apply security fix

apps/api/src/middleware/requireAdminAuth.ts

@@ -5,12 +5,12 @@ import { getAuthToken, sendUnauthorized, sendForbidden } from './authHelpers'
 import { verifyActorToken } from '../security/tokens'
 import { getSessionCookieName } from '../security/sessionCookies'
 
-const ROLE_RANK: Record<AdminRole, number> = {
-  SUPER_ADMIN: 5,
-  ADMIN:       4,
-  SUPPORT:     3,
-  FINANCE:     2,
-  VIEWER:      1,
+const ADMIN_ROLE_ALLOWLIST: Record<AdminRole, readonly AdminRole[]> = {
+  SUPER_ADMIN: ['SUPER_ADMIN'],
+  ADMIN:       ['SUPER_ADMIN', 'ADMIN'],
+  SUPPORT:     ['SUPER_ADMIN', 'ADMIN', 'SUPPORT'],
+  FINANCE:     ['SUPER_ADMIN', 'ADMIN', 'FINANCE'],
+  VIEWER:      ['SUPER_ADMIN', 'ADMIN', 'SUPPORT', 'FINANCE', 'VIEWER'],
 }
 
 const ADMIN_2FA_ENROLLMENT_EXEMPT_PATHS = new Set([
@@ -67,11 +67,10 @@ export function requireAdminRole(minimumRole: AdminRole) {
     const admin = req.admin
     if (!admin) return sendUnauthorized(res, 'unauthenticated', 'Admin authentication required')
 
-    const rank     = ROLE_RANK[admin.role]   ?? 0
-    const required = ROLE_RANK[minimumRole]  ?? 99
+    const allowedRoles = ADMIN_ROLE_ALLOWLIST[minimumRole] ?? []
 
-    if (rank < required) {
-      return sendForbidden(res, 'forbidden', `This action requires the ${minimumRole} role or higher`)
+    if (!allowedRoles.includes(admin.role)) {
+      return sendForbidden(res, 'forbidden', `This action requires explicit ${minimumRole} permission`)
     }
 
     next()
@@ -92,3 +91,11 @@ export function requireFreshAdmin2FA(req: Request, res: Response, next: NextFunc
 
   next()
 }
+
+
+export function requireFreshAdmin2FAWhenEnabled(req: Request, res: Response, next: NextFunction) {
+  const admin = req.admin
+  if (!admin) return sendUnauthorized(res, 'unauthenticated', 'Admin authentication required')
+  if (!admin.totpEnabled) return next()
+  return requireFreshAdmin2FA(req, res, next)
+}