-- OPERATOR ACTION, NOT AN AUTOMATIC MIGRATION.
-- Run only after approving the user's requested temporary administrator MFA pause.
-- Scope: existing marketplace staff only, password login remains required.
-- Supabase factors, passwords, customer auth and memberships remain unchanged.
begin;
do $$
declare previous marketplace_private.admin_login_security;current_row marketplace_private.admin_login_security;
begin
 select * into previous from marketplace_private.admin_login_security where id for update;
 if not found then raise exception 'admin_login_policy_unavailable';end if;
 update marketplace_private.admin_login_security set paused_until=clock_timestamp()+interval '7 days',updated_at=clock_timestamp(),updated_by=null
 where id returning * into current_row;
 insert into marketplace_private.audit_log(actor,entity,record_id,operation,before_data,after_data)
 values(null,'admin_login_security','true','MFA_PAUSED',
  jsonb_build_object('paused_until',previous.paused_until,'updated_at',previous.updated_at),
  jsonb_build_object('paused_until',current_row.paused_until,'updated_at',current_row.updated_at,'days',7,'reason','user_requested_local_testing_temporary_pause','source','authorized_sql_operator'));
end$$;
commit;
select jsonb_build_object('mfa_required',paused_until is null or paused_until<=now(),'paused_until',paused_until,'updated_at',updated_at) as admin_login_security
from marketplace_private.admin_login_security where id;