Add reject_access_due_to_2fa_for_org function by WcaleNieWolny · Pull Request #1333 · Cap-go/capgo

WcaleNieWolny · 2025-12-30T11:53:59Z

Summary

Adds a new database function reject_access_due_to_2fa_for_org for checking 2FA enforcement at the organization level. This function respects org-limited API keys and properly validates that API keys are allowed to access the specific organization being queried.

Test plan

All 14 new tests pass, covering JWT auth, API key auth, org-limited API key access control, and edge cases
Run with: supabase test db
All 804 existing tests continue to pass

Checklist

My code follows the code style of this project
I have adequate test coverage (14 new tests)
All tests pass locally

Motivation

It turns out that even with the best plan in the world (#1291), 3 PRs that do nothing but add DB code (#1311, #1310, #1300) getting all the functions I need for the CLI to work in advance is not easy. I forgot to do public reject_access_due_to_2fa_for_org, so here we go. 4th PR for the 2FA enforcement

Business impact

None - another PR in the PRs required for 2FA enforcement to work

Summary by CodeRabbit

New Features
- Added organization-level two-factor authentication (2FA) enforcement. Organizations can now require members to enable 2FA before accessing organization resources.
Tests
- Comprehensive test coverage added for the new 2FA enforcement feature.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

Note

Adds an org-scoped 2FA access check usable by CLI/frontend.

New public.reject_access_due_to_2fa_for_org(org_id uuid) (SECURITY DEFINER) returns true to reject or false to allow
Validates identity via public.get_identity_org_allowed(...) to enforce org-limited API key scope
Logic: reject if no identity; allow if org missing or not enforcing 2FA; if enforcing, require public.has_2fa_enabled(user_id)
Grants EXECUTE to authenticated, anon, and service_role
Adds 14 tests covering JWT auth, API key auth, org-limited keys (allowed/denied orgs), anonymity, and edge cases

^{Written by Cursor Bugbot for commit 6a12b49. This will update automatically on new commits. Configure here.}

… checks Adds a new function for checking 2FA enforcement at the organization level, respecting org-limited API keys. Includes 14 comprehensive tests covering JWT auth, API key auth, org-limited API key constraints, and edge cases. 🤖 Generated with Claude Code Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

coderabbitai · 2025-12-30T11:54:14Z

📝 Walkthrough

Walkthrough

Adds a SECURITY DEFINER SQL function public.reject_access_due_to_2fa_for_org(org_id uuid) that evaluates org-level 2FA enforcement and the caller's 2FA status, returning a boolean to allow or reject access; includes grants and a 14-case test suite.

Changes

Cohort / File(s)	Summary
Core function `supabase/migrations/20251230114041_reject_access_due_to_2fa_for_org.sql`	Adds `reject_access_due_to_2fa_for_org(org_id uuid)` (plpgsql, SECURITY DEFINER, owner postgres, search_path '') that: fetches current identity via `public.get_identity_org_allowed`, rejects if no identity, reads `public.orgs.enforcing_2fa`, returns reject when org enforces 2FA and user lacks `has_2fa_enabled`; grants EXECUTE to `authenticated`, `anon`, and `service_role`.
Tests `supabase/tests/42_test_reject_access_due_to_2fa_for_org.sql`	New test script creating users, orgs (enforcing/non-enforcing), MFA factor, API keys (including org-limited), and 14 assertions covering combinations of user 2FA state, org enforcement, API-key contexts, non-existent org, anonymous and service role access; ends with rollback.

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant DB_Function as reject_access_due_to_2fa_for_org()
  participant IdentityFn as public.get_identity_org_allowed()
  participant Orgs as public.orgs

  Client->>DB_Function: call(org_id)
  DB_Function->>IdentityFn: get_identity(org_id, key_modes...)
  IdentityFn-->>DB_Function: identity or null
  alt no identity
    DB_Function-->>Client: RETURN true  /* reject access */
  else identity found
    DB_Function->>Orgs: SELECT enforcing_2fa FROM orgs WHERE id=org_id
    Orgs-->>DB_Function: enforcing_2fa value or null
    alt org not found or enforcing_2fa = false
      DB_Function-->>Client: RETURN false /* allow */
    else enforcing_2fa = true
      alt identity.has_2fa_enabled = true
        DB_Function-->>Client: RETURN false /* allow */
      else
        DB_Function-->>Client: RETURN true  /* reject */
      end
    end
  end

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

feat: reject_access_due_to_2fa_for_app #1310: Adds a similar SECURITY DEFINER function for app-level 2FA enforcement (reject_access_due_to_2fa_for_app) with matching grants and tests.
feat: 2FA enforcement - database #1300: Introduces overlapping org-level 2FA enforcement logic and related DB identity/2FA checks used by this function.

Poem

🐇 A rabbit hopped into the DB night,

"Is two‑factor on? I'll guard it right."
If org says yes and your keys are bare,
I'll bounce you gently — security's fair. 🥕

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely summarizes the main change: adding a new database function for 2FA access control at the organization level.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description check	✅ Passed	The PR description includes all required sections: summary, test plan, and checklist with verification items marked complete.

✨ Finishing touches

📝 Generate docstrings

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

- Clarify why get_identity_org_allowed is used instead of get_identity - Document intentional behavior difference when org doesn't exist - Ensure clean request.headers state before anonymous user test 🤖 Generated with Claude Code Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

🤖 Generated with Claude Code Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

sonarqubecloud · 2025-12-31T19:39:30Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

* feat: add reject_access_due_to_2fa_for_org function for org-level 2FA checks Adds a new function for checking 2FA enforcement at the organization level, respecting org-limited API keys. Includes 14 comprehensive tests covering JWT auth, API key auth, org-limited API key constraints, and edge cases. 🤖 Generated with Claude Code Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix: improve comments and ensure clean test state - Clarify why get_identity_org_allowed is used instead of get_identity - Document intentional behavior difference when org doesn't exist - Ensure clean request.headers state before anonymous user test 🤖 Generated with Claude Code Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: return false for non-existent org (no 2FA enforcement applies) 🤖 Generated with Claude Code Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> Co-authored-by: Martin DONADIEU <martindonadieu@gmail.com>

WcaleNieWolny and others added 3 commits December 30, 2025 13:00

fix: return false for non-existent org (no 2FA enforcement applies)

2dd45e7

🤖 Generated with Claude Code Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Merge branch 'main' into WcaleNieWolny/reject-2fa-org-access

6a12b49

riderx merged commit c99e1fb into main Dec 31, 2025
10 checks passed

riderx deleted the WcaleNieWolny/reject-2fa-org-access branch December 31, 2025 19:38

coderabbitai bot mentioned this pull request Jan 2, 2026

fix: support hashed API keys in RLS identity functions #1351

Merged

3 tasks

This was referenced Jan 26, 2026

Feature/sso 04 tests #1380

Closed

Fix 2FA enforcement in RBAC checks #1512

Merged

fix(api): allow org password verify #1547

Merged

coderabbitai bot mentioned this pull request Feb 7, 2026

Sso 01 schema #1597

Closed

coderabbitai bot mentioned this pull request Mar 8, 2026

Restrict org status RPCs to authenticated members #1751

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add reject_access_due_to_2fa_for_org function#1333

Add reject_access_due_to_2fa_for_org function#1333
riderx merged 4 commits intomainfrom
WcaleNieWolny/reject-2fa-org-access

WcaleNieWolny commented Dec 30, 2025 •

edited by cursor bot

Loading

Uh oh!

coderabbitai bot commented Dec 30, 2025 •

edited

Loading

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

Possibly related PRs

Poem

Uh oh!

Uh oh!

sonarqubecloud bot commented Dec 31, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

WcaleNieWolny commented Dec 30, 2025 • edited by cursor bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Checklist

Motivation

Business impact

Summary by CodeRabbit

Uh oh!

coderabbitai bot commented Dec 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

Possibly related PRs

Poem

Pre-merge checks and finishing touches

Uh oh!

Uh oh!

sonarqubecloud bot commented Dec 31, 2025

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

WcaleNieWolny commented Dec 30, 2025 •

edited by cursor bot

Loading

coderabbitai bot commented Dec 30, 2025 •

edited

Loading