@aglyn/plugins-redirects 1.0.0-beta.143

package/src/lib/components/redirects-console-page.js

@@ -0,0 +1,833 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ 'use client';
+import { _ as _extends } from "@swc/helpers/_/_extends";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { checkQuota, pluginDocsHelp } from "@aglyn/aglyn";
+import { isExternalRedirectDestination, isSelfRedirect, matchRedirect, normalizeRedirectDestination, normalizeRedirectSource, REDIRECT_DEFAULT_PRIORITY, validateRedirectRule, REDIRECT_STATUS_CODES } from "../model/index.js";
+import { CardDisplay, useConfirmationContext } from "@aglyn/shared-ui-jsx";
+import { authorizedFetch } from "@aglyn/shared-util-http/authorized-token";
+import QuotaReadoutComponent from "@aglyn/shared-ui-jsx/components/quota-readout.component";
+import { useSnackbar } from "@aglyn/shared-ui-snackstack";
+import { Timestamp } from "@aglyn/shared-util-timestamp";
+import { Alert, Button, Chip, Dialog, DialogActions, DialogContent, DialogTitle, MenuItem, Stack, Switch, TextField, Typography } from "@mui/material";
+import { collection, deleteField, doc, getCountFromServer, getDoc, setDoc, updateDoc } from "firebase/firestore";
+import { useCallback, useEffect, useMemo, useState } from "react";
+import { ListPagination } from "@aglyn/shared-ui-jsx/components/list-pagination.component";
+import { TABLE_PAGE_SIZE_DEFAULT } from "@aglyn/shared-ui-jsx/const/table-pagination";
+import { ceilingedWindow, collectionCeiling, useFirestore, useFirestoreCollection, useFirestoreDoc, useHostResourceApi, useUser, writeGuardedBySeed } from "@aglyn/tenant-feature-instance";
+/**
+ * How many redirect documents this page reads.
+ *
+ * A CEILING, not a page size. Everything the page decides is computed over
+ * the WHOLE rule set: the duplicate-source check, the chain-loop walk that
+ * follows internal destinations through the rules, and the inline tester that
+ * runs the enforcement matcher. A server page would give each of them a
+ * tenth of the rules to reason about, and the duplicate check would then
+ * create exactly the collision it exists to prevent.
+ */ const REDIRECT_CEILING = 200;
+/**
+ * Redirect manager (AGL-156): CRUD over `hosts/{hostId}/redirects` with
+ * the shared AGL-154 validation (normalized sources, https-or-internal
+ * destinations, self-redirect refusal, duplicate-source check). Paid
+ * (`redirects` flag + `redirectsPerHost` quota); rules take effect on the
+ * site within ~30 seconds (AGL-155 ISR window).
+ *
+ * The plan gate is the SHELL's, and it runs before this component exists
+ * (AGL-2484): the console resolves `redirects` from the org billing doc and
+ * renders its own refusal notice in place of the surface, so this card is
+ * only ever mounted for an entitled org and states no plan terms of its own.
+ * Redirects registers no `upgradeNotice` override because it is a genuine
+ * upgrade — free denies it, Starter and above grant it — which makes the
+ * shell's plan-derived sentence the accurate one already.
+ *
+ * `entitled` is still read below, where it is not redundant: it holds back
+ * the thirty analytics day-doc reads behind the hit counts, and refuses the
+ * add path ahead of the server that enforces it.
+ */ export function RedirectsConsolePage(props) {
+    var _ref, _ref1, _ref2, _ref3, _ref4, _ref5;
+    const { hostId, entitled, org } = props;
+    const firestore = useFirestore();
+    const createHostResource = useHostResourceApi();
+    const { data: currentUser } = useUser();
+    const { enqueueSnackbar } = useSnackbar();
+    const { confirm } = useConfirmationContext();
+    const { data: redirectDocs, status: redirectsStatus, /**
+     * The rows this editor is seeded from are unconfirmed by the server
+     * (AGL-1358). Editing copies every field the form owns out of the stored
+     * rule and writes all of them back, so `merge: true` protects only the
+     * fields written elsewhere (`lastHitAt`, `deletedAt`). This is the site
+     * where a rollback is hardest to undo: a reverted `destination` on a
+     * **301** is cached by every browser that has already followed it, so the
+     * stale target outlives the fix in the console. `kind` reverting from
+     * exact to prefix silently widens a rule over a whole subtree, and
+     * `priority` reorders which rule fires when several match.
+     */ fromCache: redirectsFromCache } = useFirestoreCollection(/*
+     * ORDERED AND CEILINGED, with a probe (AGL-2501).
+     *
+     * `limit(200)` alone is answered in DOCUMENT-ID order and the ids are
+     * generated, so the window was a pseudo-random two hundred of the site's
+     * rules — sorted by `source` in the browser afterwards, which is what
+     * made it invisible: the rules on screen run alphabetically and are
+     * simply the wrong rules, and the ones missing leave no gap to notice.
+     *
+     * `orderBy('source')` is the tempting fix and the dangerous one. It
+     * matches only documents that HAVE the field, and nothing validates
+     * `source` for presence — `/api/hosts/resources` stores an allow-list of
+     * fields and checks none of them — so a rule saved without one would
+     * vanish from this page while still redirecting live traffic. The
+     * document NAME cannot be absent, so the walk is total: every rule is
+     * reachable, and the alphabetical order stays where it belongs, in the
+     * sort below over a window the page holds whole.
+     */ ()=>collectionCeiling(collection(firestore, 'hosts', hostId, 'redirects'), REDIRECT_CEILING), [
+        firestore,
+        hostId
+    ], {
+        idField: '$id'
+    });
+    const { rows: readRedirects, truncated: redirectsTruncated } = ceilingedWindow(redirectDocs, REDIRECT_CEILING);
+    const redirects = [
+        ...readRedirects
+    ].filter((redirect)=>!redirect.deletedAt).sort((a, b)=>{
+        var _a_source, _b_source;
+        return String((_a_source = a.source) != null ? _a_source : '').localeCompare(String((_b_source = b.source) != null ? _b_source : ''));
+    });
+    /*
+   * The page is a SLICE of the ceiling, which is what the three whole-set
+   * consumers above require. The count is the rules this page HOLDS, after
+   * soft-deleted ones are dropped — not the quota, which is a server count of
+   * every document including the soft-deleted, and is read separately below.
+   */ const [page, setPage] = useState(0);
+    const [pageSize, setPageSize] = useState(TABLE_PAGE_SIZE_DEFAULT);
+    const visibleRedirects = useMemo(()=>redirects.slice(page * pageSize, page * pageSize + pageSize), // eslint-disable-next-line react-hooks/exhaustive-deps
+    [
+        redirectDocs,
+        page,
+        pageSize
+    ]);
+    /**
+   * What the ENFORCING route counts, which is not what this page was counting.
+   *
+   * `hosts/{id}/redirects` is read here as an unordered `limit(200)` window
+   * and then filtered to drop soft-deleted rows, and that filtered length was
+   * feeding both `checkQuota('redirectsPerHost')` and the readout beside it.
+   * The route in `app/api/hosts/resources` counts the collection plainly —
+   * `collectionRef.count()`, every document, soft-deleted ones included — so
+   * the two disagreed on both counts at once: a rule deleted in this console
+   * still occupies a slot on the server, and a site past 200 rules has rows
+   * the window never saw.
+   *
+   * The visible effect is the worst kind: the page shows room, the author
+   * fills in the form, and the save is refused by a server counting something
+   * else. Same shape as AGL-1716.
+   *
+   * An aggregation query, so it costs one read unit per thousand documents
+   * rather than reading them. Re-run when the document set changes, which
+   * covers an add; a soft delete leaves the document in place and so does not
+   * move this number — correctly, because it does not move the server's
+   * either.
+   *
+   * Only the COUNT is corrected here. Whether a soft-deleted rule should go on
+   * occupying a slot is the quota RULE, and that lives with the enforcing
+   * route.
+   */ const [enforcedCount, setEnforcedCount] = useState(null);
+    const redirectDocCount = (_ref = redirectDocs == null ? void 0 : redirectDocs.length) != null ? _ref : 0;
+    /**
+   * `null` when the count cannot be taken, never a number.
+   *
+   * `try`, not `.catch()`: `getCountFromServer` validates its reference and
+   * THROWS synchronously on a bad one, so a rejection handler alone leaves the
+   * error to escape the effect and take the page down with it. Unreadable is
+   * also not zero — answering zero would tell an author at their cap that the
+   * whole allowance is free.
+   */ const countRedirects = useCallback(async ()=>{
+        try {
+            const snapshot = await getCountFromServer(collection(firestore, 'hosts', hostId, 'redirects'));
+            return snapshot.data().count;
+        } catch (unused) {
+            return null;
+        }
+    }, [
+        firestore,
+        hostId
+    ]);
+    useEffect(()=>{
+        let active = true;
+        void countRedirects().then((count)=>{
+            if (active && count != null) setEnforcedCount(count);
+        });
+        return ()=>{
+            active = false;
+        };
+    }, [
+        countRedirects,
+        redirectDocCount
+    ]);
+    const [draft, setDraft] = useState(null);
+    const [testPath, setTestPath] = useState('');
+    // Host routing map for the screen-collision warning (AGL-156 spec).
+    const { data: host } = useFirestoreDoc(()=>doc(firestore, 'hosts', hostId), [
+        firestore,
+        hostId
+    ], {
+        idField: '$id'
+    });
+    // Sampled hit counts (AGL-157): summed from the last 30 analytics day
+    // docs' `redirects` maps written by enforcement. Counts are sampled —
+    // one per ISR revalidation window with traffic, not per request.
+    const [hits, setHits] = useState(null);
+    useEffect(()=>{
+        if (!entitled) return;
+        let active = true;
+        const ids = Array.from({
+            length: 30
+        }, (_, index)=>{
+            const date = new Date();
+            date.setDate(date.getDate() - index);
+            return date.toISOString().slice(0, 10);
+        });
+        void Promise.all(ids.map((id)=>getDoc(doc(firestore, 'hosts', hostId, 'analytics', id)).then((snapshot)=>{
+                var _snapshot_get;
+                return (_snapshot_get = snapshot.get('redirects')) != null ? _snapshot_get : {};
+            }).catch(()=>({})))).then((days)=>{
+            if (!active) return;
+            const totals = {};
+            for (const dayMap of days){
+                for (const [redirectId, count] of Object.entries(dayMap)){
+                    var _totals_redirectId;
+                    totals[redirectId] = ((_totals_redirectId = totals[redirectId]) != null ? _totals_redirectId : 0) + Number(count);
+                }
+            }
+            setHits(totals);
+        });
+        return ()=>{
+            active = false;
+        };
+    }, [
+        entitled,
+        firestore,
+        hostId
+    ]);
+    const idKey = (value)=>value.replace(/[.$#[\]/]/g, '_');
+    const totalHits = Object.values(hits != null ? hits : {}).reduce((sum, count)=>sum + count, 0);
+    const handleAdd = useCallback(()=>{
+        if (!entitled) {
+            return void enqueueSnackbar('URL redirects require a Starter plan — see Billing to upgrade', {
+                variant: 'warning',
+                persist: false
+            });
+        }
+        /*
+     * The SERVER's count, not the rows on screen — the whole point of this
+     * fix. Read from the polled value rather than re-counted on the click:
+     * this gate is a courtesy that spares the author a form they are about to
+     * be refused, the route is the actual enforcer, and making the button
+     * await an aggregation would delay the dialog on every press to sharpen a
+     * number the server re-checks anyway.
+     *
+     * `null` means the count could not be read, and that lets the add through:
+     * refusing on a number we do not have would block an author who may well
+     * be inside their cap.
+     */ const quota = checkQuota(org, 'redirectsPerHost', enforcedCount != null ? enforcedCount : 0);
+        if (!quota.allowed) {
+            return void enqueueSnackbar(`Redirect limit reached (${quota.limit}) — upgrade in Billing`, {
+                variant: 'warning',
+                persist: false
+            });
+        }
+        setDraft({
+            id: null,
+            source: '',
+            destination: '',
+            statusCode: 302,
+            kind: 'exact',
+            priority: REDIRECT_DEFAULT_PRIORITY,
+            // A NEW rule is on: the author is adding it to make it fire, and
+            // enforcement queries `where('enabled', '==', true)`, so a rule created
+            // without the field would never resolve (AGL-1372).
+            enabled: true
+        });
+    }, [
+        entitled,
+        org,
+        enforcedCount,
+        enqueueSnackbar
+    ]);
+    /**
+   * Tell the tenant a rule changed (best effort, never awaited into the save
+   * outcome). Rule writes are client Firestore writes with no publish step,
+   * and the tenant's rules list sits behind the hour-long
+   * `tenant-data:{hostId}` backstop — without this call a new rule waits out
+   * that TTL while the snackbar above promises ~30 seconds. The route busts
+   * the host tag and drops the source path's cached HTML; a regex pattern has
+   * no single literal path, so it announces `/` for the tag bust alone and
+   * the matching pages catch up on their own ISR window.
+   */ const announceRuleChange = useCallback((source)=>{
+        const redirectPath = typeof source === 'string' && source.startsWith('/') ? source : '/';
+        void authorizedFetch(currentUser, '/api/screens/revalidate', {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json'
+            },
+            body: JSON.stringify({
+                hostId,
+                redirectPath
+            })
+        }).catch(()=>undefined);
+    }, [
+        currentUser,
+        hostId
+    ]);
+    const handleSave = useCallback(async ()=>{
+        var _ref, _ref1;
+        if (!draft) return;
+        const kind = draft.kind || 'exact';
+        // Shared v2 validation (AGL-375): regex patterns must compile; path
+        // kinds keep the v1 normalization.
+        const problem = validateRedirectRule({
+            kind,
+            source: draft.source,
+            destination: draft.destination
+        });
+        if (problem) {
+            return void enqueueSnackbar(problem, {
+                variant: 'warning',
+                persist: false
+            });
+        }
+        const source = kind === 'regex' ? draft.source.trim() : normalizeRedirectSource(draft.source);
+        const destination = normalizeRedirectDestination(draft.destination);
+        if (kind !== 'regex' && isSelfRedirect({
+            source,
+            destination
+        })) {
+            return void enqueueSnackbar('That would redirect the path to itself', {
+                variant: 'warning',
+                persist: false
+            });
+        }
+        const duplicate = redirects.find((redirect)=>{
+            var _redirect_kind;
+            return redirect.source === source && ((_redirect_kind = redirect.kind) != null ? _redirect_kind : 'exact') === kind && redirect.$id !== draft.id;
+        });
+        if (duplicate) {
+            return void enqueueSnackbar(`A rule for ${source} already exists`, {
+                variant: 'warning',
+                persist: false
+            });
+        }
+        // Chain-loop detection (AGL-156): follow internal destinations through
+        // the rule set; a walk that returns to this source can never execute.
+        if (destination.startsWith('/')) {
+            const bySource = new Map(redirects.filter((redirect)=>redirect.$id !== draft.id).map((redirect)=>[
+                    redirect.source,
+                    redirect.destination
+                ]));
+            let cursor = destination.toLowerCase();
+            for(let hop = 0; hop < 10 && cursor; hop += 1){
+                if (cursor === source) {
+                    return void enqueueSnackbar('That destination chains back to this rule — a redirect loop', {
+                        variant: 'warning',
+                        persist: false
+                    });
+                }
+                const next = bySource.get(cursor);
+                cursor = next && next.startsWith('/') ? next.toLowerCase() : undefined;
+            }
+        }
+        // Screen-route collision: shadowing a live page may be intentional
+        // (moved pages) — warn, don't block (decision per the issue).
+        const routedPaths = Object.values((_ref = host == null ? void 0 : host.screens) != null ? _ref : {}).map((path)=>path === '/' ? '/' : `/${path}`);
+        if (routedPaths.includes(source)) {
+            enqueueSnackbar(`${source} is a published page — the redirect takes precedence`, {
+                variant: 'info',
+                persist: false
+            });
+        }
+        const fields = {
+            source,
+            destination,
+            statusCode: REDIRECT_STATUS_CODES.includes(draft.statusCode) ? draft.statusCode : 302,
+            kind,
+            priority: Number.isFinite(Number(draft.priority)) ? Number(draft.priority) : REDIRECT_DEFAULT_PRIORITY,
+            /**
+       * Whatever the rule already was (AGL-1372). This was `true`, so editing
+       * a **disabled** rule's target silently re-enabled it — a deliberate
+       * "off" (a retired campaign, a rule that broke something) undone by a
+       * routine save, changing site routing without the author asking.
+       *
+       * `!== false` rather than the raw value, because the switch below reads
+       * the stored field the same way: absent means on. Enforcement's query is
+       * `where('enabled', '==', true)`, so a rule missing the field is not
+       * served, and normalising it here makes the console's claim true.
+       *
+       * The create default lives in `handleAdd` — a new rule seeds the draft
+       * `true`, so both defaults hold without either one reading the other.
+       */ enabled: draft.enabled !== false
+        };
+        /**
+     * The publisher's stamp on an external destination (AGL-1881).
+     *
+     * `matchRedirect` will not send traffic off the platform without it, and
+     * `cloud/firebase-firestore.rules` admits no write to this collection from
+     * anyone but `canPublishHostContent` — so reaching this line at all is the
+     * approval, and saving is how a rule written before that fix starts firing
+     * again.
+     *
+     * Written on EDIT only. A create rides /api/hosts/resources, which stamps
+     * the same field from the id token's verified uid; sending it from here
+     * would be the client supplying its own provenance, and that route drops
+     * it for exactly that reason.
+     *
+     * Cleared with `deleteField()` when the destination is internal, rather
+     * than left standing. `merge: true` never removes a key, so an edit from
+     * `https://elsewhere.example` back to `/pricing` would otherwise leave a
+     * stamp behind that a LATER edit back to an external target would inherit
+     * — approval carried across a destination nobody approved.
+     */ const approval = isExternalRedirectDestination(destination) ? {
+            externalDestinationApprovedBy: (_ref1 = currentUser == null ? void 0 : currentUser.uid) != null ? _ref1 : null
+        } : {
+            externalDestinationApprovedBy: deleteField()
+        };
+        try {
+            if (draft.id) {
+                /**
+         * Edit stays client-direct (no quota consumed) — and is refused when
+         * its seed was never confirmed by the server (AGL-1358); the eight
+         * validation refusals above have all already returned by here.
+         *
+         * `merge: true` is load-bearing, contrary to what this said before
+         * (AGL-1372): `fields` is every key the FORM owns, not every key the
+         * document holds. `lastHitAt` is written by enforcement
+         * (`resolve-redirect`), and `deletedAt` by the delete below — a
+         * replacing write would erase both.
+         *
+         * The guard WRAPS the write. An early return is a shape you can keep
+         * while losing the protection; here the write is only reachable
+         * through the verdict.
+         */ const verdict = await writeGuardedBySeed({
+                    subject: 'redirect',
+                    unreadable: redirectsStatus === 'error',
+                    fromCache: redirectsFromCache
+                }, async ()=>{
+                    await setDoc(doc(firestore, 'hosts', hostId, 'redirects', draft.id), _extends({}, fields, approval, {
+                        updatedAt: Timestamp.now()
+                    }), {
+                        merge: true
+                    });
+                });
+                // Before `setDraft(null)`, so a refusal keeps the dialog open with
+                // what was typed, in the same warning vocabulary as the validation
+                // refusals above it.
+                if (!verdict.ok) {
+                    return void enqueueSnackbar(verdict.message, {
+                        variant: 'warning',
+                        persist: false
+                    });
+                }
+            } else {
+                // New redirect rides the quota-enforcing resources API (AGL-473) —
+                // it also re-checks the `redirects` entitlement server-side.
+                await createHostResource({
+                    hostId,
+                    resource: 'redirect',
+                    data: fields
+                });
+            }
+            // The changed rule, and — when an edit moved the source — the path
+            // that just STOPPED redirecting, so its page refreshes too.
+            announceRuleChange(source);
+            if (draft.id) {
+                var _find;
+                const previous = (_find = (redirects != null ? redirects : []).find((rule)=>rule.$id === draft.id)) == null ? void 0 : _find.source;
+                if (previous && previous !== source) announceRuleChange(previous);
+            }
+            setDraft(null);
+            enqueueSnackbar('Redirect saved — live within ~30 seconds', {
+                variant: 'success',
+                persist: false
+            });
+        } catch (error) {
+            var _ref2;
+            console.error(error);
+            enqueueSnackbar((_ref2 = error == null ? void 0 : error.message) != null ? _ref2 : 'An error has occurred', {
+                variant: 'error',
+                allowDuplicate: true
+            });
+        }
+    }, [
+        draft,
+        redirects,
+        host,
+        firestore,
+        hostId,
+        createHostResource,
+        currentUser,
+        enqueueSnackbar,
+        redirectsStatus,
+        redirectsFromCache,
+        announceRuleChange
+    ]);
+    /**
+   * A refusal has to be visible (AGL-1881).
+   *
+   * These two writes were bare `await`s. The rules now gate this collection on
+   * a publishing role, so an `author` reaching either gets a
+   * permission-denied — and an unhandled rejection renders as a control that
+   * flips back with no error, which is the worst way to say no. `handleSave`
+   * has always ended in a snackbar; these now match it.
+   *
+   * The card is not role-gated on purpose: it is entitlement-gated, and the
+   * rules leave READ to the catch-all so an author can still see the rules
+   * that affect the pages they write.
+   */ const reportWriteFailure = useCallback((error)=>{
+        var _ref;
+        enqueueSnackbar((error == null ? void 0 : error.code) === 'permission-denied' ? 'Changing a redirect needs a publishing role — ask an editor or admin' : (_ref = error == null ? void 0 : error.message) != null ? _ref : 'An error has occurred', {
+            variant: 'warning',
+            persist: false
+        });
+    }, [
+        enqueueSnackbar
+    ]);
+    const handleToggle = useCallback((redirect)=>async (event)=>{
+            try {
+                await updateDoc(doc(firestore, 'hosts', hostId, 'redirects', redirect.$id), {
+                    enabled: event.target.checked,
+                    updatedAt: Timestamp.now()
+                });
+                announceRuleChange(redirect.source);
+            } catch (error) {
+                reportWriteFailure(error);
+            }
+        }, [
+        firestore,
+        hostId,
+        reportWriteFailure,
+        announceRuleChange
+    ]);
+    const handleDelete = useCallback((redirect)=>async ()=>{
+            const confirmed = await confirm({
+                title: 'Delete this redirect?',
+                description: `${redirect.source} stops redirecting.`,
+                confirmationText: 'Delete',
+                confirmationButtonProps: {
+                    color: 'error'
+                }
+            }).then(()=>true).catch(()=>false);
+            if (!confirmed) return;
+            try {
+                await updateDoc(doc(firestore, 'hosts', hostId, 'redirects', redirect.$id), {
+                    deletedAt: Timestamp.now(),
+                    enabled: false
+                });
+                announceRuleChange(redirect.source);
+            } catch (error) {
+                reportWriteFailure(error);
+            }
+        }, [
+        confirm,
+        firestore,
+        hostId,
+        reportWriteFailure,
+        announceRuleChange
+    ]);
+    return /*#__PURE__*/ _jsxs(CardDisplay, {
+        header: 'URL redirects',
+        help: pluginDocsHelp('redirects', {
+            anchor: '#manage-redirects'
+        }),
+        contentGutterX: true,
+        contentGutterY: true,
+        children: [
+            /*#__PURE__*/ _jsxs(Stack, {
+                spacing: 1,
+                children: [
+                    /*#__PURE__*/ _jsx(Typography, {
+                        variant: "body2",
+                        color: "text.secondary",
+                        children: 'Exact-path rules; 302 while testing, promote to 301 when ' + 'sure (browsers cache 301 aggressively). Changes go live ' + 'within ~30 seconds.'
+                    }),
+                    hits && totalHits > 0 ? /*#__PURE__*/ _jsx(Typography, {
+                        variant: "caption",
+                        color: "text.secondary",
+                        children: `${totalHits} redirect hit${totalHits === 1 ? '' : 's'} in ` + 'the last 30 days (sampled — one per cache window with ' + 'traffic).'
+                    }) : null,
+                    visibleRedirects.map((redirect)=>{
+                        var _redirect_statusCode, _redirect_kind, _hits_idKey;
+                        return /*#__PURE__*/ _jsxs(Stack, {
+                            direction: "row",
+                            spacing: 1,
+                            sx: {
+                                alignItems: 'center'
+                            },
+                            children: [
+                                /*#__PURE__*/ _jsx(Switch, {
+                                    size: "small",
+                                    checked: redirect.enabled !== false,
+                                    onChange: handleToggle(redirect)
+                                }),
+                                /*#__PURE__*/ _jsx(Chip, {
+                                    size: "small",
+                                    label: (_redirect_statusCode = redirect.statusCode) != null ? _redirect_statusCode : 302
+                                }),
+                                ((_redirect_kind = redirect.kind) != null ? _redirect_kind : 'exact') !== 'exact' ? /*#__PURE__*/ _jsx(Chip, {
+                                    size: "small",
+                                    variant: "outlined",
+                                    label: redirect.kind
+                                }) : null,
+                                isExternalRedirectDestination(redirect.destination) && !redirect.externalDestinationApprovedBy ? /*#__PURE__*/ _jsx(Chip, {
+                                    size: "small",
+                                    color: "warning",
+                                    variant: "outlined",
+                                    label: "not serving",
+                                    title: 'This rule sends visitors to another site. Open it and ' + 'save to confirm the destination — until then it is ' + 'skipped.'
+                                }) : null,
+                                /*#__PURE__*/ _jsxs(Stack, {
+                                    sx: {
+                                        flex: 1,
+                                        minWidth: 0
+                                    },
+                                    children: [
+                                        /*#__PURE__*/ _jsx(Typography, {
+                                            variant: "body2",
+                                            noWrap: true,
+                                            children: `${redirect.source} → ${redirect.destination}`
+                                        }),
+                                        hits || redirect.lastHitAt ? /*#__PURE__*/ _jsx(Typography, {
+                                            variant: "caption",
+                                            color: "text.secondary",
+                                            children: [
+                                                hits ? `${(_hits_idKey = hits[idKey(redirect.$id)]) != null ? _hits_idKey : 0} hits (30d, sampled)` : null,
+                                                redirect.lastHitAt ? `last ${redirect.lastHitAt.toDate().toLocaleString()}` : null
+                                            ].filter(Boolean).join(' · ')
+                                        }) : null
+                                    ]
+                                }),
+                                /*#__PURE__*/ _jsx(Button, {
+                                    size: "small",
+                                    onClick: ()=>{
+                                        var _redirect_source, _redirect_destination, _redirect_statusCode, _redirect_kind, _redirect_priority;
+                                        return setDraft({
+                                            id: redirect.$id,
+                                            source: (_redirect_source = redirect.source) != null ? _redirect_source : '',
+                                            destination: (_redirect_destination = redirect.destination) != null ? _redirect_destination : '',
+                                            statusCode: (_redirect_statusCode = redirect.statusCode) != null ? _redirect_statusCode : 302,
+                                            kind: (_redirect_kind = redirect.kind) != null ? _redirect_kind : 'exact',
+                                            priority: (_redirect_priority = redirect.priority) != null ? _redirect_priority : REDIRECT_DEFAULT_PRIORITY,
+                                            // Read exactly as the switch beside it does (AGL-1372):
+                                            // an edit must not be a way to turn a rule back on.
+                                            enabled: redirect.enabled !== false
+                                        });
+                                    },
+                                    children: 'Edit'
+                                }),
+                                /*#__PURE__*/ _jsx(Button, {
+                                    size: "small",
+                                    color: "error",
+                                    onClick: handleDelete(redirect),
+                                    children: 'Delete'
+                                })
+                            ]
+                        }, redirect.$id);
+                    }),
+                    redirects.length === 0 ? null : /*#__PURE__*/ _jsx(ListPagination, {
+                        page: page,
+                        pageSize: pageSize,
+                        rowCount: visibleRedirects.length,
+                        // The rules this page HOLDS, after the soft-deleted ones are
+                        // dropped. Not the quota figure below it: that is a server
+                        // count over every document, soft-deleted rows included,
+                        // because a deleted rule still occupies a slot.
+                        count: redirects.length,
+                        onPageChange: setPage,
+                        onPageSizeChange: setPageSize
+                    }),
+                    redirectsTruncated ? /*#__PURE__*/ _jsx(Alert, {
+                        severity: "info",
+                        children: `Showing ${REDIRECT_CEILING} rules, ordered by id. This site ` + 'has more — the duplicate check and the tester below only ' + 'cover the ones listed here.'
+                    }) : null,
+                    /*#__PURE__*/ _jsx(Button, {
+                        size: "small",
+                        color: "primary",
+                        sx: {
+                            alignSelf: 'flex-start'
+                        },
+                        onClick: handleAdd,
+                        children: 'Add redirect'
+                    }),
+                    /*#__PURE__*/ _jsx(QuotaReadoutComponent, {
+                        ready: org != null && enforcedCount != null,
+                        used: enforcedCount != null ? enforcedCount : 0,
+                        limit: checkQuota(org, 'redirectsPerHost', enforcedCount != null ? enforcedCount : 0).limit,
+                        noun: "redirect"
+                    }),
+                    /*#__PURE__*/ _jsxs(Stack, {
+                        direction: "row",
+                        spacing: 1,
+                        sx: {
+                            alignItems: 'center'
+                        },
+                        children: [
+                            /*#__PURE__*/ _jsx(TextField, {
+                                size: "small",
+                                label: "Test a path",
+                                placeholder: "/old-page",
+                                value: testPath,
+                                onChange: (event)=>setTestPath(event.target.value),
+                                sx: {
+                                    maxWidth: 260
+                                }
+                            }),
+                            testPath.trim() ? /*#__PURE__*/ _jsx(Typography, {
+                                variant: "caption",
+                                color: "text.secondary",
+                                children: (()=>{
+                                    var _normalizeRedirectSource;
+                                    const normalized = (_normalizeRedirectSource = normalizeRedirectSource(testPath)) != null ? _normalizeRedirectSource : testPath.trim();
+                                    const result = matchRedirect(redirects, normalized);
+                                    return result ? `→ ${result.destination} (${result.statusCode})` : 'No rule matches';
+                                })()
+                            }) : null
+                        ]
+                    })
+                ]
+            }),
+            /*#__PURE__*/ _jsxs(Dialog, {
+                open: Boolean(draft),
+                onClose: ()=>setDraft(null),
+                maxWidth: "xs",
+                fullWidth: true,
+                children: [
+                    /*#__PURE__*/ _jsx(DialogTitle, {
+                        children: (draft == null ? void 0 : draft.id) ? 'Edit redirect' : 'Add redirect'
+                    }),
+                    /*#__PURE__*/ _jsxs(DialogContent, {
+                        sx: {
+                            display: 'flex',
+                            flexDirection: 'column',
+                            gap: 1.5,
+                            pt: 1
+                        },
+                        children: [
+                            /*#__PURE__*/ _jsxs(TextField, {
+                                select: true,
+                                label: "Match mode",
+                                value: (_ref1 = draft == null ? void 0 : draft.kind) != null ? _ref1 : 'exact',
+                                onChange: (event)=>setDraft((prev)=>prev ? _extends({}, prev, {
+                                            kind: event.target.value
+                                        }) : prev),
+                                size: "small",
+                                sx: {
+                                    mt: 1
+                                },
+                                children: [
+                                    /*#__PURE__*/ _jsx(MenuItem, {
+                                        value: "exact",
+                                        children: 'Exact path'
+                                    }),
+                                    /*#__PURE__*/ _jsx(MenuItem, {
+                                        value: "prefix",
+                                        children: 'Path prefix'
+                                    }),
+                                    /*#__PURE__*/ _jsx(MenuItem, {
+                                        value: "regex",
+                                        children: 'Regular expression'
+                                    })
+                                ]
+                            }),
+                            /*#__PURE__*/ _jsx(TextField, {
+                                label: (draft == null ? void 0 : draft.kind) === 'regex' ? 'Pattern' : 'From path',
+                                placeholder: (draft == null ? void 0 : draft.kind) === 'regex' ? '/product/(\\d+)' : '/old-page',
+                                helperText: (draft == null ? void 0 : draft.kind) === 'regex' ? 'Anchored to the whole path; use $1, $2 in the destination' : (draft == null ? void 0 : draft.kind) === 'prefix' ? 'Matches the path and everything under it' : undefined,
+                                value: (_ref2 = draft == null ? void 0 : draft.source) != null ? _ref2 : '',
+                                onChange: (event)=>setDraft((prev)=>prev ? _extends({}, prev, {
+                                            source: event.target.value
+                                        }) : prev),
+                                size: "small",
+                                autoFocus: true
+                            }),
+                            /*#__PURE__*/ _jsx(TextField, {
+                                label: "To",
+                                placeholder: "/new-page or https://example.com",
+                                value: (_ref3 = draft == null ? void 0 : draft.destination) != null ? _ref3 : '',
+                                onChange: (event)=>setDraft((prev)=>prev ? _extends({}, prev, {
+                                            destination: event.target.value
+                                        }) : prev),
+                                size: "small"
+                            }),
+                            /*#__PURE__*/ _jsxs(TextField, {
+                                select: true,
+                                label: "Status code",
+                                value: (_ref4 = draft == null ? void 0 : draft.statusCode) != null ? _ref4 : 302,
+                                onChange: (event)=>setDraft((prev)=>prev ? _extends({}, prev, {
+                                            statusCode: Number(event.target.value)
+                                        }) : prev),
+                                size: "small",
+                                children: [
+                                    /*#__PURE__*/ _jsx(MenuItem, {
+                                        value: 302,
+                                        children: '302 — temporary (default)'
+                                    }),
+                                    /*#__PURE__*/ _jsx(MenuItem, {
+                                        value: 301,
+                                        children: '301 — permanent'
+                                    }),
+                                    /*#__PURE__*/ _jsx(MenuItem, {
+                                        value: 307,
+                                        children: '307 — temporary, keep method'
+                                    }),
+                                    /*#__PURE__*/ _jsx(MenuItem, {
+                                        value: 308,
+                                        children: '308 — permanent, keep method'
+                                    })
+                                ]
+                            }),
+                            /*#__PURE__*/ _jsx(TextField, {
+                                label: "Priority",
+                                type: "number",
+                                helperText: "Lower fires first when several rules match",
+                                value: (_ref5 = draft == null ? void 0 : draft.priority) != null ? _ref5 : REDIRECT_DEFAULT_PRIORITY,
+                                onChange: (event)=>setDraft((prev)=>prev ? _extends({}, prev, {
+                                            priority: Number(event.target.value)
+                                        }) : prev),
+                                size: "small"
+                            })
+                        ]
+                    }),
+                    /*#__PURE__*/ _jsxs(DialogActions, {
+                        children: [
+                            /*#__PURE__*/ _jsx(Button, {
+                                onClick: ()=>setDraft(null),
+                                children: 'Cancel'
+                            }),
+                            /*#__PURE__*/ _jsx(Button, {
+                                variant: "contained",
+                                color: "primary",
+                                disabled: !(draft == null ? void 0 : draft.source.trim()) || !(draft == null ? void 0 : draft.destination.trim()),
+                                onClick: handleSave,
+                                children: 'Save redirect'
+                            })
+                        ]
+                    })
+                ]
+            })
+        ]
+    });
+}
+RedirectsConsolePage.displayName = 'RedirectsConsolePage';
+export default RedirectsConsolePage;
+
+//# sourceMappingURL=redirects-console-page.js.map