foxhunt/migrations/ENABLE_MFA_FOR_ADMINS.sql

-- Enable MFA for Admin Accounts
-- Agent H3: Multi-Factor Authentication Enforcement
--
-- This script enforces MFA for all admin-level accounts (system_admin, risk_manager, trader)
-- Resolves security audit finding: MFA infrastructure complete but not enabled by default

-- Step 1: Update is_mfa_required function to enforce MFA based on role
CREATE OR REPLACE FUNCTION is_mfa_required(p_user_id UUID)
RETURNS BOOLEAN AS $$
DECLARE
    v_has_admin_role BOOLEAN;
BEGIN
    -- Check if user has admin, risk_manager, or trader roles
    SELECT EXISTS(
        SELECT 1
        FROM user_roles ur
        JOIN roles r ON ur.role_id = r.id
        WHERE ur.user_id = p_user_id
          AND ur.active = TRUE
          AND r.active = TRUE
          AND (ur.expires_at IS NULL OR ur.expires_at > NOW())
          AND r.name IN ('system_admin', 'risk_manager', 'trader')
    ) INTO v_has_admin_role;

    -- MFA is required for admin roles
    RETURN v_has_admin_role;
END;
$$ LANGUAGE plpgsql STABLE;

COMMENT ON FUNCTION is_mfa_required IS 'Returns TRUE if user has admin-level roles (system_admin, risk_manager, trader) requiring MFA';

-- Step 2: View to identify users requiring MFA who don't have it enabled
CREATE OR REPLACE VIEW users_requiring_mfa AS
SELECT
    u.id,
    u.username,
    u.email,
    array_agg(DISTINCT r.name) as roles,
    COALESCE(m.is_enabled, FALSE) as mfa_enabled,
    COALESCE(m.is_verified, FALSE) as mfa_verified,
    m.enrolled_at,
    is_mfa_required(u.id) as mfa_required
FROM users u
JOIN user_roles ur ON u.id = ur.user_id
JOIN roles r ON ur.role_id = r.id
LEFT JOIN mfa_config m ON u.id = m.user_id
WHERE u.active = TRUE
  AND ur.active = TRUE
  AND r.active = TRUE
  AND (ur.expires_at IS NULL OR ur.expires_at > NOW())
  AND r.name IN ('system_admin', 'risk_manager', 'trader')
GROUP BY u.id, u.username, u.email, m.is_enabled, m.is_verified, m.enrolled_at
HAVING is_mfa_required(u.id) = TRUE;

COMMENT ON VIEW users_requiring_mfa IS 'Shows all users with admin roles who must have MFA enabled';

-- Step 3: Create enforcement trigger to prevent login without MFA
CREATE OR REPLACE FUNCTION enforce_mfa_on_login()
RETURNS TRIGGER AS $$
BEGIN
    -- Check if MFA is required for this user
    IF is_mfa_required(NEW.user_id) THEN
        -- Check if MFA is configured and verified
        IF NOT EXISTS (
            SELECT 1
            FROM mfa_config
            WHERE user_id = NEW.user_id
              AND is_enabled = TRUE
              AND is_verified = TRUE
        ) THEN
            RAISE EXCEPTION 'MFA_REQUIRED: User % must enroll in MFA before authenticating', NEW.user_id
                USING HINT = 'Admin users must complete MFA enrollment',
                      ERRCODE = 'P0001';
        END IF;
    END IF;

    RETURN NEW;
END;
$$ LANGUAGE plpgsql;

-- Apply trigger to sessions table (login creates session)
DROP TRIGGER IF EXISTS enforce_mfa_before_session ON sessions;
CREATE TRIGGER enforce_mfa_before_session
    BEFORE INSERT ON sessions
    FOR EACH ROW
    EXECUTE FUNCTION enforce_mfa_on_login();

COMMENT ON FUNCTION enforce_mfa_on_login IS 'Prevents session creation for admin users without verified MFA';
COMMENT ON TRIGGER enforce_mfa_before_session ON sessions IS 'Enforces MFA requirement during login';

-- Step 4: Report current MFA status
DO $$
DECLARE
    v_admin_count INTEGER;
    v_mfa_enrolled_count INTEGER;
    v_mfa_pending_count INTEGER;
BEGIN
    -- Count admin users
    SELECT COUNT(DISTINCT u.id)
    INTO v_admin_count
    FROM users u
    JOIN user_roles ur ON u.id = ur.user_id
    JOIN roles r ON ur.role_id = r.id
    WHERE u.active = TRUE
      AND ur.active = TRUE
      AND r.active = TRUE
      AND r.name IN ('system_admin', 'risk_manager', 'trader');

    -- Count MFA enrolled admins
    SELECT COUNT(*)
    INTO v_mfa_enrolled_count
    FROM users_requiring_mfa
    WHERE mfa_enabled = TRUE AND mfa_verified = TRUE;

    -- Count pending enrollment
    v_mfa_pending_count := v_admin_count - v_mfa_enrolled_count;

    RAISE NOTICE '';
    RAISE NOTICE '=== MFA Enforcement Status ===';
    RAISE NOTICE 'Total admin users: %', v_admin_count;
    RAISE NOTICE 'MFA enrolled: %', v_mfa_enrolled_count;
    RAISE NOTICE 'MFA pending: %', v_mfa_pending_count;
    RAISE NOTICE '';

    IF v_mfa_pending_count > 0 THEN
        RAISE NOTICE 'ACTION REQUIRED: % admin user(s) must enroll in MFA', v_mfa_pending_count;
        RAISE NOTICE 'Run: SELECT * FROM users_requiring_mfa WHERE mfa_enabled = FALSE;';
    ELSE
        RAISE NOTICE 'SUCCESS: All admin users have MFA enabled';
    END IF;
    RAISE NOTICE '';
END $$;

-- Step 5: Create admin helper function to initiate MFA enrollment
CREATE OR REPLACE FUNCTION admin_force_mfa_enrollment(p_username VARCHAR)
RETURNS TABLE (
    user_id UUID,
    username VARCHAR,
    email VARCHAR,
    message TEXT
) AS $$
DECLARE
    v_user_id UUID;
    v_username VARCHAR;
    v_email VARCHAR;
BEGIN
    -- Find user
    SELECT u.id, u.username, u.email
    INTO v_user_id, v_username, v_email
    FROM users u
    WHERE u.username = p_username
      AND u.active = TRUE;

    IF v_user_id IS NULL THEN
        RAISE EXCEPTION 'User % not found or inactive', p_username;
    END IF;

    -- Check if MFA is required
    IF NOT is_mfa_required(v_user_id) THEN
        RETURN QUERY SELECT
            v_user_id,
            v_username,
            v_email,
            'User does not have admin role - MFA not required'::TEXT;
        RETURN;
    END IF;

    -- Check current MFA status
    IF EXISTS (
        SELECT 1 FROM mfa_config
        WHERE user_id = v_user_id
          AND is_enabled = TRUE
          AND is_verified = TRUE
    ) THEN
        RETURN QUERY SELECT
            v_user_id,
            v_username,
            v_email,
            'MFA already enabled and verified'::TEXT;
        RETURN;
    END IF;

    -- Delete any existing incomplete enrollments
    DELETE FROM mfa_enrollment_sessions WHERE user_id = v_user_id;
    DELETE FROM mfa_config WHERE user_id = v_user_id;

    RETURN QUERY SELECT
        v_user_id,
        v_username,
        v_email,
        'Ready for MFA enrollment - user must call MfaManager.start_enrollment()'::TEXT;
END;
$$ LANGUAGE plpgsql;

COMMENT ON FUNCTION admin_force_mfa_enrollment IS 'Prepares user for MFA enrollment by cleaning up incomplete sessions';

-- Final validation queries
\echo ''
\echo '=== Users Requiring MFA Enrollment ==='
SELECT
    username,
    email,
    roles,
    mfa_enabled,
    mfa_verified,
    CASE
        WHEN mfa_enabled AND mfa_verified THEN '✓ Enrolled'
        WHEN mfa_enabled AND NOT mfa_verified THEN '⚠ Pending Verification'
        ELSE '✗ Not Enrolled'
    END as status
FROM users_requiring_mfa
ORDER BY mfa_enabled DESC, username;

\echo ''
\echo '=== MFA Enforcement Active ==='
\echo 'Trigger "enforce_mfa_before_session" is now active on sessions table'
\echo 'Admin users without verified MFA will be blocked from logging in'
\echo ''