feat: implement v3 feature roadmap (Phases 12-19)

Add enterprise authentication (OIDC/SAML SSO, TOTP MFA, API rate limiting,
tamper-evident audit chain), structured event bus with reliable delivery,
advanced deployment strategies (blue-green, canary analysis, promotion
automation, freeze windows), observability stack (tracing, SLO/SLI framework,
alerting rules engine, metric rollups), policy-as-code governance with
compliance export (CEF/LEEF/JSON), multi-cluster federation with geo-distributed
bundle replication, config-as-code export/import, GraphQL schema definitions,
and HA/production readiness tooling (leader election, health checks, DR runbooks).

977 tests, 0 failures.

Author: raffaelschneider

lib/sentinel_cp/accounts/totp.ex

@@ -0,0 +1,150 @@
+defmodule SentinelCp.Accounts.Totp do
+  @moduledoc """
+  TOTP multi-factor authentication context.
+  Handles enrollment, verification, recovery codes, and org enforcement policies.
+  """
+
+  import Ecto.Query, warn: false
+  alias SentinelCp.Repo
+  alias SentinelCp.Accounts.UserTotp
+
+  @doc """
+  Gets the TOTP configuration for a user.
+  Returns nil if MFA is not enrolled.
+  """
+  def get_user_totp(user_id) do
+    Repo.get_by(UserTotp, user_id: user_id)
+  end
+
+  @doc """
+  Creates a new TOTP enrollment for a user.
+  Returns the UserTotp with the secret and recovery codes.
+  The TOTP is not active until verified with a valid code.
+  """
+  def create_user_totp(user_id) do
+    %UserTotp{}
+    |> UserTotp.create_changeset(%{user_id: user_id})
+    |> Repo.insert()
+  end
+
+  @doc """
+  Verifies a TOTP code and activates MFA for the user.
+  Used during initial enrollment to confirm the user has the correct secret.
+  """
+  def verify_totp_enrollment(%UserTotp{} = totp, code) do
+    if valid_totp_code?(totp, code) do
+      totp
+      |> UserTotp.verify_changeset()
+      |> Repo.update()
+    else
+      {:error, :invalid_code}
+    end
+  end
+
+  @doc """
+  Validates a TOTP code during login.
+  Returns {:ok, totp} if valid, {:error, :invalid_code} otherwise.
+  """
+  def validate_totp(%UserTotp{} = totp, code) do
+    cond do
+      valid_totp_code?(totp, code) ->
+        {:ok, _} =
+          totp
+          |> UserTotp.touch_changeset()
+          |> Repo.update()
+
+        {:ok, totp}
+
+      valid_recovery_code?(totp, code) ->
+        {:ok, _} =
+          totp
+          |> UserTotp.use_recovery_code_changeset(code)
+          |> Repo.update()
+
+        {:ok, totp}
+
+      true ->
+        {:error, :invalid_code}
+    end
+  end
+
+  @doc """
+  Deletes the TOTP configuration for a user (disables MFA).
+  """
+  def delete_user_totp(%UserTotp{} = totp) do
+    Repo.delete(totp)
+  end
+
+  @doc """
+  Regenerates recovery codes for a user's TOTP.
+  """
+  def regenerate_recovery_codes(%UserTotp{} = totp) do
+    totp
+    |> UserTotp.regenerate_recovery_codes_changeset()
+    |> Repo.update()
+  end
+
+  @doc """
+  Checks if a user has MFA enabled (enrolled and verified).
+  """
+  def mfa_enabled?(user_id) do
+    case get_user_totp(user_id) do
+      %UserTotp{} = totp -> UserTotp.verified?(totp)
+      nil -> false
+    end
+  end
+
+  @doc """
+  Checks if a user needs to enroll in MFA based on org policy.
+  Returns `{:required, deadline}` if MFA is required but not enrolled,
+  `:ok` if MFA is not required or already enrolled.
+  """
+  def check_mfa_requirement(user, org) do
+    policy = org_mfa_policy(org)
+
+    case policy do
+      "optional" ->
+        :ok
+
+      "required" ->
+        if mfa_enabled?(user.id), do: :ok, else: {:required, mfa_deadline(org)}
+
+      "required_for_admins" ->
+        if user.role == "admin" and not mfa_enabled?(user.id) do
+          {:required, mfa_deadline(org)}
+        else
+          :ok
+        end
+
+      _ ->
+        :ok
+    end
+  end
+
+  defp valid_totp_code?(%UserTotp{secret: secret}, code) when is_binary(code) do
+    NimbleTOTP.valid?(secret, code)
+  end
+
+  defp valid_totp_code?(_, _), do: false
+
+  defp valid_recovery_code?(%UserTotp{recovery_codes: codes}, code) when is_binary(code) do
+    code in codes
+  end
+
+  defp valid_recovery_code?(_, _), do: false
+
+  defp org_mfa_policy(org) do
+    Map.get(org, :mfa_policy, "optional")
+  end
+
+  defp mfa_deadline(org) do
+    grace_days = Map.get(org, :mfa_grace_period_days, 14)
+    enforced_at = Map.get(org, :mfa_enforced_at)
+
+    if enforced_at do
+      DateTime.add(enforced_at, grace_days * 86_400, :second)
+    else
+      nil
+    end
+  end
+end

lib/sentinel_cp/accounts/user.ex

@@ -17,6 +17,12 @@ defmodule SentinelCp.Accounts.User do
     field :role, :string, default: "reader"
     field :confirmed_at, :utc_datetime
 
+    # SSO fields
+    field :sso_provider_type, :string
+    field :sso_provider_id, :binary_id
+    field :sso_subject, :string
+    field :sso_provisioned_at, :utc_datetime
+
     has_many :api_keys, SentinelCp.Accounts.ApiKey
     has_many :org_memberships, SentinelCp.Orgs.OrgMembership
 

lib/sentinel_cp/accounts/user_totp.ex

@@ -0,0 +1,83 @@
+defmodule SentinelCp.Accounts.UserTotp do
+  @moduledoc """
+  Schema for TOTP-based multi-factor authentication.
+  Stores the shared secret and recovery codes for each user.
+  """
+  use Ecto.Schema
+  import Ecto.Changeset
+
+  @primary_key {:id, :binary_id, autogenerate: true}
+  @foreign_key_type :binary_id
+
+  @recovery_code_count 10
+
+  schema "user_totps" do
+    field :secret, :binary
+    field :recovery_codes, {:array, :string}, default: []
+    field :verified_at, :utc_datetime
+    field :last_used_at, :utc_datetime
+
+    belongs_to :user, SentinelCp.Accounts.User
+
+    timestamps(type: :utc_datetime)
+  end
+
+  def create_changeset(totp, attrs) do
+    totp
+    |> cast(attrs, [:user_id])
+    |> validate_required([:user_id])
+    |> unique_constraint(:user_id)
+    |> put_secret()
+    |> put_recovery_codes()
+    |> foreign_key_constraint(:user_id)
+  end
+
+  def verify_changeset(totp) do
+    now = DateTime.utc_now() |> DateTime.truncate(:second)
+
+    totp
+    |> change(%{verified_at: now, last_used_at: now})
+  end
+
+  def touch_changeset(totp) do
+    now = DateTime.utc_now() |> DateTime.truncate(:second)
+    change(totp, %{last_used_at: now})
+  end
+
+  def use_recovery_code_changeset(totp, code) do
+    remaining = List.delete(totp.recovery_codes, code)
+    change(totp, %{recovery_codes: remaining})
+  end
+
+  def regenerate_recovery_codes_changeset(totp) do
+    change(totp, %{recovery_codes: generate_recovery_codes()})
+  end
+
+  def verified?(%__MODULE__{verified_at: nil}), do: false
+  def verified?(%__MODULE__{}), do: true
+
+  defp put_secret(changeset) do
+    if get_field(changeset, :secret) do
+      changeset
+    else
+      put_change(changeset, :secret, NimbleTOTP.secret())
+    end
+  end
+
+  defp put_recovery_codes(changeset) do
+    put_change(changeset, :recovery_codes, generate_recovery_codes())
+  end
+
+  defp generate_recovery_codes do
+    Enum.map(1..@recovery_code_count, fn _ ->
+      :crypto.strong_rand_bytes(5) |> Base.encode32(padding: false) |> String.downcase()
+    end)
+  end
+
+  @doc """
+  Generates an otpauth:// URI for QR code generation.
+  """
+  def otpauth_uri(%__MODULE__{secret: secret}, email) when is_binary(email) do
+    NimbleTOTP.otpauth_uri("SentinelCP:#{email}", secret, issuer: "SentinelCP")
+  end
+end

lib/sentinel_cp/analytics/metric_rollup.ex

@@ -0,0 +1,69 @@
+defmodule SentinelCp.Analytics.MetricRollup do
+  @moduledoc """
+  Schema for pre-aggregated metric rollups.
+
+  Rollups store hourly and daily aggregations of service metrics,
+  enabling fast queries over long time ranges without scanning raw data.
+
+  ## Periods
+  - `hourly` — one record per service per hour
+  - `daily` — one record per service per day
+  - `monthly` — one record per service per month
+  """
+  use Ecto.Schema
+  import Ecto.Changeset
+
+  @primary_key {:id, :binary_id, autogenerate: true}
+  @foreign_key_type :binary_id
+
+  @periods ~w(hourly daily monthly)
+
+  schema "metric_rollups" do
+    field :period, :string
+    field :period_start, :utc_datetime
+    field :request_count, :integer, default: 0
+    field :error_count, :integer, default: 0
+    field :latency_p50_ms, :integer
+    field :latency_p95_ms, :integer
+    field :latency_p99_ms, :integer
+    field :bandwidth_in_bytes, :integer, default: 0
+    field :bandwidth_out_bytes, :integer, default: 0
+    field :status_2xx, :integer, default: 0
+    field :status_3xx, :integer, default: 0
+    field :status_4xx, :integer, default: 0
+    field :status_5xx, :integer, default: 0
+
+    belongs_to :service, SentinelCp.Services.Service
+    belongs_to :project, SentinelCp.Projects.Project
+
+    timestamps(type: :utc_datetime)
+  end
+
+  def changeset(rollup, attrs) do
+    rollup
+    |> cast(attrs, [
+      :service_id,
+      :project_id,
+      :period,
+      :period_start,
+      :request_count,
+      :error_count,
+      :latency_p50_ms,
+      :latency_p95_ms,
+      :latency_p99_ms,
+      :bandwidth_in_bytes,
+      :bandwidth_out_bytes,
+      :status_2xx,
+      :status_3xx,
+      :status_4xx,
+      :status_5xx
+    ])
+    |> validate_required([:service_id, :project_id, :period, :period_start])
+    |> validate_inclusion(:period, @periods)
+    |> unique_constraint([:service_id, :period, :period_start])
+    |> foreign_key_constraint(:service_id)
+    |> foreign_key_constraint(:project_id)
+  end
+
+  def periods, do: @periods
+end