fix(cli): add goreleaser v2 config version

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: EfeDurmaz16

packages/sardis-api/migrations/039_access_audit_log.sql

@@ -0,0 +1,25 @@
+-- Access audit log for SOC 2 compliance.
+-- Records all authentication events, admin actions, and API access.
+
+CREATE TABLE IF NOT EXISTS access_audit_log (
+    id              BIGSERIAL PRIMARY KEY,
+    event_type      TEXT NOT NULL,              -- 'auth_success', 'auth_failure', 'admin_action', 'api_access'
+    user_id         TEXT,
+    org_id          TEXT,
+    ip_address      TEXT,
+    user_agent      TEXT,
+    endpoint        TEXT,
+    method          TEXT,
+    status_code     INT,
+    auth_method     TEXT,                       -- 'api_key', 'jwt', 'anonymous'
+    details         JSONB DEFAULT '{}',
+    created_at      TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_audit_log_created_at ON access_audit_log (created_at);
+CREATE INDEX IF NOT EXISTS idx_audit_log_user_id ON access_audit_log (user_id) WHERE user_id IS NOT NULL;
+CREATE INDEX IF NOT EXISTS idx_audit_log_event_type ON access_audit_log (event_type);
+CREATE INDEX IF NOT EXISTS idx_audit_log_org_id ON access_audit_log (org_id) WHERE org_id IS NOT NULL;
+
+-- Retention: keep for 1 year
+-- DELETE FROM access_audit_log WHERE created_at < now() - interval '1 year';

packages/sardis-api/src/sardis_api/audit_log.py

@@ -0,0 +1,115 @@
+"""Access audit logging for SOC 2 compliance.
+
+Logs all authentication events, admin actions, and sensitive API access
+to the access_audit_log table.
+"""
+from __future__ import annotations
+
+import json
+import logging
+from typing import Any, Optional
+
+from fastapi import Request
+
+logger = logging.getLogger("sardis.audit")
+
+
+async def log_access_event(
+    event_type: str,
+    request: Optional[Request] = None,
+    user_id: str | None = None,
+    org_id: str | None = None,
+    status_code: int | None = None,
+    auth_method: str | None = None,
+    details: dict[str, Any] | None = None,
+) -> None:
+    """Record an access event to the audit log table.
+
+    Best-effort — failures are logged but do not block the request.
+    """
+    ip_address = ""
+    user_agent = ""
+    endpoint = ""
+    method = ""
+
+    if request:
+        if request.client:
+            ip_address = request.client.host
+        user_agent = request.headers.get("User-Agent", "")[:500]
+        endpoint = str(request.url.path)
+        method = request.method
+
+    try:
+        from sardis_v2_core.database import get_pool
+
+        pool = await get_pool()
+        async with pool.acquire() as conn:
+            await conn.execute(
+                """
+                INSERT INTO access_audit_log
+                    (event_type, user_id, org_id, ip_address, user_agent,
+                     endpoint, method, status_code, auth_method, details)
+                VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10::jsonb)
+                """,
+                event_type,
+                user_id,
+                org_id,
+                ip_address,
+                user_agent[:500],
+                endpoint[:500],
+                method,
+                status_code,
+                auth_method,
+                json.dumps(details or {}),
+            )
+    except Exception as e:
+        # Best-effort — don't let audit logging break requests
+        logger.warning("Audit log write failed: %s", e)
+
+
+async def log_auth_success(
+    request: Request,
+    user_id: str,
+    org_id: str,
+    auth_method: str,
+) -> None:
+    """Log a successful authentication."""
+    await log_access_event(
+        event_type="auth_success",
+        request=request,
+        user_id=user_id,
+        org_id=org_id,
+        auth_method=auth_method,
+    )
+
+
+async def log_auth_failure(
+    request: Request,
+    auth_method: str,
+    reason: str = "",
+) -> None:
+    """Log a failed authentication attempt."""
+    await log_access_event(
+        event_type="auth_failure",
+        request=request,
+        auth_method=auth_method,
+        details={"reason": reason},
+    )
+
+
+async def log_admin_action(
+    request: Request,
+    user_id: str,
+    org_id: str,
+    action: str,
+    details: dict[str, Any] | None = None,
+) -> None:
+    """Log an admin action for compliance."""
+    await log_access_event(
+        event_type="admin_action",
+        request=request,
+        user_id=user_id,
+        org_id=org_id,
+        auth_method="admin",
+        details={"action": action, **(details or {})},
+    )

packages/sardis-api/src/sardis_api/middleware/mfa.py

@@ -0,0 +1,106 @@
+"""MFA enforcement for admin endpoints.
+
+Verifies TOTP codes via X-MFA-Code header when users have MFA enabled.
+In production, admin endpoints with sensitive operations require MFA.
+"""
+from __future__ import annotations
+
+import logging
+import os
+
+from fastapi import Depends, HTTPException, Request, status
+
+from sardis_api.authz import Principal, require_admin_principal
+
+logger = logging.getLogger("sardis.api.mfa")
+
+
+async def _get_user_mfa_status(user_id: str) -> dict:
+    """Check if a user has MFA enabled and retrieve their secret."""
+    try:
+        from sardis_v2_core.database import get_pool
+
+        pool = await get_pool()
+        async with pool.acquire() as conn:
+            row = await conn.fetchrow(
+                "SELECT mfa_enabled, mfa_secret FROM users WHERE id = $1",
+                user_id,
+            )
+            if not row:
+                return {"enabled": False, "secret": None}
+            return {
+                "enabled": bool(row["mfa_enabled"]),
+                "secret": row["mfa_secret"],
+            }
+    except Exception as e:
+        logger.warning("Could not check MFA status for user=%s: %s", user_id, e)
+        return {"enabled": False, "secret": None}
+
+
+async def require_mfa_if_enabled(
+    request: Request,
+    principal: Principal = Depends(require_admin_principal),
+) -> None:
+    """FastAPI dependency that enforces MFA for admin users who have it enabled.
+
+    Checks for X-MFA-Code header and verifies against the user's TOTP secret.
+    Skips verification if MFA is not enabled for the user or in dev/test environments
+    (unless SARDIS_REQUIRE_ADMIN_MFA=1 is set).
+    """
+    env = os.getenv("SARDIS_ENVIRONMENT", "dev").strip().lower()
+    force_mfa = os.getenv("SARDIS_REQUIRE_ADMIN_MFA", "").strip().lower() in (
+        "1", "true", "yes", "on",
+    )
+
+    # In dev/test, skip MFA unless explicitly forced
+    if env not in ("prod", "production") and not force_mfa:
+        return
+
+    # Only enforce MFA for JWT-authenticated users (not API keys)
+    if principal.kind != "jwt":
+        return
+
+    user = principal.user
+    if user is None:
+        return
+
+    user_id = getattr(user, "username", None) or getattr(user, "id", None)
+    if not user_id:
+        return
+
+    mfa_status = await _get_user_mfa_status(user_id)
+    if not mfa_status["enabled"]:
+        if env in ("prod", "production"):
+            logger.warning(
+                "Admin user %s has no MFA enabled — consider enforcing MFA setup",
+                user_id,
+            )
+        return
+
+    # MFA is enabled — require the code
+    mfa_code = request.headers.get("X-MFA-Code", "").strip()
+    if not mfa_code:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="MFA code required. Provide X-MFA-Code header.",
+        )
+
+    # Verify TOTP code
+    try:
+        import pyotp
+
+        totp = pyotp.TOTP(mfa_status["secret"])
+        if not totp.verify(mfa_code, valid_window=1):
+            logger.warning("Invalid MFA code for admin user %s", user_id)
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN,
+                detail="Invalid MFA code",
+            )
+    except ImportError:
+        logger.error("pyotp not installed — MFA verification unavailable")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail="MFA verification unavailable",
+        )
+
+    logger.info("MFA verified for admin user %s", user_id)