[Auth] Implement ADR-0069 — enterprise authentication hardening (P1/P2/P3)

[os-zhuang]

Tracking issue for implementing ADR-0069: Enterprise authentication hardening (merged in #2275). Design is accepted-in-principle; no code yet — this issue tracks the phased build.

Parent: #2246 (first-run admin experience). Governing constraint: ADR-0049 — every setting ships with its runtime enforcement; no "false surface" toggles.

Each item = (setting → enforcement seam → mechanism). [native] = better-auth 1.6.x knob; [custom] = ObjectStack hook/middleware; [field] = new identity column.

P1 — security floor (first real customers)

• Password: breached-password reject [native] — enable haveibeenpwned plugin (password_reject_breached). Lowest-risk first PR / sample for the pattern. ✅ shipped in feat(plugin-auth): reject breached passwords via HIBP (ADR-0069 D1, P1) #2361 (the enforcement-wired pattern template).
• Password: complexity [custom] — password_require_complexity + password_min_classes, validated in before hooks on /sign-up/email, /reset-password, /change-password. ✅ shipped in feat(plugin-auth): password complexity policy (ADR-0069 D1, P1) #2368.
• Password: expiry + history [custom][field] — password_expiry_days (gate at session validation), password_history_count (reject reuse); fields sys_user.password_changed_at, sys_account.previous_password_hashes. ✅ history shipped in feat(plugin-auth): password history / no-reuse (ADR-0069 D1, P1) #2371 (no-reuse, password_history_count + sys_account.previous_password_hashes); expiry shipped in feat(auth): password expiry via the session-validation gate (ADR-0069 D1, P1) #2388 (the session-validation gate; REST surface).
• Account lockout [custom][field] — lockout_threshold + lockout_duration_minutes; fields sys_user.failed_login_count, locked_until; admin Unlock action + locked-accounts filter. ✅ shipped in feat(plugin-auth): account lockout + rate-limit tuning (ADR-0069 D2, P1) #2365 (locked-accounts list filter is a small follow-up).
• Rate-limit tuning [native] — enable/tune better-auth core rateLimit with stricter customRules for /sign-in|sign-up|reset; shared store for multi-node. ✅ shipped in feat(plugin-auth): account lockout + rate-limit tuning (ADR-0069 D2, P1) #2365 (multi-node shared store still TODO).
• Enforced MFA [custom][field] — mfa_required + mfa_grace_period_days; gate password-only sessions at session validation until TOTP enrolled+verified; field sys_user.mfa_required_at. ✅ shipped in feat(auth): enforced MFA via the session-validation gate (ADR-0069 D3, P1) #2390 (global mfa_required + grace, reusing the feat(auth): password expiry via the session-validation gate (ADR-0069 D1, P1) #2388 gate; per-org require_mfa + objectui enroll prompt = follow-ups [Auth] ADR-0069 remaining — session-validation gate (password expiry + enforced MFA), session controls, IP allowlist, OIDC/SAML #2375).

P2 — defense in depth

• Session controls [custom][field] — idle timeout, absolute max, concurrent cap; fields sys_session.last_activity_at, revoked_at, revoke_reason.
• IP allowlist [custom][field] — sys_organization.allowed_ip_ranges (+ optional per-user); Hono auth-route middleware before the better-auth handler.
• OIDC trust-list UI [native] — surface admin-managed OIDC providers (issuer/client/scopes/allowed domains) instead of env-only genericOAuth.

P3 — federation breadth

• SAML 2.0 — not in better-auth core; assess @better-auth/sso vs custom plugin. Do not ship a SAML settings surface before an enforcing impl (ADR-0049).
• Broader settings-driven social providers; per-org override UI polish.

Out of scope (separate issues/ADRs)

• SCIM / directory provisioning & bulk import (separate ADR — provisioning ≠ auth).
• Passkeys / WebAuthn.

Suggested first PR: haveibeenpwned (native, low-risk) as the enforcement-wired pattern template, then the [custom] items each with their hook + tests.

[os-zhuang]

P1 password-policy + anti-brute-force shipped (#2361 / #2365 / #2368 / #2371). Remaining ADR-0069 work (session-validation gate for password expiry + enforced MFA, plus P2/P3) consolidated into #2375.

[os-zhuang]

✅ ADR-0069 fully implemented — P1 / P2 / P3 all merged

Closing this tracker. Every (setting → enforcement seam → mechanism) triple is wired with real runtime enforcement (ADR-0049 — no false surfaces).

P1 — security floor

• Breached-password rejection (HIBP, native) — the enforcement-wired template.
• Password complexity (min character classes) — before-hook validator.
• Password history (no-reuse) + expiry (password_changed_at + auth-gate posture).
• Account lockout + rate-limit tuning (failed_login_count / locked_until, sign-in hooks, admin Unlock action + endpoint).
• Enforced MFA — per-org require_mfa + grace period, across all surfaces (rest-server enforceAuth, runtime enforceAuthGate), with an objectui remediation overlay (enroll TOTP) that makes it end-to-end usable.
• The shared session-validation gate (customSession → user.authGate; rest + dispatcher seams) reused by password expiry and enforced MFA.

P2 — defense in depth

• Session controls: idle timeout, absolute max lifetime, concurrent-session cap (revoke = expire-in-place).
• IP allowlist (CIDR, trust-proxy extraction, fail-open on undetermined IP).

P3 — federation

• OIDC trust list (Okta/Entra/Auth0) — register_sso_provider + bridge (UI already existed; verified, no duplicate built).
• SAML 2.0 via @better-auth/sso (feat(plugin-auth): SAML 2.0 SSO via @better-auth/sso (ADR-0069 P3) #2404) — corrected the stale "SAML out of core" premise; no custom plugin.

All shipped across stacked PRs, each with unit tests + build + live dogfood + CI green before merge.