fix billing and 2fa admin

apps/api/src/middleware/requireAdminAuth.test.ts

@@ -13,7 +13,7 @@ vi.mock('../lib/prisma', () => ({
 
 import jwt from 'jsonwebtoken'
 import { prisma } from '../lib/prisma'
-import { requireAdminAuth, requireAdminRole } from './requireAdminAuth'
+import { requireAdminAuth, requireAdminRole, requireFreshAdmin2FA } from './requireAdminAuth'
 
 function responseStub() {
   const res = { status: vi.fn(), json: vi.fn() }
@@ -163,3 +163,35 @@ describe('requireAdminRole middleware', () => {
     expect(res.status).not.toHaveBeenCalled()
   })
 })
+
+describe('requireFreshAdmin2FA middleware', () => {
+  it('allows a 2FA-verified admin session until the session ends', () => {
+    const req = {
+      admin: { id: 'admin_1', totpEnabled: true },
+      adminAuthLast2faAt: Date.now() - 24 * 60 * 60 * 1000,
+    } as Request
+    const res = responseStub()
+    const next = vi.fn() as NextFunction
+
+    requireFreshAdmin2FA(req, res, next)
+
+    expect(next).toHaveBeenCalledTimes(1)
+    expect(res.status).not.toHaveBeenCalled()
+  })
+
+  it('blocks enrolled admins whose session has no 2FA verification proof', () => {
+    const req = { admin: { id: 'admin_1', totpEnabled: true } } as Request
+    const res = responseStub()
+    const next = vi.fn() as NextFunction
+
+    requireFreshAdmin2FA(req, res, next)
+
+    expect(res.status).toHaveBeenCalledWith(403)
+    expect(res.json).toHaveBeenCalledWith({
+      error: 'fresh_2fa_required',
+      message: 'Admin 2FA verification is required for this session',
+      statusCode: 403,
+    })
+    expect(next).not.toHaveBeenCalled()
+  })
+})

apps/api/src/middleware/requireAdminAuth.ts

@@ -20,8 +20,6 @@ const ADMIN_2FA_ENROLLMENT_EXEMPT_PATHS = new Set([
   '/auth/2fa/verify',
 ])
 
-const FRESH_2FA_WINDOW_MS = Number(process.env.ADMIN_FRESH_2FA_WINDOW_MS ?? 10 * 60 * 1000)
-
 function is2faEnrollmentExempt(req: Request) {
   return ADMIN_2FA_ENROLLMENT_EXEMPT_PATHS.has(req.path)
 }
@@ -84,9 +82,8 @@ export function requireFreshAdmin2FA(req: Request, res: Response, next: NextFunc
     return sendForbidden(res, 'admin_2fa_required', 'Admin 2FA enrollment is required for this action')
   }
 
-  const last2faAt = req.adminAuthLast2faAt
-  if (!last2faAt || Date.now() - last2faAt > FRESH_2FA_WINDOW_MS) {
-    return sendForbidden(res, 'fresh_2fa_required', 'Fresh admin 2FA verification is required for this action')
+  if (!req.adminAuthLast2faAt) {
+    return sendForbidden(res, 'fresh_2fa_required', 'Admin 2FA verification is required for this session')
   }
 
   next()