admin / Synapse-Sonar

import { redirect } from "next/navigation";
import { getServerSession } from "next-auth";
import { authOptions } from "@/lib/authOptions";
import { prisma } from "@/lib/prisma";
import Logo from "@/components/Logo";
import MfaEnrollment from "@/components/MfaEnrollment";
import SignOutButton from "@/components/SignOutButton";

export const dynamic = "force-dynamic";

/**
 * Mandatory MFA enrollment gate. Reached when a Tenant Admin has turned on the
 * org-wide MFA policy and this user hasn't enrolled yet. Renders outside the app
 * shell (no nav) so the only ways out are: enroll, or sign out.
 */
export default async function MfaRequiredPage() {
  const session = await getServerSession(authOptions);
  if (!session?.user?.id) redirect("/login");

  const me = await prisma.user.findUnique({
    where: { id: session.user.id },
    select: { mfaEnabled: true, tenant: { select: { mfaRequired: true } } },
  });

  // If the policy is off, or the user already enrolled, there's nothing to gate.
  if (!me?.tenant?.mfaRequired || me.mfaEnabled) redirect("/");

  return (
    <div className="flex min-h-screen items-center justify-center bg-[#05080f] px-4">
      <div className="w-full max-w-md rounded-2xl border border-slate-700/60 bg-gradient-to-b from-[#1e293b] to-[#0f172a] p-8 shadow-2xl">
        <div className="flex justify-center">
          <Logo variant="full" className="h-24 drop-shadow-[0_0_24px_rgba(59,130,246,0.35)]" />
        </div>
        <h1 className="mt-6 text-center text-xl font-semibold text-slate-100">
          MFA is required
        </h1>
        <p className="mt-1 text-center text-sm text-slate-400">
          Your administrator requires multi-factor authentication. Set it up now
          to continue.
        </p>

        <div className="mt-6">
          <MfaEnrollment continueHref="/" />
        </div>

        <div className="mt-6 border-t border-slate-700/60 pt-4 text-center">
          <SignOutButton />
        </div>
      </div>
    </div>
  );
}