-- Operator rollback: restores strict MFA immediately, preserving all factors and history.
begin;
do $$
declare previous marketplace_private.admin_login_security;current_row marketplace_private.admin_login_security;
begin
 select * into previous from marketplace_private.admin_login_security where id for update;
 if not found then raise exception 'admin_login_policy_unavailable';end if;
 if previous.paused_until is null then return;end if;
 update marketplace_private.admin_login_security set paused_until=null,updated_at=clock_timestamp(),updated_by=null
 where id returning * into current_row;
 insert into marketplace_private.audit_log(actor,entity,record_id,operation,before_data,after_data)
 values(null,'admin_login_security','true','MFA_REQUIRED',
  jsonb_build_object('paused_until',previous.paused_until,'updated_at',previous.updated_at),
  jsonb_build_object('paused_until',null,'updated_at',current_row.updated_at,'reason','operator_restored_admin_mfa','source','authorized_sql_operator'));
end$$;
commit;