feat(demo): harden hosted demo against egress + identity mutations

src/app/(dashboard)/layout.tsx

@@ -92,8 +92,10 @@ export default function DashboardLayout({
   }, [me?.mustChangePassword]);
 
   // Redirect to dedicated 2FA setup page if required but not enabled
-  // Guard: wait for password change to complete first
+  // Guard: wait for password change to complete first.
+  // Skipped in demo mode — the seeded shared account does not enroll TOTP.
   useEffect(() => {
+    if (isDemoMode()) return;
     if (me && !me.mustChangePassword && me.twoFactorRequired && !me.totpEnabled && me.authMethod !== "OIDC") {
       router.push("/setup-2fa");
     }

src/auth.ts

@@ -11,6 +11,7 @@ import { writeAuditLog } from "@/server/services/audit";
 import { debugLog, infoLog, warnLog } from "@/lib/logger";
 import { headers } from "next/headers";
 import { env, isBuildPhase } from "@/lib/env";
+import { isDemoMode } from "@/lib/is-demo-mode";
 import {
   loginAttemptTracker,
   getRemainingLockSeconds,
@@ -151,8 +152,9 @@ const credentialsProvider = Credentials({
       return null;
     }
 
-    // TOTP 2FA check
-    if (user.totpEnabled && user.totpSecret) {
+    // TOTP 2FA check (bypassed in hosted demo mode so visitors can sign in
+    // with the seeded shared account regardless of its TOTP state).
+    if (!isDemoMode() && user.totpEnabled && user.totpSecret) {
       const raw = credentials.totpCode as string | undefined;
       const totpCode = raw && raw !== "undefined" ? raw.trim() : undefined;
 

src/server/routers/__tests__/admin.test.ts

@@ -17,6 +17,7 @@ vi.mock("@/trpc/init", () => {
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
     requireSuperAdmin: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/ai.test.ts

@@ -17,6 +17,7 @@ vi.mock("@/trpc/init", () => {
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
     requireSuperAdmin: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/alert-channels.test.ts

@@ -22,6 +22,7 @@ vi.mock("@/trpc/init", () => {
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
     requireSuperAdmin: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/alert-deliveries.test.ts

@@ -31,6 +31,7 @@ vi.mock("@/trpc/init", () => {
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
     requireSuperAdmin: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/alert-events.test.ts

@@ -17,6 +17,7 @@ vi.mock("@/trpc/init", () => {
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
     requireSuperAdmin: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/alert-retry-delivery.test.ts

@@ -35,6 +35,7 @@ vi.mock("@/trpc/init", () => {
     router: t.router,
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/alert-rules.test.ts

@@ -20,6 +20,7 @@ vi.mock("@/trpc/init", () => {
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
     requireSuperAdmin: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/alert-webhooks.test.ts

@@ -21,6 +21,7 @@ vi.mock("@/trpc/init", () => {
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
     requireSuperAdmin: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/audit-deployments.test.ts

@@ -19,6 +19,7 @@ vi.mock("@/trpc/init", () => {
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
     requireSuperAdmin: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/audit-export.test.ts

@@ -19,6 +19,7 @@ vi.mock("@/trpc/init", () => {
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
     requireSuperAdmin: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/audit.test.ts

@@ -23,6 +23,7 @@ vi.mock("@/trpc/init", () => {
     router: t.router,
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/certificate.test.ts

@@ -17,6 +17,7 @@ vi.mock("@/trpc/init", () => {
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
     requireSuperAdmin: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/dashboard.test.ts

@@ -23,6 +23,7 @@ vi.mock("@/trpc/init", () => {
     router: t.router,
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/deploy.test.ts

@@ -19,6 +19,7 @@ vi.mock("@/trpc/init", () => {
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
     requireSuperAdmin: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/environment.test.ts

@@ -19,6 +19,7 @@ vi.mock("@/trpc/init", () => {
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
     requireSuperAdmin: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/filter-preset.test.ts

@@ -16,6 +16,7 @@ vi.mock("@/trpc/init", () => {
     router: t.router,
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/fleet-list.test.ts

@@ -16,6 +16,7 @@ vi.mock("@/trpc/init", () => {
     router: t.router,
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/fleet-matrix-summary-scale.test.ts

@@ -16,6 +16,7 @@ vi.mock("@/trpc/init", () => {
     router: t.router,
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/fleet-matrix-summary.test.ts

@@ -16,6 +16,7 @@ vi.mock("@/trpc/init", () => {
     router: t.router,
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/fleet.test.ts

@@ -28,6 +28,7 @@ vi.mock("@/trpc/init", () => {
     router: t.router,
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/git-sync.test.ts

@@ -19,6 +19,7 @@ vi.mock("@/trpc/init", () => {
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
     requireSuperAdmin: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/metrics.test.ts

@@ -24,6 +24,7 @@ vi.mock("@/trpc/init", () => {
     router: t.router,
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/migration-start-translation.test.ts

@@ -19,6 +19,7 @@ vi.mock("@/trpc/init", () => {
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
     requireSuperAdmin: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/migration.test.ts

@@ -19,6 +19,7 @@ vi.mock("@/trpc/init", () => {
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
     requireSuperAdmin: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/node-group.test.ts

@@ -18,6 +18,7 @@ vi.mock("@/trpc/init", () => {
     router: t.router,
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/pipeline-batch-import.test.ts

@@ -17,6 +17,7 @@ vi.mock("@/trpc/init", () => {
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
     requireSuperAdmin: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/pipeline-bulk-tags.test.ts

@@ -19,6 +19,7 @@ vi.mock("@/trpc/init", () => {
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
     requireSuperAdmin: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/pipeline-bulk.test.ts

@@ -23,6 +23,7 @@ vi.mock("@/trpc/init", () => {
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
     requireSuperAdmin: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/pipeline-crud.test.ts

@@ -17,6 +17,7 @@ vi.mock("@/trpc/init", () => {
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
     requireSuperAdmin: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/pipeline-dependency.test.ts

@@ -19,6 +19,7 @@ vi.mock("@/trpc/init", () => {
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
     requireSuperAdmin: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/pipeline-deploy.test.ts

@@ -27,6 +27,7 @@ vi.mock("@/trpc/init", () => {
     router: t.router,
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/pipeline-get-n1.test.ts

@@ -19,6 +19,7 @@ vi.mock("@/trpc/init", () => {
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
     requireSuperAdmin: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/pipeline-graph.test.ts

@@ -17,6 +17,7 @@ vi.mock("@/trpc/init", () => {
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
     requireSuperAdmin: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/pipeline-group.test.ts

@@ -19,6 +19,7 @@ vi.mock("@/trpc/init", () => {
     router: t.router,
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/pipeline-observability-tap.test.ts

@@ -15,6 +15,7 @@ vi.mock("@/trpc/init", () => {
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
     requireSuperAdmin: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/pipeline-observability.test.ts

@@ -17,6 +17,7 @@ vi.mock("@/trpc/init", () => {
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
     requireSuperAdmin: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/pipeline-versions.test.ts

@@ -17,6 +17,7 @@ vi.mock("@/trpc/init", () => {
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
     requireSuperAdmin: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/promotion.test.ts

@@ -19,6 +19,7 @@ vi.mock("@/trpc/init", () => {
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
     requireSuperAdmin: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/secret.test.ts

@@ -19,6 +19,7 @@ vi.mock("@/trpc/init", () => {
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
     requireSuperAdmin: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/service-account.test.ts

@@ -19,6 +19,7 @@ vi.mock("@/trpc/init", () => {
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
     requireSuperAdmin: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/settings.test.ts

@@ -17,6 +17,7 @@ vi.mock("@/trpc/init", () => {
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
     requireSuperAdmin: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/shared-component.test.ts

@@ -17,6 +17,7 @@ vi.mock("@/trpc/init", () => {
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
     requireSuperAdmin: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/staged-rollout.test.ts

@@ -17,6 +17,7 @@ vi.mock("@/trpc/init", () => {
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
     requireSuperAdmin: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/team.test.ts

@@ -19,6 +19,7 @@ vi.mock("@/trpc/init", () => {
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
     requireSuperAdmin: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/telemetry.test.ts

@@ -21,6 +21,7 @@ vi.mock("@/trpc/init", () => {
     router: t.router,
     protectedProcedure: t.procedure,
     requireSuperAdmin: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });

src/server/routers/__tests__/template.test.ts

@@ -17,6 +17,7 @@ vi.mock("@/trpc/init", () => {
     protectedProcedure: t.procedure,
     withTeamAccess: passthrough,
     requireSuperAdmin: passthrough,
+    denyInDemo: passthrough,
     middleware: t.middleware,
   };
 });