Ledger

WEB-032

Staff seeding: 9 local test accounts (<role>@zoen.test) with enrolled TOTP + verify (AAL2), db:reset guard against wiping real staff

← Ledger

donestatus · web-db

1✓ tests passed / failed

2.61Mtokens · 7 min

0evidence files

Evidence

From logs/evidence/WEB-032/. Click a thumbnail for the full image.

No evidence files in logs/evidence/WEB-032/.

Tests

pass signup closed, 9 roles at AAL2, reset guard · 20.8 s · raw log$ pnpm --filter @zoen/db test:int

Notes

2026-10-04 14:58 UTC · seed-staff.mjs: 9 local accounts <role>@zoen.test (password + enrolled/verified TOTP via the real MFA API; replaces irreproducible factors), staff + staff_roles upserted, credentials only in gitignored supabase/seeds/staff.local.json; --verify signs in each through password+TOTP → AAL2 + role. reset.mjs (pnpm db:reset) refuses when any non-@zoen.test account exists unless --force, then reseeds. Config fix: [auth.email] enable_signup must stay true (it is the email provider switch); sign-ups stay closed via [auth] enable_signup=false (tested). 7 integration tests (incl. role spike).