Sloth-ninja closes an MFA gap in firm-template reversions

A firm-wide template rollback now gets the same extra identity check as other destructive admin actions.

securityworkflow

Sloth-ninja found one exception in the product's admin safeguards: an enrolled administrator could reverse a shared firm template without completing two-factor confirmation. That action can change access across a firm, so the exception mattered.

The rollback now pauses for a time-based one-time-password check when the administrator has enrolled in MFA, then completes the original action after verification. Teams that have not adopted MFA are not newly forced into it. The interface also keeps the rollback and retry in one flow, so an approved step-up does not require a second click or leave the template list in an odd state.

So what Firm administrators and legal-ops teams should care because template access changes now carry the same confirmation standard as comparable high-impact actions.

View this fork on GitHub →

Spotted something wrong? Or know the PR text has fresher detail than the writeup above?

Commits in this thread

1 commit from Sloth-ninja/JessicaOSS, oldest first. Source extracted verbatim from the harvested git log.

SHA Subject Author Date

64114ca6 MFA-gate the template admin-revert, aligning it with routes/admin.ts sloth-ninja 2026-08-05 ↗ GitHub

SHA	Subject	Author	Date
`64114ca6`	MFA-gate the template admin-revert, aligning it with routes/admin.ts	sloth-ninja	2026-08-05	↗ GitHub
commit body The independent review of #76 flagged the template admin-revert as the only admin mutation in the product not behind requireMfaIfEnrolled, unlike the WS9 firm-library revert the card is modelled on. That was a backend change, so it was deferred out of #76 into this follow-up. Backend: POST /tabular-templates/:id/admin-revert gains requireMfaIfEnrolled between requireAdmin and asyncHandler - the ordering all nine mutating routes in routes/admin.ts use. Route test asserts an enrolled-but-unverified admin gets 403 with code "mfa_verification_required" and never reaches the seam. Frontend: FirmTemplatesSection wraps the whole mutation in the page's existing useMfaGuardedAction, so it replays intact after a step-up; mfa-required is rethrown for the guard while other failures still surface inline. Card copy updated only after the behaviour was true. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

commit body

The independent review of #76 flagged the template admin-revert as the only
admin mutation in the product not behind requireMfaIfEnrolled, unlike the WS9
firm-library revert the card is modelled on. That was a backend change, so it
was deferred out of #76 into this follow-up.

Backend: POST /tabular-templates/:id/admin-revert gains requireMfaIfEnrolled
between requireAdmin and asyncHandler - the ordering all nine mutating routes
in routes/admin.ts use. Route test asserts an enrolled-but-unverified admin
gets 403 with code "mfa_verification_required" and never reaches the seam.

Frontend: FirmTemplatesSection wraps the whole mutation in the page's existing
useMfaGuardedAction, so it replays intact after a step-up; mfa-required is
rethrown for the guard while other failures still surface inline. Card copy
updated only after the behaviour was true.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Capture this thread into my fork

Download a single Markdown prompt that tells Claude how to port every commit above into your working tree — adapting paths and structure to match your repo. Run it via claude -p < capture-thread-1045.md from inside the repo you want the changes in.

⬇ Download capture-thread-1045.md