medplum / medplum / 24538926374

92%

main: 92%

push

github

Add admin endpoint to reset user MFA enrollment (#8970)

* Add admin endpoint to reset user MFA enrollment

Adds POST /admin/projects/:projectId/members/:membershipId/mfa/reset
so project admins can reset MFA for users who have lost access to their
authenticator device. Rotates the TOTP secret and sends the user an
email notification. Uses systemRepo to bypass the access policy that
makes mfaEnrolled readonly for normal writes.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Ian Plunkett <1857868+ianplunkett@users.noreply.github.com>

* Fix MFA reset test: use correct invite response shape

The invite endpoint returns the ProjectMembership resource directly,
not a { membership, user } wrapper. Update tests to read membershipId
from inviteRes.body.id and fetch the User via systemRepo using the
reference from inviteRes.body.user.reference.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Ian Plunkett <1857868+ianplunkett@users.noreply.github.com>

* Fix remaining MFA reset test assertions

- Cross-project access returns 404 (repo is project-scoped, not 403)
- Non-admin test now uses addTestUser to create a real non-admin member
  within the same project, rather than an admin of a different project

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Ian Plunkett <1857868+ianplunkett@users.noreply.github.com>

---------

Signed-off-by: Ian Plunkett <1857868+ianplunkett@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Karl Pietrzak <karl@medplum.com>

18356 of 20905 branches covered (87.81%)

Branch coverage included in aggregate %.

14 of 16 new or added lines in 1 file covered. (87.5%)

33271 of 35292 relevant lines covered (94.27%)

13446.05 hits per line