org scoping). With global mfa on, POST /api/v1/mcp returns 403 with details.code=MFA_REQUIRED (the dispatcher seam). Unit: plugin-auth 195 + runtime 444 + core 299 + platform-objects 63 + service-settings 129 green; full build incl. strict DTS green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
documentation
Contributor
📓 Docs Drift CheckThis PR changes 3 package(s): 23 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
7 tasks
This was referenced Jul 11, 2026
This was referenced Jul 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ADR-0069 (tracking #2281, follow-up #2375): the two remaining tails that make enforced MFA total.
What
sys_organization.require_mfa— an org can require MFA above the global floor.computeAuthGatenow treats the active org'srequire_mfaas an effective MFA requirement even when globalmfa_requiredis off.isAuthGateActive()stays cheap (synchronous) via a 60s-TTL "any org requires MFA" cache with a lazy background refresh — a brand-new per-org requirement activates the gate on the next request, with no per-request org query when the feature is off.resolveExecutionContext), so MCP / GraphQL / embedded data paths enforcePASSWORD_EXPIRED/MFA_REQUIREDconsistently with the REST seam (feat(auth): password expiry via the session-validation gate (ADR-0069 D1, P1) #2388). Reuses the shared coreevaluateAuthGate+ allow-list. Previously only the REST surface (the Console) was gated.Default-off / additive; ADR-0049 (enforcement ships with the setting).
Verification
computeAuthGate(active-org require_mfa → MFA_REQUIRED with global off; not-requiring org → pass; cache tripsisAuthGateActive).require_mfa=true→ its member's data request is403 MFA_REQUIRED, while an admin with no org is200(correct scoping).POST /api/v1/mcpreturns403 { error: { details: { code: 'MFA_REQUIRED' } } }(the dispatcher seam fires, matching the REST gate).ADR-0069 enforced MFA — now complete across all surfaces
✅ global + per-org enforcement · ✅ REST (Console) gate (#2388) · ✅ dispatcher/MCP gate (this PR) · ✅ Console remediation UI (objectstack-ai/objectui#2037). Remaining on #2375 is P2/P3 only.
🤖 Generated with Claude Code