add office-aware passport policies and alert lifecycle

Enforce geofenced location evidence for passport challenges and extend admin alerting so mobile devices can review, dismiss, and act on real org and security events.
2026-04-20 13:21:28 +00:00
parent a1a684ee81
commit e9eb9b4172
11 changed files with 548 additions and 37 deletions
@@ -36,7 +36,10 @@ export class AlertManager {
              action: 'listPassportAlerts',
            }
          );
-          const alerts = await this.listAlertsForUser(passportDevice.data.userId);
+          const alerts = await this.listAlertsForUser(
+            passportDevice.data.userId,
+            !!requestArg.includeDismissed
+          );
          return {
            alerts: alerts.map((alertArg) => ({ id: alertArg.id, data: alertArg.data })),
          };
@@ -82,6 +85,25 @@ export class AlertManager {
      )
    );

+    this.typedRouter.addTypedHandler(
+      new plugins.typedrequest.TypedHandler<plugins.idpInterfaces.request.IReq_DismissPassportAlert>(
+        'dismissPassportAlert',
+        async (requestArg) => {
+          const passportDevice = await this.receptionRef.passportManager.authenticatePassportDeviceRequest(
+            requestArg,
+            {
+              action: 'dismissPassportAlert',
+              signedFields: [`hint_id=${requestArg.hintId}`],
+            }
+          );
+          await this.dismissAlert(passportDevice.data.userId, requestArg.hintId);
+          return {
+            success: true,
+          };
+        }
+      )
+    );
+
    this.typedRouter.addTypedHandler(
      new plugins.typedrequest.TypedHandler<plugins.idpInterfaces.request.IReq_UpsertAlertRule>(
        'upsertAlertRule',
@@ -263,46 +285,81 @@ export class AlertManager {
    }

    if (optionsArg.eventType === 'global_admin_access') {
-      const fallbackRule = new AlertRule();
-      fallbackRule.id = 'builtin-global-admin-access';
-      fallbackRule.data = {
+      return [this.createBuiltInRule('builtin-global-admin-access', {
        scope: 'global',
-        organizationId: undefined,
        eventType: 'global_admin_access',
        minimumSeverity: 'high',
        recipientMode: 'global_admins',
-        recipientUserIds: [],
-        push: true,
-        enabled: true,
-        createdByUserId: 'system',
-        createdAt: 0,
-        updatedAt: 0,
-      };
-      return [fallbackRule];
+      })];
    }

    if (optionsArg.eventType === 'global_app_credentials_regenerated') {
-      const fallbackRule = new AlertRule();
-      fallbackRule.id = 'builtin-global-app-credentials-regenerated';
-      fallbackRule.data = {
+      return [this.createBuiltInRule('builtin-global-app-credentials-regenerated', {
        scope: 'global',
-        organizationId: undefined,
        eventType: 'global_app_credentials_regenerated',
        minimumSeverity: 'critical',
        recipientMode: 'global_admins',
-        recipientUserIds: [],
-        push: true,
-        enabled: true,
-        createdByUserId: 'system',
-        createdAt: 0,
-        updatedAt: 0,
+      })];
+    }
+
+    if (optionsArg.organizationId) {
+      const organizationFallbackMap: Record<
+        string,
+        {
+          minimumSeverity: plugins.idpInterfaces.data.TAlertSeverity;
+        }
+      > = {
+        org_app_connected: { minimumSeverity: 'medium' },
+        org_app_disconnected: { minimumSeverity: 'medium' },
+        org_invitation_created: { minimumSeverity: 'low' },
+        org_invitation_resent: { minimumSeverity: 'low' },
+        org_member_removed: { minimumSeverity: 'high' },
+        org_member_roles_updated: { minimumSeverity: 'high' },
+        org_ownership_transferred: { minimumSeverity: 'critical' },
      };
-      return [fallbackRule];
+      const fallbackConfig = organizationFallbackMap[optionsArg.eventType];
+      if (fallbackConfig) {
+        return [this.createBuiltInRule(`builtin-${optionsArg.eventType}`, {
+          scope: 'organization',
+          organizationId: optionsArg.organizationId,
+          eventType: optionsArg.eventType,
+          minimumSeverity: fallbackConfig.minimumSeverity,
+          recipientMode: 'org_admins',
+        })];
+      }
    }

    return [];
  }

+  private createBuiltInRule(
+    ruleIdArg: string,
+    optionsArg: {
+      scope: plugins.idpInterfaces.data.TAlertRuleScope;
+      organizationId?: string;
+      eventType: string;
+      minimumSeverity: plugins.idpInterfaces.data.TAlertSeverity;
+      recipientMode: plugins.idpInterfaces.data.TAlertRuleRecipientMode;
+    }
+  ) {
+    const fallbackRule = new AlertRule();
+    fallbackRule.id = ruleIdArg;
+    fallbackRule.data = {
+      scope: optionsArg.scope,
+      organizationId: optionsArg.organizationId,
+      eventType: optionsArg.eventType,
+      minimumSeverity: optionsArg.minimumSeverity,
+      recipientMode: optionsArg.recipientMode,
+      recipientUserIds: [],
+      push: true,
+      enabled: true,
+      createdByUserId: 'system',
+      createdAt: 0,
+      updatedAt: 0,
+    };
+    return fallbackRule;
+  }
+
  public async createAlertsForEvent(optionsArg: {
    category: plugins.idpInterfaces.data.TAlertCategory;
    eventType: string;
@@ -378,11 +435,13 @@ export class AlertManager {
    return createdAlerts;
  }

-  public async listAlertsForUser(userIdArg: string) {
+  public async listAlertsForUser(userIdArg: string, includeDismissedArg = false) {
    const alerts = await this.CAlert.getInstances({
      'data.recipientUserId': userIdArg,
    });
-    return alerts.sort((leftArg, rightArg) => rightArg.data.createdAt - leftArg.data.createdAt);
+    return alerts
+      .filter((alertArg) => includeDismissedArg || !alertArg.data.dismissedAt)
+      .sort((leftArg, rightArg) => rightArg.data.createdAt - leftArg.data.createdAt);
  }

  public async getAlertByHint(userIdArg: string, hintIdArg: string) {
@@ -408,6 +467,25 @@ export class AlertManager {
    return alert;
  }

+  public async dismissAlert(userIdArg: string, hintIdArg: string) {
+    const alert = await this.getAlertByHint(userIdArg, hintIdArg);
+    if (!alert) {
+      throw new plugins.typedrequest.TypedResponseError('Alert not found');
+    }
+
+    alert.data.dismissedAt = Date.now();
+    if (!alert.data.seenAt) {
+      alert.data.seenAt = Date.now();
+    }
+    alert.data.notification = {
+      ...alert.data.notification,
+      status: 'seen',
+      seenAt: alert.data.notification.seenAt || Date.now(),
+    };
+    await alert.save();
+    return alert;
+  }
+
  public async reDeliverPendingAlerts() {
    const alerts = await this.CAlert.getInstances({});
    for (const alert of alerts) {
@@ -11,6 +11,29 @@ export class AppConnectionManager {

  public CAppConnection = plugins.smartdata.setDefaultManagerForDoc(this, AppConnection);

+  private async emitOrganizationAlert(optionsArg: {
+    organizationId: string;
+    eventType: string;
+    severity: plugins.idpInterfaces.data.TAlertSeverity;
+    title: string;
+    body: string;
+    actorUserId: string;
+    relatedEntityId?: string;
+    relatedEntityType?: string;
+  }) {
+    await this.receptionRef.alertManager.createAlertsForEvent({
+      category: 'admin',
+      organizationId: optionsArg.organizationId,
+      eventType: optionsArg.eventType,
+      severity: optionsArg.severity,
+      title: optionsArg.title,
+      body: optionsArg.body,
+      actorUserId: optionsArg.actorUserId,
+      relatedEntityId: optionsArg.relatedEntityId,
+      relatedEntityType: optionsArg.relatedEntityType,
+    });
+  }
+
  constructor(receptionRefArg: Reception) {
    this.receptionRef = receptionRefArg;
    this.receptionRef.typedrouter.addTypedRouter(this.typedrouter);
@@ -131,6 +154,17 @@ export class AppConnectionManager {
              await connection.save();
            }

+            await this.emitOrganizationAlert({
+              organizationId: requestArg.organizationId,
+              eventType: 'org_app_connected',
+              severity: 'medium',
+              title: 'Organization app connected',
+              body: `${user.data.email} connected ${app.data.name} to this organization.`,
+              actorUserId: user.id,
+              relatedEntityId: app.id,
+              relatedEntityType: 'global-app',
+            });
+
            return {
              success: true,
              connection: await connection.createSavableObject(),
@@ -145,6 +179,17 @@ export class AppConnectionManager {

            await connection.disconnect();

+            await this.emitOrganizationAlert({
+              organizationId: requestArg.organizationId,
+              eventType: 'org_app_disconnected',
+              severity: 'medium',
+              title: 'Organization app disconnected',
+              body: `${user.data.email} disconnected ${app.data.name} from this organization.`,
+              actorUserId: user.id,
+              relatedEntityId: app.id,
+              relatedEntityType: 'global-app',
+            });
+
            return {
              success: true,
              connection: await connection.createSavableObject(),
@@ -30,6 +30,7 @@ export class PassportChallenge extends plugins.smartdata.SmartDataDbDoc<
      deviceLabel: undefined,
      requireLocation: false,
      requireNfc: false,
+      locationPolicy: undefined,
      requestedCapabilities: undefined,
    },
    evidence: undefined,
@@ -56,4 +57,10 @@ export class PassportChallenge extends plugins.smartdata.SmartDataDbDoc<
    this.data.status = 'expired';
    await this.save();
  }
+
+  public async markRejected() {
+    this.data.status = 'rejected';
+    this.data.completedAt = Date.now();
+    await this.save();
+  }
 }
@@ -137,6 +137,47 @@ export class PassportManager {
      )
    );

+    this.typedRouter.addTypedHandler(
+      new plugins.typedrequest.TypedHandler<plugins.idpInterfaces.request.IReq_GetPassportDashboard>(
+        'getPassportDashboard',
+        async (requestArg) => {
+          const passportDevice = await this.authenticatePassportDeviceRequest(requestArg, {
+            action: 'getPassportDashboard',
+          });
+
+          const user = await this.receptionRef.userManager.CUser.getInstance({
+            id: passportDevice.data.userId,
+          });
+          const organizations = user
+            ? await this.receptionRef.organizationmanager.getAllOrganizationsForUser(user)
+            : [];
+          const devices = await this.getPassportDevicesForUser(passportDevice.data.userId);
+          const challenges = await this.listPendingChallengesForDevice(passportDevice.id);
+          const alerts = await this.receptionRef.alertManager.listAlertsForUser(passportDevice.data.userId);
+
+          return {
+            profile: {
+              userId: passportDevice.data.userId,
+              name: user?.data?.name || user?.data?.email || 'Passport User',
+              handle: user?.data?.username || user?.data?.email || passportDevice.data.userId,
+              organizations: organizations.map((organizationArg) => ({
+                id: organizationArg.id,
+                name: organizationArg.data.name,
+              })),
+              deviceCount: devices.length,
+              recoverySummary: 'Recovery workflows are not configured yet for this passport.',
+            },
+            devices: devices.map((deviceArg) => ({ id: deviceArg.id, data: deviceArg.data })),
+            challenges: challenges.map((challengeArg) => ({
+              challenge: { id: challengeArg.id, data: challengeArg.data },
+              signingPayload: this.buildChallengeSigningPayload(challengeArg),
+            })),
+            alerts: alerts.map((alertArg) => ({ id: alertArg.id, data: alertArg.data })),
+          };
+        }
+      )
+    );
+
    this.typedRouter.addTypedHandler(
      new plugins.typedrequest.TypedHandler<plugins.idpInterfaces.request.IReq_ApprovePassportChallenge>(
        'approvePassportChallenge',
@@ -161,6 +202,26 @@ export class PassportManager {
      )
    );

+    this.typedRouter.addTypedHandler(
+      new plugins.typedrequest.TypedHandler<plugins.idpInterfaces.request.IReq_RejectPassportChallenge>(
+        'rejectPassportChallenge',
+        async (requestArg) => {
+          const passportDevice = await this.authenticatePassportDeviceRequest(requestArg, {
+            action: 'rejectPassportChallenge',
+            signedFields: [`challenge_id=${requestArg.challengeId}`],
+          });
+          const challenge = await this.rejectPassportChallenge(passportDevice.id, requestArg.challengeId);
+          return {
+            success: true,
+            challenge: {
+              id: challenge.id,
+              data: challenge.data,
+            },
+          };
+        }
+      )
+    );
+
    this.typedRouter.addTypedHandler(
      new plugins.typedrequest.TypedHandler<plugins.idpInterfaces.request.IReq_RegisterPassportPushToken>(
        'registerPassportPushToken',
@@ -225,8 +286,11 @@ export class PassportManager {
          return {
            challenge: passportChallenge
              ? {
-                  id: passportChallenge.id,
-                  data: passportChallenge.data,
+                  challenge: {
+                    id: passportChallenge.id,
+                    data: passportChallenge.data,
+                  },
+                  signingPayload: this.buildChallengeSigningPayload(passportChallenge),
                }
              : undefined,
          };
@@ -374,9 +438,43 @@ export class PassportManager {
      `audience=${challengeArg.data.metadata.audience || ''}`,
      `require_location=${challengeArg.data.metadata.requireLocation}`,
      `require_nfc=${challengeArg.data.metadata.requireNfc}`,
+      `location_policy=${challengeArg.data.metadata.locationPolicy ? JSON.stringify(challengeArg.data.metadata.locationPolicy) : ''}`,
    ].join('\n');
  }

+  private evaluateLocationPolicy(
+    locationPolicyArg: plugins.idpInterfaces.data.IPassportLocationPolicy,
+    locationEvidenceArg: plugins.idpInterfaces.data.IPassportLocationEvidence
+  ) {
+    const earthRadiusMeters = 6371000;
+    const latitude1 = (locationPolicyArg.latitude * Math.PI) / 180;
+    const latitude2 = (locationEvidenceArg.latitude * Math.PI) / 180;
+    const deltaLatitude = ((locationEvidenceArg.latitude - locationPolicyArg.latitude) * Math.PI) / 180;
+    const deltaLongitude = ((locationEvidenceArg.longitude - locationPolicyArg.longitude) * Math.PI) / 180;
+
+    const haversine =
+      Math.sin(deltaLatitude / 2) * Math.sin(deltaLatitude / 2) +
+      Math.cos(latitude1) * Math.cos(latitude2) * Math.sin(deltaLongitude / 2) * Math.sin(deltaLongitude / 2);
+    const distanceMeters = 2 * earthRadiusMeters * Math.atan2(Math.sqrt(haversine), Math.sqrt(1 - haversine));
+
+    const accuracyAccepted =
+      !locationPolicyArg.maxAccuracyMeters ||
+      locationEvidenceArg.accuracyMeters <= locationPolicyArg.maxAccuracyMeters;
+    const withinGeofence = distanceMeters <= locationPolicyArg.radiusMeters;
+
+    return {
+      matched: accuracyAccepted && withinGeofence,
+      distanceMeters,
+      accuracyAccepted,
+      evaluatedAt: Date.now(),
+      reason: !accuracyAccepted
+        ? `Accuracy ${locationEvidenceArg.accuracyMeters}m exceeds allowed ${locationPolicyArg.maxAccuracyMeters}m`
+        : !withinGeofence
+          ? `Location is ${Math.round(distanceMeters)}m away from ${locationPolicyArg.label || 'required area'}`
+          : undefined,
+    };
+  }
+
  private createPairingPayload(
    pairingTokenArg: string,
    challengeArg: PassportChallenge,
@@ -450,6 +548,7 @@ export class PassportManager {
        deviceLabel: optionsArg.deviceLabel,
        requireLocation: false,
        requireNfc: false,
+        locationPolicy: undefined,
        requestedCapabilities: this.normalizeCapabilities(optionsArg.capabilities),
      },
      evidence: undefined,
@@ -602,6 +701,7 @@ export class PassportManager {
      notificationTitle?: string;
      requireLocation?: boolean;
      requireNfc?: boolean;
+      locationPolicy?: plugins.idpInterfaces.data.IPassportLocationPolicy;
    }
  ) {
    const passportDevices = await this.getPassportDevicesForUser(userIdArg);
@@ -631,8 +731,9 @@ export class PassportManager {
        audience: optionsArg.audience,
        notificationTitle: optionsArg.notificationTitle,
        deviceLabel: targetDevice.data.label,
-        requireLocation: !!optionsArg.requireLocation,
+        requireLocation: !!optionsArg.requireLocation || !!optionsArg.locationPolicy,
        requireNfc: !!optionsArg.requireNfc,
+        locationPolicy: optionsArg.locationPolicy,
      },
      evidence: undefined,
      notification: {
@@ -716,9 +817,21 @@ export class PassportManager {
      throw new plugins.typedrequest.TypedResponseError('Passport signature invalid');
    }

+    const locationEvaluation =
+      passportChallenge.data.metadata.locationPolicy && optionsArg.location
+        ? this.evaluateLocationPolicy(passportChallenge.data.metadata.locationPolicy, optionsArg.location)
+        : undefined;
+
+    if (passportChallenge.data.metadata.locationPolicy && !locationEvaluation?.matched) {
+      throw new plugins.typedrequest.TypedResponseError(
+        locationEvaluation?.reason || 'Location evidence did not satisfy the office policy'
+      );
+    }
+
    await passportChallenge.markApproved({
      signatureFormat: optionsArg.signatureFormat || 'raw',
      location: optionsArg.location,
+      locationEvaluation,
      nfc: optionsArg.nfc,
    });

@@ -738,6 +851,36 @@ export class PassportManager {
    return passportChallenge;
  }

+  public async rejectPassportChallenge(deviceIdArg: string, challengeIdArg: string) {
+    const passportChallenge = await this.CPassportChallenge.getInstance({
+      id: challengeIdArg,
+      'data.deviceId': deviceIdArg,
+      'data.status': 'pending',
+    });
+    if (!passportChallenge) {
+      throw new plugins.typedrequest.TypedResponseError('Passport challenge not found');
+    }
+
+    if (passportChallenge.isExpired()) {
+      await passportChallenge.markExpired();
+      throw new plugins.typedrequest.TypedResponseError('Passport challenge expired');
+    }
+
+    await passportChallenge.markRejected();
+
+    await this.receptionRef.activityLogManager.logActivity(
+      passportChallenge.data.userId,
+      'passport_challenge_rejected',
+      `Rejected passport challenge ${passportChallenge.data.type}`,
+      {
+        targetId: passportChallenge.id,
+        targetType: 'passport-challenge',
+      }
+    );
+
+    return passportChallenge;
+  }
+
  public async listPendingChallengesForDevice(deviceIdArg: string) {
    const passportChallenges = await this.CPassportChallenge.getInstances({
      'data.deviceId': deviceIdArg,
@@ -14,6 +14,36 @@ export class UserInvitationManager {

  public CUserInvitation = plugins.smartdata.setDefaultManagerForDoc(this, UserInvitation);

+  private async emitOrganizationAlert(optionsArg: {
+    organizationId: string;
+    eventType: string;
+    severity: plugins.idpInterfaces.data.TAlertSeverity;
+    title: string;
+    body: string;
+    actorUserId: string;
+    relatedEntityId?: string;
+    relatedEntityType?: string;
+  }) {
+    await this.receptionRef.alertManager.createAlertsForEvent({
+      category: 'admin',
+      organizationId: optionsArg.organizationId,
+      eventType: optionsArg.eventType,
+      severity: optionsArg.severity,
+      title: optionsArg.title,
+      body: optionsArg.body,
+      actorUserId: optionsArg.actorUserId,
+      relatedEntityId: optionsArg.relatedEntityId,
+      relatedEntityType: optionsArg.relatedEntityType,
+    });
+  }
+
+  private async getOrganizationName(organizationIdArg: string) {
+    const organization = await this.receptionRef.organizationmanager.COrganization.getInstance({
+      id: organizationIdArg,
+    });
+    return organization?.data.name || 'this organization';
+  }
+
  constructor(receptionRefArg: Reception) {
    this.receptionRef = receptionRefArg;
    this.receptionRef.typedrouter.addTypedRouter(this.typedrouter);
@@ -85,11 +115,24 @@ export class UserInvitationManager {
            isNew = true;
          }

-          // Send invitation email
-          await this.sendInvitationEmail(invitation, requestArg.organizationId);
+            // Send invitation email
+            await this.sendInvitationEmail(invitation, requestArg.organizationId);

-          return {
-            success: true,
+            await this.emitOrganizationAlert({
+              organizationId: requestArg.organizationId,
+              eventType: 'org_invitation_created',
+              severity: 'low',
+              title: 'Organization invitation created',
+              body: `${user.data.email} invited ${email} to ${await this.getOrganizationName(
+                requestArg.organizationId
+              )}.`,
+              actorUserId: user.id,
+              relatedEntityId: invitation.id,
+              relatedEntityType: 'invitation',
+            });
+
+            return {
+              success: true,
            invitation: await invitation.createSavableObject(),
            isNew,
          };
@@ -189,6 +232,17 @@ export class UserInvitationManager {
          await invitation.regenerateToken();
          await this.sendInvitationEmail(invitation, requestArg.organizationId);

+          await this.emitOrganizationAlert({
+            organizationId: requestArg.organizationId,
+            eventType: 'org_invitation_resent',
+            severity: 'low',
+            title: 'Organization invitation resent',
+            body: `${user.data.email} resent an invitation to ${invitation.data.email}.`,
+            actorUserId: user.id,
+            relatedEntityId: invitation.id,
+            relatedEntityType: 'invitation',
+          });
+
          return { success: true, message: 'Invitation resent.' };
        }
      )
@@ -231,10 +285,12 @@ export class UserInvitationManager {

          await role.delete();

-          // Remove org from user's connectedOrgs
-          const memberUser = await this.receptionRef.userManager.CUser.getInstance({
+          const removedUser = await this.receptionRef.userManager.CUser.getInstance({
            id: requestArg.userId,
          });
+
+          // Remove org from user's connectedOrgs
+          const memberUser = removedUser;
          if (memberUser && memberUser.data.connectedOrgs) {
            memberUser.data.connectedOrgs = memberUser.data.connectedOrgs.filter(
              orgId => orgId !== requestArg.organizationId
@@ -242,6 +298,19 @@ export class UserInvitationManager {
            await memberUser.save();
          }

+          await this.emitOrganizationAlert({
+            organizationId: requestArg.organizationId,
+            eventType: 'org_member_removed',
+            severity: 'high',
+            title: 'Organization member removed',
+            body: `${user.data.email} removed ${removedUser?.data?.email || requestArg.userId} from ${await this.getOrganizationName(
+              requestArg.organizationId
+            )}.`,
+            actorUserId: user.id,
+            relatedEntityId: requestArg.userId,
+            relatedEntityType: 'user',
+          });
+
          return { success: true };
        }
      )
@@ -283,6 +352,20 @@ export class UserInvitationManager {
          role.data.roles = requestArg.roles;
          await role.save();

+          const updatedUser = await this.receptionRef.userManager.CUser.getInstance({
+            id: requestArg.userId,
+          });
+          await this.emitOrganizationAlert({
+            organizationId: requestArg.organizationId,
+            eventType: 'org_member_roles_updated',
+            severity: 'high',
+            title: 'Organization member roles updated',
+            body: `${user.data.email} changed roles for ${updatedUser?.data?.email || requestArg.userId} to ${requestArg.roles.join(', ')}.`,
+            actorUserId: user.id,
+            relatedEntityId: requestArg.userId,
+            relatedEntityType: 'user',
+          });
+
          return { success: true, role: await role.createSavableObject() };
        }
      )
@@ -332,6 +415,20 @@ export class UserInvitationManager {
          }
          await currentUserRole.save();

+          const newOwner = await this.receptionRef.userManager.CUser.getInstance({
+            id: requestArg.newOwnerId,
+          });
+          await this.emitOrganizationAlert({
+            organizationId: requestArg.organizationId,
+            eventType: 'org_ownership_transferred',
+            severity: 'critical',
+            title: 'Organization ownership transferred',
+            body: `${user.data.email} transferred ownership to ${newOwner?.data?.email || requestArg.newOwnerId}.`,
+            actorUserId: user.id,
+            relatedEntityId: requestArg.newOwnerId,
+            relatedEntityType: 'user',
+          });
+
          return { success: true };
        }
      )