enabled policies

This commit is contained in:
2026-01-16 17:31:25 +10:30
parent 71c58ddb60
commit 4ee3b81074
13 changed files with 1582 additions and 219 deletions
+144
View File
@@ -0,0 +1,144 @@
import { useState, useEffect } from 'react';
import { AlertTriangle, Clock, CheckCircle } from 'lucide-react';
import { Alert, AlertDescription, AlertTitle } from '@/components/ui/alert';
import { MfaComplianceSummary, isMfaRequired } from '@/lib/api';
interface ComplianceBannerProps {
compliance: MfaComplianceSummary | null;
}
export function ComplianceBanner({ compliance }: ComplianceBannerProps) {
const [countdown, setCountdown] = useState<string | null>(null);
// Calculate countdown from deadline
useEffect(() => {
if (!compliance?.deadline_at) {
setCountdown(null);
return;
}
const deadline = new Date(compliance.deadline_at);
const now = new Date();
if (deadline <= now) {
setCountdown('Deadline passed');
return;
}
const updateCountdown = () => {
const remaining = deadline.getTime() - Date.now();
if (remaining <= 0) {
setCountdown('Deadline passed');
return;
}
const days = Math.floor(remaining / (1000 * 60 * 60 * 24));
const hours = Math.floor((remaining % (1000 * 60 * 60 * 24)) / (1000 * 60 * 60));
const minutes = Math.floor((remaining % (1000 * 60 * 60)) / (1000 * 60));
if (days > 0) {
setCountdown(`${days} day${days > 1 ? 's' : ''} remaining`);
} else if (hours > 0) {
setCountdown(`${hours} hour${hours > 1 ? 's' : ''} remaining`);
} else {
setCountdown(`${minutes} minute${minutes > 1 ? 's' : ''} remaining`);
}
};
updateCountdown();
const interval = setInterval(updateCountdown, 60000); // Update every minute
return () => clearInterval(interval);
}, [compliance?.deadline_at]);
// Check if MFA is required based on effective_mode (if available)
const mfaRequired = isMfaRequired(compliance);
// Don't show if no compliance data or already compliant
if (!compliance || compliance.overall_status === 'compliant' ||
compliance.overall_status === 'not_applicable') {
return null;
}
// Show banner if:
// 1. MFA is required (effective_mode starts with "require_"), OR
// 2. There are missing methods (fallback for older data without effective_mode)
if (!mfaRequired && compliance.missing_methods.length === 0) {
return null;
}
// Past due - high severity
if (compliance.overall_status === 'past_due' || compliance.overall_status === 'suspended') {
return (
<Alert variant="destructive" className="mb-4">
<AlertTriangle className="h-4 w-4" />
<AlertTitle>Multi-Factor Authentication Required</AlertTitle>
<AlertDescription>
<div className="mt-2 space-y-2">
<p>
Your account requires MFA enrollment to access full features.
Please configure MFA immediately to restore access.
</p>
{compliance.missing_methods.length > 0 && (
<p className="text-sm">
Required methods: {compliance.missing_methods.join(', ')}
</p>
)}
</div>
</AlertDescription>
</Alert>
);
}
// In grace period - warning
if (compliance.overall_status === 'in_grace') {
return (
<Alert className="mb-4 border-warning/50 bg-warning/5">
<Clock className="h-4 w-4 text-warning" />
<AlertTitle className="text-warning">MFA Enrollment Required</AlertTitle>
<AlertDescription>
<div className="mt-2 space-y-2">
<p>
Your organization requires multi-factor authentication. Please configure MFA before the deadline.
</p>
{countdown && (
<p className="text-sm font-medium">
Time remaining: {countdown}
</p>
)}
{compliance.missing_methods.length > 0 && (
<p className="text-sm">
Required methods: {compliance.missing_methods.join(', ')}
</p>
)}
</div>
</AlertDescription>
</Alert>
);
}
// Pending - info
if (compliance.overall_status === 'pending') {
return (
<Alert className="mb-4 border-primary/50 bg-primary/5">
<Clock className="h-4 w-4 text-primary" />
<AlertTitle>MFA Policy Applied</AlertTitle>
<AlertDescription>
<div className="mt-2 space-y-2">
<p>
Your organization has enabled MFA requirements. You have a grace period to configure your authentication methods.
</p>
{compliance.missing_methods.length > 0 && (
<p className="text-sm">
Required methods: {compliance.missing_methods.join(', ')}
</p>
)}
</div>
</AlertDescription>
</Alert>
);
}
return null;
}
@@ -0,0 +1,238 @@
import { useState, useEffect } from 'react';
import { useNavigate } from 'react-router-dom';
import { Shield, Smartphone, Fingerprint, AlertTriangle, CheckCircle, Loader2 } from 'lucide-react';
import { Button } from '@/components/ui/button';
import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@/components/ui/card';
import { useAuth } from '@/contexts/AuthContext';
import { AddPasskeyWizard } from '@/components/security/AddPasskeyWizard';
import { TotpEnrollmentWizard } from '@/components/security/TotpEnrollmentWizard';
import { api } from '@/lib/api';
export default function MfaEnforcementLayout() {
const navigate = useNavigate();
const { user, mfaCompliance, refreshCompliance } = useAuth();
const [showTotpEnrollment, setShowTotpEnrollment] = useState(false);
const [showPasskeyEnrollment, setShowPasskeyEnrollment] = useState(false);
const [isChecking, setIsChecking] = useState(true);
const [isCompliant, setIsCompliant] = useState(false);
// Check compliance status on mount and after enrollment
useEffect(() => {
const checkCompliance = async () => {
setIsChecking(true);
try {
const compliance = await api.policies.getMyCompliance();
if (compliance.overall_status === 'compliant') {
setIsCompliant(true);
} else {
setIsCompliant(false);
}
} catch (error) {
console.error('[MfaEnforcementLayout] Failed to check compliance:', error);
setIsCompliant(false);
} finally {
setIsChecking(false);
}
};
checkCompliance();
}, []);
// Redirect when compliant
useEffect(() => {
if (isCompliant) {
const timer = setTimeout(() => {
navigate('/profile');
}, 2000);
return () => clearTimeout(timer);
}
}, [isCompliant, navigate]);
const handleTotpSuccess = async () => {
setShowTotpEnrollment(false);
await refreshCompliance();
const compliance = await api.policies.getMyCompliance();
setIsCompliant(compliance.overall_status === 'compliant');
};
const handlePasskeySuccess = async () => {
setShowPasskeyEnrollment(false);
await refreshCompliance();
const compliance = await api.policies.getMyCompliance();
setIsCompliant(compliance.overall_status === 'compliant');
};
// Show success state
if (isCompliant) {
return (
<div className="min-h-screen flex items-center justify-center bg-background p-4">
<Card className="w-full max-w-md">
<CardContent className="pt-6">
<div className="flex flex-col items-center text-center">
<div className="w-16 h-16 rounded-full bg-success/10 flex items-center justify-center mb-4">
<CheckCircle className="w-8 h-8 text-success" />
</div>
<h2 className="text-xl font-semibold text-foreground mb-2">
MFA Configured Successfully
</h2>
<p className="text-muted-foreground mb-4">
Your account is now compliant. Redirecting to your profile...
</p>
<Loader2 className="w-5 h-5 animate-spin text-muted-foreground" />
</div>
</CardContent>
</Card>
</div>
);
}
// Determine which MFA methods are required
const missingMethods = mfaCompliance?.missing_methods || [];
const requiresTotp = missingMethods.includes('totp');
const requiresPasskey = missingMethods.includes('webauthn');
return (
<div className="min-h-screen flex flex-col bg-background">
{/* Header - similar to TopBar but without sidebar */}
<header className="h-14 border-b border-border bg-card flex items-center justify-between px-4 flex-shrink-0">
<div className="flex items-center gap-3">
<Shield className="w-5 h-5 text-primary" />
<span className="font-semibold text-foreground">Gatehouse</span>
</div>
<div className="flex items-center gap-2">
<span className="text-sm text-muted-foreground">
{user?.email}
</span>
</div>
</header>
{/* Main content */}
<div className="flex-1 flex items-center justify-center p-4">
<Card className="w-full max-w-lg">
<CardHeader className="text-center">
<div className="mx-auto w-16 h-16 rounded-full bg-warning/10 flex items-center justify-center mb-4">
<AlertTriangle className="w-8 h-8 text-warning" />
</div>
<CardTitle className="text-xl">MFA Enrollment Required</CardTitle>
<CardDescription>
Your account is restricted until you configure multi-factor authentication.
Please set up at least one of the following methods to continue.
</CardDescription>
</CardHeader>
<CardContent className="space-y-4">
{/* Deadline info */}
{mfaCompliance?.deadline_at && (
<div className="p-3 rounded-lg bg-destructive/10 border border-destructive/20 text-center">
<p className="text-sm font-medium text-destructive">
Deadline: {new Date(mfaCompliance.deadline_at).toLocaleDateString()}
</p>
</div>
)}
{/* TOTP Option */}
{requiresTotp && (
<div className="p-4 border rounded-lg space-y-3">
<div className="flex items-start gap-3">
<div className="w-10 h-10 rounded bg-primary/10 flex items-center justify-center flex-shrink-0">
<Smartphone className="w-5 h-5 text-primary" />
</div>
<div className="flex-1">
<h3 className="font-medium text-foreground">Authenticator App</h3>
<p className="text-sm text-muted-foreground">
Set up an authenticator app (Google Authenticator, Authy, etc.)
</p>
</div>
</div>
<Button
onClick={() => setShowTotpEnrollment(true)}
className="w-full"
>
Set up Authenticator
</Button>
</div>
)}
{/* Passkey Option */}
{requiresPasskey && (
<div className="p-4 border rounded-lg space-y-3">
<div className="flex items-start gap-3">
<div className="w-10 h-10 rounded bg-primary/10 flex items-center justify-center flex-shrink-0">
<Fingerprint className="w-5 h-5 text-primary" />
</div>
<div className="flex-1">
<h3 className="font-medium text-foreground">Passkey</h3>
<p className="text-sm text-muted-foreground">
Register a passkey (biometrics, security key, or device passkey)
</p>
</div>
</div>
<Button
onClick={() => setShowPasskeyEnrollment(true)}
className="w-full"
>
Add Passkey
</Button>
</div>
)}
{/* Both methods available */}
{(!requiresTotp && !requiresPasskey) && (
<div className="p-4 border rounded-lg space-y-3">
<div className="flex items-start gap-3">
<div className="w-10 h-10 rounded bg-primary/10 flex items-center justify-center flex-shrink-0">
<Shield className="w-5 h-5 text-primary" />
</div>
<div className="flex-1">
<h3 className="font-medium text-foreground">Configure MFA</h3>
<p className="text-sm text-muted-foreground">
Set up multi-factor authentication to secure your account
</p>
</div>
</div>
<div className="grid grid-cols-2 gap-3">
<Button
variant="outline"
onClick={() => setShowTotpEnrollment(true)}
className="w-full"
>
<Smartphone className="w-4 h-4 mr-2" />
Authenticator
</Button>
<Button
variant="outline"
onClick={() => setShowPasskeyEnrollment(true)}
className="w-full"
>
<Fingerprint className="w-4 h-4 mr-2" />
Passkey
</Button>
</div>
</div>
)}
{/* Loading state while checking */}
{isChecking && (
<div className="flex items-center justify-center gap-2 text-muted-foreground">
<Loader2 className="w-4 h-4 animate-spin" />
<span className="text-sm">Checking compliance status...</span>
</div>
)}
</CardContent>
</Card>
</div>
{/* Enrollment Wizards */}
<TotpEnrollmentWizard
open={showTotpEnrollment}
onOpenChange={setShowTotpEnrollment}
onSuccess={handleTotpSuccess}
/>
<AddPasskeyWizard
open={showPasskeyEnrollment}
onOpenChange={setShowPasskeyEnrollment}
onSuccess={handlePasskeySuccess}
/>
</div>
);
}
@@ -0,0 +1,34 @@
import { Navigate, Outlet } from 'react-router-dom';
import { useAuth } from '@/contexts/AuthContext';
import AuthenticatedLayout from './AuthenticatedLayout';
import MfaEnforcementLayout from './MfaEnforcementLayout';
import { Loader2 } from 'lucide-react';
export default function ProtectedLayout() {
const { isAuthenticated, isLoading, requiresMfaEnrollment } = useAuth();
if (isLoading) {
return (
<div className="min-h-screen flex items-center justify-center bg-background">
<div className="flex flex-col items-center gap-4">
<Loader2 className="w-8 h-8 animate-spin text-primary" />
<p className="text-muted-foreground text-sm">Loading...</p>
</div>
</div>
);
}
if (!isAuthenticated) {
return <Navigate to="/login" replace />;
}
if (requiresMfaEnrollment) {
return <MfaEnforcementLayout />;
}
return (
<AuthenticatedLayout>
<Outlet />
</AuthenticatedLayout>
);
}
+116 -122
View File
@@ -13,40 +13,31 @@ import {
} from "@/components/ui/dropdown-menu";
import { Avatar, AvatarFallback, AvatarImage } from "@/components/ui/avatar";
import { useAuth } from "@/contexts/AuthContext";
import { api, Organization } from "@/lib/api";
import { Organization } from "@/lib/api";
import { useOrganizations } from "@/hooks/useOrganizations";
import { ComplianceBanner } from "@/components/auth/ComplianceBanner";
export function TopBar() {
const navigate = useNavigate();
const { user, isAuthenticated } = useAuth();
const [organizations, setOrganizations] = useState<Organization[]>([]);
const { user, isAuthenticated, mfaCompliance } = useAuth();
const [currentOrg, setCurrentOrg] = useState<Organization | null>(null);
const [orgsLoading, setOrgsLoading] = useState(true);
// Use React Query hook for organizations with automatic caching and deduplication
const { data: organizations = [], isLoading: orgsLoading } = useOrganizations();
// Debug logging
console.log('[TopBar] organizations data:', organizations);
console.log('[TopBar] organizations is array:', Array.isArray(organizations));
// Ensure organizations is always an array (defensive check)
const organizationsArray = Array.isArray(organizations) ? organizations : [];
// Set initial currentOrg when organizations are loaded
useEffect(() => {
async function fetchOrgs() {
console.log('[TopBar] fetchOrgs called, isAuthenticated:', isAuthenticated);
if (!isAuthenticated) {
console.log('[TopBar] Not authenticated, skipping organizations fetch');
setOrgsLoading(false);
return;
}
try {
console.log('[TopBar] Making api.users.organizations() request');
const response = await api.users.organizations();
console.log('[TopBar] Organizations fetched successfully:', response.organizations.length);
setOrganizations(response.organizations);
if (response.organizations.length > 0 && !currentOrg) {
setCurrentOrg(response.organizations[0]);
}
} catch (error) {
console.error("[TopBar] Failed to fetch organizations:", error);
} finally {
setOrgsLoading(false);
}
if (organizationsArray.length > 0 && !currentOrg) {
setCurrentOrg(organizationsArray[0]);
}
fetchOrgs();
}, [isAuthenticated, currentOrg]);
}, [organizationsArray, currentOrg]);
const handleLogout = () => {
navigate("/login");
@@ -57,103 +48,106 @@ export function TopBar() {
: user?.email?.slice(0, 2).toUpperCase() || "U";
return (
<header className="h-14 border-b border-border bg-card flex items-center justify-between px-4 flex-shrink-0">
{/* Left side - Sidebar toggle */}
<div className="flex items-center gap-3">
<SidebarTrigger className="text-muted-foreground hover:text-foreground">
<Menu className="w-5 h-5" />
</SidebarTrigger>
</div>
<header className="flex flex-col">
<ComplianceBanner compliance={mfaCompliance} />
<div className="h-14 border-b border-border bg-card flex items-center justify-between px-4 flex-shrink-0">
{/* Left side - Sidebar toggle */}
<div className="flex items-center gap-3">
<SidebarTrigger className="text-muted-foreground hover:text-foreground">
<Menu className="w-5 h-5" />
</SidebarTrigger>
</div>
{/* Right side - Org selector + User menu */}
<div className="flex items-center gap-3">
{/* Organization Selector */}
<DropdownMenu>
<DropdownMenuTrigger asChild>
<Button variant="ghost" className="flex items-center gap-2 h-9 px-3">
<div className="w-6 h-6 rounded bg-primary/10 flex items-center justify-center">
<Building2 className="w-3.5 h-3.5 text-primary" />
</div>
<span className="text-sm font-medium hidden sm:inline">
{orgsLoading ? "Loading..." : (currentOrg?.name || "No Organization")}
</span>
<ChevronDown className="w-4 h-4 text-muted-foreground" />
</Button>
</DropdownMenuTrigger>
<DropdownMenuContent align="end" className="w-56">
<DropdownMenuLabel className="text-xs text-muted-foreground uppercase tracking-wider">
Switch Organization
</DropdownMenuLabel>
<DropdownMenuSeparator />
{orgsLoading ? (
<div className="flex items-center justify-center py-4">
<Loader2 className="w-4 h-4 animate-spin text-muted-foreground" />
</div>
) : organizations.length === 0 ? (
<div className="text-sm text-muted-foreground text-center py-4">
No organizations
</div>
) : (
organizations.map((org) => (
<DropdownMenuItem
key={org.id}
onClick={() => setCurrentOrg(org)}
className="flex items-center justify-between"
>
<div className="flex items-center gap-2">
<Building2 className="w-4 h-4 text-muted-foreground" />
<span>{org.name}</span>
</div>
{org.role && ["owner", "admin"].includes(org.role) && (
<span className="text-xs bg-accent/10 text-accent px-1.5 py-0.5 rounded capitalize">
{org.role}
</span>
)}
</DropdownMenuItem>
))
)}
</DropdownMenuContent>
</DropdownMenu>
{/* User Menu */}
<DropdownMenu>
<DropdownMenuTrigger asChild>
<Button variant="ghost" className="flex items-center gap-2 h-9 px-2">
<Avatar className="w-7 h-7">
<AvatarImage src={user?.avatar_url || undefined} />
<AvatarFallback className="bg-primary text-primary-foreground text-xs">
{userInitials}
</AvatarFallback>
</Avatar>
<ChevronDown className="w-4 h-4 text-muted-foreground hidden sm:block" />
</Button>
</DropdownMenuTrigger>
<DropdownMenuContent align="end" className="w-56">
<DropdownMenuLabel>
<div className="flex flex-col">
<span className="font-medium">{user?.full_name || "User"}</span>
<span className="text-xs text-muted-foreground font-normal">
{user?.email}
{/* Right side - Org selector + User menu */}
<div className="flex items-center gap-3">
{/* Organization Selector */}
<DropdownMenu>
<DropdownMenuTrigger asChild>
<Button variant="ghost" className="flex items-center gap-2 h-9 px-3">
<div className="w-6 h-6 rounded bg-primary/10 flex items-center justify-center">
<Building2 className="w-3.5 h-3.5 text-primary" />
</div>
<span className="text-sm font-medium hidden sm:inline">
{orgsLoading ? "Loading..." : (currentOrg?.name || "No Organization")}
</span>
</div>
</DropdownMenuLabel>
<DropdownMenuSeparator />
<DropdownMenuItem onClick={() => navigate("/profile")}>
<User className="w-4 h-4 mr-2" />
Profile
</DropdownMenuItem>
<DropdownMenuItem onClick={() => navigate("/security")}>
<Shield className="w-4 h-4 mr-2" />
Security
</DropdownMenuItem>
<DropdownMenuSeparator />
<DropdownMenuItem onClick={handleLogout} className="text-destructive focus:text-destructive">
<LogOut className="w-4 h-4 mr-2" />
Log out
</DropdownMenuItem>
</DropdownMenuContent>
</DropdownMenu>
<ChevronDown className="w-4 h-4 text-muted-foreground" />
</Button>
</DropdownMenuTrigger>
<DropdownMenuContent align="end" className="w-56">
<DropdownMenuLabel className="text-xs text-muted-foreground uppercase tracking-wider">
Switch Organization
</DropdownMenuLabel>
<DropdownMenuSeparator />
{orgsLoading ? (
<div className="flex items-center justify-center py-4">
<Loader2 className="w-4 h-4 animate-spin text-muted-foreground" />
</div>
) : organizationsArray.length === 0 ? (
<div className="text-sm text-muted-foreground text-center py-4">
No organizations
</div>
) : (
organizationsArray.map((org) => (
<DropdownMenuItem
key={org.id}
onClick={() => setCurrentOrg(org)}
className="flex items-center justify-between"
>
<div className="flex items-center gap-2">
<Building2 className="w-4 h-4 text-muted-foreground" />
<span>{org.name}</span>
</div>
{org.role && ["owner", "admin"].includes(org.role) && (
<span className="text-xs bg-accent/10 text-accent px-1.5 py-0.5 rounded capitalize">
{org.role}
</span>
)}
</DropdownMenuItem>
))
)}
</DropdownMenuContent>
</DropdownMenu>
{/* User Menu */}
<DropdownMenu>
<DropdownMenuTrigger asChild>
<Button variant="ghost" className="flex items-center gap-2 h-9 px-2">
<Avatar className="w-7 h-7">
<AvatarImage src={user?.avatar_url || undefined} />
<AvatarFallback className="bg-primary text-primary-foreground text-xs">
{userInitials}
</AvatarFallback>
</Avatar>
<ChevronDown className="w-4 h-4 text-muted-foreground hidden sm:block" />
</Button>
</DropdownMenuTrigger>
<DropdownMenuContent align="end" className="w-56">
<DropdownMenuLabel>
<div className="flex flex-col">
<span className="font-medium">{user?.full_name || "User"}</span>
<span className="text-xs text-muted-foreground font-normal">
{user?.email}
</span>
</div>
</DropdownMenuLabel>
<DropdownMenuSeparator />
<DropdownMenuItem onClick={() => navigate("/profile")}>
<User className="w-4 h-4 mr-2" />
Profile
</DropdownMenuItem>
<DropdownMenuItem onClick={() => navigate("/security")}>
<Shield className="w-4 h-4 mr-2" />
Security
</DropdownMenuItem>
<DropdownMenuSeparator />
<DropdownMenuItem onClick={handleLogout} className="text-destructive focus:text-destructive">
<LogOut className="w-4 h-4 mr-2" />
Log out
</DropdownMenuItem>
</DropdownMenuContent>
</DropdownMenu>
</div>
</div>
</header>
);
}
}