EMERGENCY_ACCESS_PROCEDURES.md
Especificación técnica desde la carpeta docs del proyecto
Emergency Access Procedures
System: Plataforma Astral Educational Management System
Site:Last Updated: September 1, 2025
Classification: CONFIDENTIAL - AUTHORIZED PERSONNEL ONLY
🚨 EMERGENCY ACCESS OVERVIEW
When the standard authentication system fails, emergency access procedures ensure continued system availability for critical operations. These procedures should only be used when normal authentication is completely unavailable.
🔑 EMERGENCY ADMIN ACCESS
Credentials (CONFIDENTIAL)
EMERGENCY ACCESS CREDENTIALS ARE STORED IN A SECURE VAULT
Contact system administrator for access during actual emergencies only
Access Conditions
The emergency bypass activates automatically when:
Technical Implementation
Located in src/lib/auth-prisma.ts at lines 27-40 and 82-94:
`typescript
// EMERGENCY BYPASS: Allow admin access when database is unavailable
if (
email.toLowerCase() === EMERGENCY_ADMIN_EMAIL &&
password === EMERGENCY_ADMIN_PASSWORD
) {
logger.warn("EMERGENCY BYPASS: Admin authentication without database", {
email,
});
return {
id: "emergency-admin-id",
email: EMERGENCY_ADMIN_EMAIL,
name: "Emergency Admin",
role: "ADMIN",
};
}`
🚨 WHEN TO USE EMERGENCY ACCESS
Authorized Use Cases
UNAUTHORIZED Use Cases
🔒 SECURITY CONSIDERATIONS
Logging and Monitoring
All emergency access usage is automatically logged:
`typescript
logger.warn("EMERGENCY BYPASS: Admin authentication without database", {
email,
});
logger.warn("DATABASE DOWN: Using emergency admin bypass", { email });`
Access Tracking
Post-Emergency Audit
After each emergency access event:
📋 EMERGENCY ACCESS PROCEDURES
Step 1: Verify Emergency Conditions (2 minutes)
Before using emergency access, confirm standard authentication is truly unavailable:
`bash
Test standard authentication endpoints
curl -s https://school.aramac.dev/api/auth/session
curl -I https://school.aramac.dev/login
Test database connectivity
npm run verify-supabase
Check system status
npx vercel ls | head -5
`If any of these work, emergency access is NOT authorized.
Step 2: Document Emergency Event (1 minute)
Create incident log entry:
`text
Timestamp: [Current UTC time]
Reporter: [Your name/role]
Issue: [Brief description of failure]
Impact: [Users/systems affected]
Emergency Access Initiated: YES
Authorization: [Manager name if available]`
Step 3: Access System (30 seconds)
- Email: [EMERGENCY ADMIN EMAIL]
- Password: [EMERGENCY ADMIN PASSWORD]
Step 4: Perform Only Critical Actions
Emergency access should be used ONLY for:
Step 5: Restore Normal Authentication
Work to restore standard authentication as quickly as possible:
`bash
Common restoration steps
npx vercel env ls | grep NEXTAUTH_URL
npx vercel --prod
npx convex dashboard # Create admin user manually
`Step 6: Document Resolution (5 minutes)
Update incident log:
`text
Resolution Time: [UTC timestamp]
Actions Taken: [List of emergency actions]
Normal Auth Restored: [YES/NO]
Follow-up Required: [Any pending actions]`
🛡️ SECURITY PROTOCOLS
Access Authorization Matrix
| Scenario | Authorization Required | Max Duration |
| ----------------------- | ------------------------- | ------------ |
| Complete system failure | None (emergency) | 24 hours |
| Database outage | IT Manager approval | 12 hours |
| Security incident | Security Officer approval | 6 hours |
| Maintenance window | Development Lead approval | 4 hours |
Mandatory Reporting
All emergency access must be reported within 24 hours to:
Password Rotation Policy
Emergency access password must be rotated:
🔧 TECHNICAL RECOVERY PROCEDURES
Database Connection Recovery
`bash
Check database status
npm run verify-supabase
Regenerate database client
npx prisma generate
Test connection
node -e "
const { PrismaClient } = require('@prisma/client');
const prisma = new PrismaClient();
prisma.\$queryRaw\
SELECT 1\.then(() => console.log('✅ DB Connected'))
.catch(e => console.log('❌ DB Error:', e.message))
.finally(() => prisma.\$disconnect());
"
`Authentication System Recovery
`bash
Verify environment variables
npx vercel env ls | grep -E "NEXTAUTH|DATABASE"
Check NEXTAUTH_URL matches domain
npx vercel env ls | grep NEXTAUTH_URL
Should show: https://school.aramac.dev
Force redeploy if needed
npx vercel --prod --force
`User Account Recovery
`bash
Recreate standard admin user
npm run create-admin
Create all test users
npm run create-all-test-users
Verify user creation
npm run verify-users
`🚨 INCIDENT ESCALATION
Level 1: Emergency Access Successful (0-30 minutes)
Level 2: Emergency Access Fails (30+ minutes)
Level 3: Security Incident (Any time)
📞 EMERGENCY CONTACTS
Primary Contacts (24/7)
Secondary Contacts (Business hours)
External Support
🔄 POST-INCIDENT PROCEDURES
Immediate (Within 1 hour)
Short-term (Within 24 hours)
Long-term (Within 1 week)
⚠️ IMPORTANT REMINDERS
DO's
DON'Ts
---
CONFIDENTIAL: This document contains sensitive security information.
Access restricted to: Authorized system administrators only.
Last emergency usage: [To be updated when used]
Next password rotation due: December 1, 2025
Archivo: EMERGENCY_ACCESS_PROCEDURES.md