Security Policies and Governance
The Security & Policies screen (/policies, implemented in src/app/policies/page.tsx) enables Administrators (ROLE_ADMIN) and Security Officers (ROLE_SECURITY_OFFICER) to establish operational governance guidelines and device fleet defense parameters.
These settings govern the strictness of compliance enforcement across patch signing pipelines, administrative sessions, and transactional communications.
1. Four-Eyes Governance and Solo Tenant Handling
The top section defines the separation of responsibilities for production promotion:
- Solo Organization (1 Member): Derogatory solo mode permitting self-approval, tracked in immutable audit logs.
- Team Organization (2+ Members): Strict enforcement of Maker-Checker (four-eyes principle). Patch authors cannot approve their own updates.
Governance Parameters
- Enforce Four-Eyes Rule (
enforceFourEyes):- When enabled, no user can approve or sign an OTA patch for which they are recorded as the author, regardless of their administrative rank.
- In multi-member organizations, this gate is mandatory for regulatory compliance with institutional banking compliance audits frameworks.
- Solo Tenant Automatic Detection (
isSoloTenant):- The system dynamically counts active accounts (
totalMembers). IftotalMembers == 1, an informational banner indicates that solo mode is operating on an explicit exception basis to prevent operational deadlocks.
- The system dynamically counts active accounts (
2. Multi-Factor Authentication (OTP 2FA) Configuration
Administrative access and critical signature operations are protected by a cryptographically strong One-Time Password (OTP) system:
| Parameter | Default Value | Description and Impact |
|---|---|---|
| OTP Validity Duration | 600 s (10 min) | Window granted to the operator to enter the 6-digit challenge code received via email. |
| Resend Cooldown | 60 s | Mandatory waiting interval before requesting a new challenge. Thwarts rate-limit exhaustion and SMTP flooding. |
| Maximum Attempts | 5 attempts | Permitted failed attempts before the active OTP is permanently invalidated and client IP throttling is triggered. |
| Token Length | 6 digits | Number of numeric characters generated using system-grade CSPRNG (SecureRandom). |
3. Session Inactivity Timeout (IdleTimer)
To protect unattended operator workstations from physical session hijacking, the web console incorporates an active inactivity sentry (IdleTimer):
- Inactivity Timeout: Configurable between 5 and 60 minutes (default: 15 minutes).
- Pre-lock Warning: An alert banner surfaces 60 seconds prior to expiration.
- Lock Action: Clears memory tokens, flushes client-side state, and redirects to the login screen with target URL preservation.
4. Enterprise SMTP Mail Gateway
Account onboarding invitations and 2FA verification codes are dispatched through the designated organizational SMTP infrastructure:
| Field | Example | Purpose |
|---|---|---|
| SMTP Host | smtp.sovereign-bank.com | Internal relay server or enterprise mail gateway |
| Port | 587 (STARTTLS) or 465 (SSL/TLS) | Encrypted submission port |
| Authentication | true | Requires dedicated service account credentials |
| Username | tkushpatch-noreply@enterprise.com | Service account identifier |
| Sender Identity (From) | TkushPatch Security <noreply@enterprise.com> | Display name and email appearing in message headers |
"Test SMTP Configuration" Action
Allows security operators to trigger an immediate diagnostic email dispatch (POST /api/admin/v1/security-policies/test-email) to verify end-to-end transport before enforcing strict 2FA requirements.
5. Mobile Anti-Repackaging Shield and Client Integrity
TkushPatch protects mobile fleets from malicious third-party tampering and application repackaging:
Official Release Certificate Fingerprints (SHA-256)
- Operators can register the official SHA-256 signing fingerprints of their Google Play Store and Apple App Store production binaries.
- The
tk_ota_pushclient SDK submits the local signature fingerprint during runtime patch checks (POST /api/v1/patches/check). - If a reported fingerprint does not match the approved organizational keystores, the server strictly denies patch delivery and logs a security event.
HMAC Pre-Signed URL Expiration
- Direct downloads of
.vmcodebinary differential archives are authenticated via time-bound HMAC signatures generated byHmacUrlSignerAdapter. - The validity window is configurable (default: 300 seconds), preventing unauthenticated hotlinking or historical token reuse.