fix(org): require admin 2FA before org-wide enforcement

[riderx]

Summary (AI generated)

• Added backend enforcement in `supabase/functions/_backend/public/organization/put.ts` to require admins to have 2FA enabled before enabling organization-wide 2FA via `enforcing_2fa`.
• Updated the organization security settings UI flow in `src/pages/settings/organization/Security.vue` to call the organization edge function for 2FA enforcement updates and surface a dedicated message when the new guard blocks the action.
• Added user-facing copy in `messages/en.json` for the new 2FA prerequisite error.

Motivation (AI generated)

Allowing organization-wide 2FA enforcement without self-2FA can create inconsistent security policy application and potential admin misuse. This patch enforces hierarchical security by validating the actor's security posture before applying the org policy.

Business Impact (AI generated)

• Prevents policy settings from being applied by admins who have not enabled 2FA, improving internal security posture.
• Reduces support risk from accidental lockouts and policy misuse.
• Improves trust in enforcement controls visible to organization members.

Test Plan (AI generated)

• Ran `bun lint` (passes after changes).
• Verify updating 2FA enforcement in org settings now fails with a clear error when actor 2FA is not enabled.
• Verify enabling/disabling 2FA enforcement succeeds once actor 2FA is enabled.

Generated with AI

[coderabbitai]

Warning

Rate limit exceeded

@riderx has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 28 minutes and 9 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

📥 Commits

Reviewing files that changed from the base of the PR and between 38ce641 and 96858a7.

📒 Files selected for processing (3)

• messages/en.json
• src/pages/settings/organization/Security.vue
• supabase/functions/_backend/public/organization/put.ts

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch riderx/2fa-admin-guard

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 96858a7707

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Use JWT-compatible endpoint for org 2FA toggle

This UI path now calls supabase.functions.invoke('organization', { method: 'PUT' ... }), but that endpoint is guarded by middlewareKey in supabase/functions/_backend/public/organization/index.ts (API-key auth), not JWT auth; dashboard sessions normally send a JWT and no capgkey, so the request is rejected as invalid_apikey before the 2FA prerequisite logic runs. In practice this makes organization 2FA enforcement changes fail for signed-in web users unless they manually provide an API key header.

Useful? React with 👍 / 👎.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud