@aglyn/tenant-data-admin 1.0.0-beta.143

package/src/lib/server/user-profiles.js

@@ -0,0 +1,364 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * The personal profile document, `users/{uid}` (AGL-1127).
+ *
+ * It holds what Manage Account → Basic info edits (`firstName`, `lastName`,
+ * `phoneNumber`, `organization`) plus the avatar the console shows for you.
+ * It is NOT an identity source: email and display name for OTHER people are
+ * read from the org roster (`orgs/{id}/members/{uid}`), which works for SSO
+ * accounts that project-level auth cannot see at all (AGL-1122). Nothing here
+ * duplicates them, so there is nothing to drift.
+ *
+ * Until this existed, no account-creation path wrote the doc — it was born
+ * the first time someone saved Basic info, so a fresh account rendered the
+ * form against a document that did not exist. Measured on production
+ * 2026-07-30: 1 of 3 accounts had one, and the account that did had exactly
+ * the four Basic-info fields.
+ */ import { splitDisplayName } from "@aglyn/shared-util-tools";
+import { isBlankAddress, normalizeAddress, normalizePhone } from "@aglyn/aglyn/server";
+import { FieldValue } from "firebase-admin/firestore";
+import { getContactSuppression, suppressPhoneContact } from "./contact-suppression.js";
+import firebaseAdmin from "./firebase-admin.js";
+const firestore = ()=>firebaseAdmin.app().firestore();
+/**
+ * Create `users/{uid}` if it is missing and prefill the name fields from the
+ * identity provider, without ever overwriting what the user has typed.
+ *
+ * Only ABSENT fields are written, so re-running on every sign-in — which is
+ * what the SSO route does — cannot undo an edit: rename yourself in Basic
+ * info and the IdP's copy stays out of it.
+ *
+ * Best-effort by contract. Provisioning access must not fail because a
+ * cosmetic prefill did, so the caller is expected to let a rejection through
+ * rather than surface it; the profile self-heals on the next sign-in.
+ *
+ * @returns what the seed actually wrote, for logging and tests.
+ */ export async function seedUserProfile(uid, input = {}) {
+    var _input_firestore;
+    var _input_photoUrl, _input_phoneNumber;
+    const ref = ((_input_firestore = input.firestore) != null ? _input_firestore : firestore()).collection('users').doc(uid);
+    const snapshot = await ref.get();
+    const { firstName, lastName } = splitDisplayName(input.displayName);
+    const blank = (value)=>typeof value !== 'string' || !value.trim();
+    const seed = {};
+    if (firstName && blank(snapshot.get('firstName'))) seed['firstName'] = firstName;
+    if (lastName && blank(snapshot.get('lastName'))) seed['lastName'] = lastName;
+    // Same absent-only rule: a directory photo fills an empty avatar, and never
+    // replaces one somebody uploaded. `photoUrl` here, not `photoURL` — this
+    // doc's spelling differs from the roster's, and writing the roster's would
+    // add a field Manage Account does not read.
+    //
+    // THE REMOVAL MARKER (AGL-2486). Absent-only is what protects an avatar
+    // somebody SET; it does nothing for one they REMOVED, because removing it
+    // is precisely what makes the field absent again. So this seed runs on the
+    // next sign-in, finds a blank field and a directory thumbnail, and puts
+    // back the picture the person just deleted — from the customer's own IdP,
+    // on every sign-in, forever.
+    //
+    // `propagateMemberPhoto` already refuses this on the roster row, and says
+    // why: it clears with `FieldValue.delete()` rather than `''` so the
+    // backfill's identical `blank()` cannot read the clear as "never set". The
+    // roster half got that treatment and this half did not, and no deletion
+    // sentinel can fix it here — an absent field is exactly the state a
+    // removal produces, so the two are indistinguishable without a marker.
+    //
+    // Hence `photoUrlErasedAt`, the same shape as `phoneNumberErasedAt` and
+    // `addressErasedAt` above and below, and owner-writable for the same
+    // reason: the only party who can clear it is the person it protects, and a
+    // person clearing their own marker is a person asking for IdP prefill
+    // again. Manage Account drops it on any save that stores a photo, so
+    // opting back in is just setting an avatar.
+    //
+    // Not a privacy control, unlike those two — an avatar is a picture the
+    // directory published, not a contact channel. It is a "stop overruling me"
+    // control, which is the whole of what "set AND CHANGE your own avatar"
+    // requires when a directory is asserting one on every sign-in.
+    if (((_input_photoUrl = input.photoUrl) == null ? void 0 : _input_photoUrl.trim()) && blank(snapshot.get('photoUrl'))) {
+        if (!snapshot.get('photoUrlErasedAt')) seed['photoUrl'] = input.photoUrl.trim();
+    }
+    // The phone is the one seeded field with a legal dimension, so it carries
+    // two guards the others do not (AGL-1592).
+    //
+    // THE DEFECT THIS EXISTS TO PREVENT. Privacy Policy v4 §11 says a user may
+    // ask us to delete the phone number we hold. Clearing the field is not
+    // enough: `/api/auth/sso-jit` and `/api/auth/session` both run this seed on
+    // EVERY sign-in, and "absent field" is exactly the condition that makes it
+    // write. A naive deletion therefore undoes itself the next time the person
+    // signs in, from the customer's IdP, with no trace — the honoured request
+    // and the resurrected number look identical in the data.
+    //
+    // Two keys, because neither one covers the whole defect:
+    //
+    //  - `phoneNumberErasedAt` on this document catches the same account. It is
+    //    free (the snapshot is already in hand) and it is what runs on the hot
+    //    path, so the common case adds no read at all.
+    //  - the number-keyed suppression record catches the SAME PERSON ARRIVING AS
+    //    A DIFFERENT ACCOUNT — reprovisioned in the IdP, or signing up
+    //    self-serve alongside their SSO seat. Their new `users/{uid}` has no
+    //    marker on it, so the per-account key alone would re-store a number
+    //    somebody asked us to stop holding.
+    //
+    // The suppression lookup is reached only when we are actually about to write
+    // a phone, which is the first sign-in of an account and no other time; an
+    // erased account short-circuits on the marker before spending the read.
+    //
+    // Note which suppressions block this: ONLY `erasePhoneOnFile`. "Stop calling
+    // me" is not "stop holding my number" — see contact-suppression.ts — and
+    // treating a do-not-call as a deletion request would answer a question the
+    // person did not ask.
+    if (((_input_phoneNumber = input.phoneNumber) == null ? void 0 : _input_phoneNumber.trim()) && blank(snapshot.get('phoneNumber'))) {
+        let refused = Boolean(snapshot.get('phoneNumberErasedAt'));
+        if (!refused) {
+            try {
+                var _input_firestore1;
+                const suppression = await getContactSuppression(input.phoneNumber, (_input_firestore1 = input.firestore) != null ? _input_firestore1 : undefined);
+                refused = Boolean(suppression == null ? void 0 : suppression.erasePhoneOnFile) && !(suppression == null ? void 0 : suppression.revokedAt);
+            } catch (error) {
+                // Fail CLOSED, in step with `isPhoneContactSuppressed`. A lookup that
+                // throws leaves us unable to say whether this number was erased on
+                // request, and re-storing it in that state is the failure this guard
+                // exists for. A cosmetic prefill is worth nothing next to it.
+                console.error('[user-profiles] suppression lookup failed; not seeding phone', error);
+                refused = true;
+            }
+        }
+        if (!refused) seed['phoneNumber'] = input.phoneNumber.trim();
+    }
+    // The address (AGL-1963), the last of AGL-1133's six and the only one that
+    // did not ship — it was written as blocked on AGL-1131 mapping attributes,
+    // which completed 2026-08-01, and nothing picked it back up.
+    //
+    // NORMALIZE BEFORE DECIDING. `normalizeAddress` returns null for an address
+    // with nothing usable in it, which is what stops a sparse assertion — a
+    // country the IdP spells "United States", and no other field — from storing
+    // an object that every `if (address)` in the codebase reads as an address.
+    // Checking the raw parts first and normalizing after would write exactly
+    // that object.
+    //
+    // Absent-only, like the rest, but `isBlankAddress` rather than `blank()`:
+    // the stored value is a MAP, so the string check the other fields use would
+    // call every populated address blank and overwrite it on every sign-in.
+    //
+    // THE ERASURE GUARD, following the phone's precedent (Privacy Policy v4 §11,
+    // AGL-1592). An address is squarely personal data, and `/api/auth/sso-jit`
+    // and `/api/auth/session` both run this seed on EVERY sign-in — so "absent
+    // field" is the condition that makes it write, and a deletion would undo
+    // itself at the next SSO sign-in from the customer's own IdP, leaving the
+    // honoured request and the resurrected address identical in the data.
+    //
+    // ONE key, where the phone needs two, and the asymmetry is the point rather
+    // than an omission. `phoneNumberErasedAt` is paired with a NUMBER-KEYED
+    // suppression record because a phone number is a routing address: the same
+    // person arriving as a different account must not have it re-stored, and
+    // the number is the only thing that can recognise them. A postal address is
+    // not a channel we contact anyone on and there is no do-not-mail list for it
+    // to join, so the per-account marker is the whole of the mechanism here.
+    // Adding a second, address-keyed store would retain MORE personal data in
+    // the name of erasing it, which is the opposite of what §11 asks for.
+    //
+    // A STREET LINE IS REQUIRED, and this is the one field where the IdP's copy
+    // is held to a stricter rule than a typed one (AGL-1566).
+    //
+    // AGL-1963 asked that a partial assertion "not produce a half-address that
+    // looks populated" and named `normalizeAddress` as the mechanism. It is not
+    // sufficient: `normalizeAddress` returns null only when NOTHING survives, so
+    // a locality on its own survives, and this seed stored it. That was pinned
+    // as a judgement call, on the reasoning that a typed city-only address is
+    // stored happily too and a second rule here would give an SSO user and a
+    // typing user different profiles from the same input.
+    //
+    // AGL-1566 is the fact that reverses it. The `Aglyn Console SSO` app maps
+    // `city`, `region` and `postalCode` out of the Directory's **Home** address
+    // and maps NO street row, so a street-less fragment is not an edge case for
+    // this IdP — it is the only address it can ever assert, and the value is
+    // residential. The symmetry argument does not survive it either: the typing
+    // user CHOSE to enter a city, and the SSO user chose nothing at all. So the
+    // two inputs were never the same input.
+    //
+    // What that leaves is personal data we would receive, store, and have no use
+    // for — nothing outside the owner's own Manage Account form reads
+    // `users/{uid}.address`, and no tax, billing or shipping path touches it.
+    // Under data minimisation the honest answer to "why do we hold this
+    // person's home postcode" has to be better than "the directory offered it".
+    // For a complete address it is: the person gets a filled-in form instead of
+    // an empty one. For a city and a postcode it is nothing, because that is not
+    // an address anybody could use.
+    //
+    // Deliberately NOT pushed into `normalizeAddress` or into `resolveIdpAddress`.
+    // The resolver's job is to report what the assertion said, and lying about
+    // that would hide the exposure rather than remove it; `normalizeAddress` is
+    // shared with Manage Account, where a person storing only a city is their own
+    // business. The rule belongs exactly here, at the point where WE decide to
+    // persist something nobody asked us to hold.
+    const address = normalizeAddress(input.address);
+    if ((address == null ? void 0 : address.line1) && isBlankAddress(snapshot.get('address'))) {
+        if (!snapshot.get('addressErasedAt')) seed['address'] = address;
+    }
+    // An existing doc with nothing missing needs no write at all — the common
+    // case on every sign-in after the first.
+    if (snapshot.exists && !Object.keys(seed).length) {
+        return {
+            created: false,
+            fields: []
+        };
+    }
+    // A doc with no name to seed is still worth creating: it is where the
+    // avatar and the notification mutes land, and its absence is what made
+    // those read as "this account has none" rather than "not set yet".
+    if (!snapshot.exists) seed['createdAt'] = FieldValue.serverTimestamp();
+    await ref.set(seed, {
+        merge: true
+    });
+    return {
+        created: !snapshot.exists,
+        fields: Object.keys(seed).filter((key)=>key !== 'createdAt')
+    };
+}
+/**
+ * "Delete the phone number you hold for me" — the second half of Privacy
+ * Policy v4 §11 (AGL-1592). Deliberately adjacent to `seedUserProfile`,
+ * because the two are halves of one invariant: this sets the marker that one
+ * reads, and changing either without the other silently restores the defect.
+ *
+ * WHAT IT DOES, AND WHY IT IS NOT JUST A DELETE
+ *
+ *  1. Removes `users/{uid}.phoneNumber` outright (`FieldValue.delete()`, not
+ *     `null` — the request was to stop holding it, and a nulled field still
+ *     reads as "we have a phone slot for this person").
+ *  2. Stamps `phoneNumberErasedAt`, which is what stops the IdP re-asserting
+ *     it on the next sign-in.
+ *  3. Writes a suppression record for the number, with `erasePhoneOnFile`.
+ *
+ * Step 3 is the one that looks contradictory and is not. Deleting every copy
+ * of a number does NOT protect the person from being called — it destroys the
+ * only artefact that could recognise them, so the same number arriving later
+ * from a customer's CRM, a support ticket, or their own re-typed profile is a
+ * number we have never heard of and will happily dial. The minimal retained
+ * record is what makes the deletion request mean what the person meant by it.
+ * The full reasoning, and the statutory carve-outs it rests on, are in
+ * contact-suppression.ts.
+ *
+ * §11 does not currently say this. It should — see the wording proposed on
+ * AGL-1592. Do not resolve the mismatch by making the code forget the number.
+ *
+ * WHY THE MARKER LIVES ON A CLIENT-WRITABLE DOCUMENT. `users/{uid}` is
+ * writable by its owner (and by staff) under the Firestore rules, so this
+ * marker is not tamper-proof. It does not need to be: the only party who can
+ * clear it is the person it protects, and a person clearing their own erasure
+ * marker is a person changing their mind, not an attacker. The adversary here
+ * is our own seeding code path, which is server-side and honours it. Moving
+ * the marker to a server-only document would buy nothing and cost a second
+ * read on every sign-in.
+ *
+ * A stale marker is harmless: it only ever suppresses an IdP prefill, and a
+ * user who types a number back in has a non-blank field, which the seed skips
+ * anyway.
+ *
+ * @param phoneNumber the number to suppress. Defaults to whatever the profile
+ *        currently holds — pass it explicitly when the request named a number
+ *        we do not have on file.
+ * @returns `suppressed` is the E.164 that went onto the do-not-contact list,
+ *          or null when there was no recognizable number to record.
+ */ export async function forgetUserPhoneNumber(input) {
+    var _input_firestore, _input_phoneNumber;
+    const db = (_input_firestore = input.firestore) != null ? _input_firestore : firestore();
+    const ref = db.collection('users').doc(input.uid);
+    const snapshot = await ref.get();
+    const onFile = snapshot.exists ? snapshot.get('phoneNumber') : null;
+    const target = normalizePhone((_input_phoneNumber = input.phoneNumber) != null ? _input_phoneNumber : onFile);
+    // The suppression is written FIRST. If it fails, the number is still on the
+    // profile and the request is visibly unfulfilled — which is recoverable by
+    // retrying. The other order deletes our only copy of the number and then
+    // fails to record it, leaving nothing to retry with.
+    let suppressed = null;
+    if (target) {
+        var _input_recordedByUid, _input_note;
+        const result = await suppressPhoneContact(_extends({
+            phoneNumber: target,
+            source: 'erasure-request',
+            uid: input.uid,
+            recordedByUid: (_input_recordedByUid = input.recordedByUid) != null ? _input_recordedByUid : null,
+            note: (_input_note = input.note) != null ? _input_note : null,
+            erasePhoneOnFile: true
+        }, input.firestore ? {
+            firestore: input.firestore
+        } : {}));
+        suppressed = result.phoneNumber;
+    }
+    // The marker is stamped even when no number was recognizable, so a later
+    // IdP assertion for this account is refused too. Someone who asks us to
+    // stop holding their number has asked about the account, not only about the
+    // digits we happened to have at the time.
+    await ref.set({
+        phoneNumber: FieldValue.delete(),
+        phoneNumberErasedAt: FieldValue.serverTimestamp()
+    }, {
+        merge: true
+    });
+    return {
+        cleared: Boolean(onFile),
+        suppressed
+    };
+}
+/**
+ * "Delete the address you hold for me" (AGL-1963) — the address half of the
+ * same §11 invariant `forgetUserPhoneNumber` implements for the phone, and
+ * deliberately adjacent to both for the same reason: this sets the marker
+ * that `seedUserProfile` reads, and changing either without the other
+ * silently restores the defect.
+ *
+ * A guard whose marker nothing ever writes is decorative, so this exists
+ * before anything needs it. Two callers do:
+ *
+ *  - Manage Account, when someone clears their own address. That is the
+ *    common case by a wide margin — nobody files a support ticket to remove
+ *    a street address, they empty the field — and without a marker their
+ *    next SSO sign-in puts it straight back.
+ *  - Staff, handling an erasure request against an account the person can no
+ *    longer sign in to.
+ *
+ * `FieldValue.delete()`, not `null`, on the same reasoning as the phone: the
+ * request was to stop holding it, and a nulled field still reads as "we have
+ * an address slot for this person".
+ *
+ * REVERSIBLE BY THE PERSON IT PROTECTS, and only by them. `users/{uid}` is
+ * writable by its owner (and by staff) under the Firestore rules, so this
+ * marker is not tamper-proof and does not need to be — the adversary it
+ * guards against is our own seeding path, which is server-side and honours
+ * it. Someone who types an address back in has a non-blank field, which the
+ * seed skips anyway — and Manage Account drops the marker on that same save,
+ * so opting back into IdP prefill is just filling the field in again.
+ */ export async function forgetUserAddress(input) {
+    var _input_firestore;
+    const db = (_input_firestore = input.firestore) != null ? _input_firestore : firestore();
+    const ref = db.collection('users').doc(input.uid);
+    const snapshot = await ref.get();
+    const onFile = snapshot.exists && !isBlankAddress(snapshot.get('address'));
+    await ref.set({
+        address: FieldValue.delete(),
+        addressErasedAt: FieldValue.serverTimestamp()
+    }, {
+        merge: true
+    });
+    return {
+        cleared: Boolean(onFile)
+    };
+}
+export default seedUserProfile;
+
+//# sourceMappingURL=user-profiles.js.map

package/src/lib/server/user-profiles.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/user-profiles.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * The personal profile document, `users/{uid}` (AGL-1127).\n *\n * It holds what Manage Account → Basic info edits (`firstName`, `lastName`,\n * `phoneNumber`, `organization`) plus the avatar the console shows for you.\n * It is NOT an identity source: email and display name for OTHER people are\n * read from the org roster (`orgs/{id}/members/{uid}`), which works for SSO\n * accounts that project-level auth cannot see at all (AGL-1122). Nothing here\n * duplicates them, so there is nothing to drift.\n *\n * Until this existed, no account-creation path wrote the doc — it was born\n * the first time someone saved Basic info, so a fresh account rendered the\n * form against a document that did not exist. Measured on production\n * 2026-07-30: 1 of 3 accounts had one, and the account that did had exactly\n * the four Basic-info fields.\n */\n\nimport { splitDisplayName } from '@aglyn/shared-util-tools'\nimport {\n  isBlankAddress,\n  normalizeAddress,\n  normalizePhone,\n  type AglynPostalAddress,\n} from '@aglyn/aglyn/server'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport {\n  getContactSuppression,\n  suppressPhoneContact,\n} from './contact-suppression'\nimport firebaseAdmin from './firebase-admin'\n\nconst firestore = () => firebaseAdmin.app().firestore()\n\nexport interface SeedUserProfileInput {\n  /** The provider's single name string, when the assertion carries one. */\n  displayName?: string | null\n  /**\n   * Avatar and phone from the same assertion (AGL-1131). Callers pass these\n   * through `resolveIdpPhotoUrl` / `resolveIdpPhone`, which is where the\n   * https-only check on the photo lives — this function does not re-validate.\n   */\n  photoUrl?: string | null\n  phoneNumber?: string | null\n  /**\n   * Postal address from the same assertion (AGL-1963). Callers pass this\n   * through `resolveIdpAddress`, whose loose `IdpAddressParts` is structurally\n   * an `AglynPostalAddress` — it is the seed below, not the caller, that\n   * decides whether the parts amount to an address at all. Stored only when\n   * the assertion carries a STREET LINE (AGL-1566): a directory that releases\n   * a home city and postcode and no street has given us personal data with no\n   * use, not an address.\n   */\n  address?: AglynPostalAddress | null\n  /** Injectable for tests; defaults to the admin app's Firestore. */\n  firestore?: any\n}\n\n/**\n * Create `users/{uid}` if it is missing and prefill the name fields from the\n * identity provider, without ever overwriting what the user has typed.\n *\n * Only ABSENT fields are written, so re-running on every sign-in — which is\n * what the SSO route does — cannot undo an edit: rename yourself in Basic\n * info and the IdP's copy stays out of it.\n *\n * Best-effort by contract. Provisioning access must not fail because a\n * cosmetic prefill did, so the caller is expected to let a rejection through\n * rather than surface it; the profile self-heals on the next sign-in.\n *\n * @returns what the seed actually wrote, for logging and tests.\n */\nexport async function seedUserProfile(\n  uid: string,\n  input: SeedUserProfileInput = {},\n): Promise<{ created: boolean; fields: string[] }> {\n  const ref = (input.firestore ?? firestore()).collection('users').doc(uid)\n  const snapshot = await ref.get()\n  const { firstName, lastName } = splitDisplayName(input.displayName)\n\n  const blank = (value: unknown) =>\n    typeof value !== 'string' || !value.trim()\n\n  const seed: Record<string, unknown> = {}\n  if (firstName && blank(snapshot.get('firstName'))) seed['firstName'] = firstName\n  if (lastName && blank(snapshot.get('lastName'))) seed['lastName'] = lastName\n  // Same absent-only rule: a directory photo fills an empty avatar, and never\n  // replaces one somebody uploaded. `photoUrl` here, not `photoURL` — this\n  // doc's spelling differs from the roster's, and writing the roster's would\n  // add a field Manage Account does not read.\n  //\n  // THE REMOVAL MARKER (AGL-2486). Absent-only is what protects an avatar\n  // somebody SET; it does nothing for one they REMOVED, because removing it\n  // is precisely what makes the field absent again. So this seed runs on the\n  // next sign-in, finds a blank field and a directory thumbnail, and puts\n  // back the picture the person just deleted — from the customer's own IdP,\n  // on every sign-in, forever.\n  //\n  // `propagateMemberPhoto` already refuses this on the roster row, and says\n  // why: it clears with `FieldValue.delete()` rather than `''` so the\n  // backfill's identical `blank()` cannot read the clear as \"never set\". The\n  // roster half got that treatment and this half did not, and no deletion\n  // sentinel can fix it here — an absent field is exactly the state a\n  // removal produces, so the two are indistinguishable without a marker.\n  //\n  // Hence `photoUrlErasedAt`, the same shape as `phoneNumberErasedAt` and\n  // `addressErasedAt` above and below, and owner-writable for the same\n  // reason: the only party who can clear it is the person it protects, and a\n  // person clearing their own marker is a person asking for IdP prefill\n  // again. Manage Account drops it on any save that stores a photo, so\n  // opting back in is just setting an avatar.\n  //\n  // Not a privacy control, unlike those two — an avatar is a picture the\n  // directory published, not a contact channel. It is a \"stop overruling me\"\n  // control, which is the whole of what \"set AND CHANGE your own avatar\"\n  // requires when a directory is asserting one on every sign-in.\n  if (input.photoUrl?.trim() && blank(snapshot.get('photoUrl'))) {\n    if (!snapshot.get('photoUrlErasedAt')) seed['photoUrl'] = input.photoUrl.trim()\n  }\n  // The phone is the one seeded field with a legal dimension, so it carries\n  // two guards the others do not (AGL-1592).\n  //\n  // THE DEFECT THIS EXISTS TO PREVENT. Privacy Policy v4 §11 says a user may\n  // ask us to delete the phone number we hold. Clearing the field is not\n  // enough: `/api/auth/sso-jit` and `/api/auth/session` both run this seed on\n  // EVERY sign-in, and \"absent field\" is exactly the condition that makes it\n  // write. A naive deletion therefore undoes itself the next time the person\n  // signs in, from the customer's IdP, with no trace — the honoured request\n  // and the resurrected number look identical in the data.\n  //\n  // Two keys, because neither one covers the whole defect:\n  //\n  //  - `phoneNumberErasedAt` on this document catches the same account. It is\n  //    free (the snapshot is already in hand) and it is what runs on the hot\n  //    path, so the common case adds no read at all.\n  //  - the number-keyed suppression record catches the SAME PERSON ARRIVING AS\n  //    A DIFFERENT ACCOUNT — reprovisioned in the IdP, or signing up\n  //    self-serve alongside their SSO seat. Their new `users/{uid}` has no\n  //    marker on it, so the per-account key alone would re-store a number\n  //    somebody asked us to stop holding.\n  //\n  // The suppression lookup is reached only when we are actually about to write\n  // a phone, which is the first sign-in of an account and no other time; an\n  // erased account short-circuits on the marker before spending the read.\n  //\n  // Note which suppressions block this: ONLY `erasePhoneOnFile`. \"Stop calling\n  // me\" is not \"stop holding my number\" — see contact-suppression.ts — and\n  // treating a do-not-call as a deletion request would answer a question the\n  // person did not ask.\n  if (input.phoneNumber?.trim() && blank(snapshot.get('phoneNumber'))) {\n    let refused = Boolean(snapshot.get('phoneNumberErasedAt'))\n    if (!refused) {\n      try {\n        const suppression = await getContactSuppression(\n          input.phoneNumber,\n          input.firestore ?? undefined,\n        )\n        refused = Boolean(suppression?.erasePhoneOnFile) && !suppression?.revokedAt\n      } catch (error) {\n        // Fail CLOSED, in step with `isPhoneContactSuppressed`. A lookup that\n        // throws leaves us unable to say whether this number was erased on\n        // request, and re-storing it in that state is the failure this guard\n        // exists for. A cosmetic prefill is worth nothing next to it.\n        console.error(\n          '[user-profiles] suppression lookup failed; not seeding phone',\n          error,\n        )\n        refused = true\n      }\n    }\n    if (!refused) seed['phoneNumber'] = input.phoneNumber.trim()\n  }\n\n  // The address (AGL-1963), the last of AGL-1133's six and the only one that\n  // did not ship — it was written as blocked on AGL-1131 mapping attributes,\n  // which completed 2026-08-01, and nothing picked it back up.\n  //\n  // NORMALIZE BEFORE DECIDING. `normalizeAddress` returns null for an address\n  // with nothing usable in it, which is what stops a sparse assertion — a\n  // country the IdP spells \"United States\", and no other field — from storing\n  // an object that every `if (address)` in the codebase reads as an address.\n  // Checking the raw parts first and normalizing after would write exactly\n  // that object.\n  //\n  // Absent-only, like the rest, but `isBlankAddress` rather than `blank()`:\n  // the stored value is a MAP, so the string check the other fields use would\n  // call every populated address blank and overwrite it on every sign-in.\n  //\n  // THE ERASURE GUARD, following the phone's precedent (Privacy Policy v4 §11,\n  // AGL-1592). An address is squarely personal data, and `/api/auth/sso-jit`\n  // and `/api/auth/session` both run this seed on EVERY sign-in — so \"absent\n  // field\" is the condition that makes it write, and a deletion would undo\n  // itself at the next SSO sign-in from the customer's own IdP, leaving the\n  // honoured request and the resurrected address identical in the data.\n  //\n  // ONE key, where the phone needs two, and the asymmetry is the point rather\n  // than an omission. `phoneNumberErasedAt` is paired with a NUMBER-KEYED\n  // suppression record because a phone number is a routing address: the same\n  // person arriving as a different account must not have it re-stored, and\n  // the number is the only thing that can recognise them. A postal address is\n  // not a channel we contact anyone on and there is no do-not-mail list for it\n  // to join, so the per-account marker is the whole of the mechanism here.\n  // Adding a second, address-keyed store would retain MORE personal data in\n  // the name of erasing it, which is the opposite of what §11 asks for.\n  //\n  // A STREET LINE IS REQUIRED, and this is the one field where the IdP's copy\n  // is held to a stricter rule than a typed one (AGL-1566).\n  //\n  // AGL-1963 asked that a partial assertion \"not produce a half-address that\n  // looks populated\" and named `normalizeAddress` as the mechanism. It is not\n  // sufficient: `normalizeAddress` returns null only when NOTHING survives, so\n  // a locality on its own survives, and this seed stored it. That was pinned\n  // as a judgement call, on the reasoning that a typed city-only address is\n  // stored happily too and a second rule here would give an SSO user and a\n  // typing user different profiles from the same input.\n  //\n  // AGL-1566 is the fact that reverses it. The `Aglyn Console SSO` app maps\n  // `city`, `region` and `postalCode` out of the Directory's **Home** address\n  // and maps NO street row, so a street-less fragment is not an edge case for\n  // this IdP — it is the only address it can ever assert, and the value is\n  // residential. The symmetry argument does not survive it either: the typing\n  // user CHOSE to enter a city, and the SSO user chose nothing at all. So the\n  // two inputs were never the same input.\n  //\n  // What that leaves is personal data we would receive, store, and have no use\n  // for — nothing outside the owner's own Manage Account form reads\n  // `users/{uid}.address`, and no tax, billing or shipping path touches it.\n  // Under data minimisation the honest answer to \"why do we hold this\n  // person's home postcode\" has to be better than \"the directory offered it\".\n  // For a complete address it is: the person gets a filled-in form instead of\n  // an empty one. For a city and a postcode it is nothing, because that is not\n  // an address anybody could use.\n  //\n  // Deliberately NOT pushed into `normalizeAddress` or into `resolveIdpAddress`.\n  // The resolver's job is to report what the assertion said, and lying about\n  // that would hide the exposure rather than remove it; `normalizeAddress` is\n  // shared with Manage Account, where a person storing only a city is their own\n  // business. The rule belongs exactly here, at the point where WE decide to\n  // persist something nobody asked us to hold.\n  const address = normalizeAddress(input.address)\n  if (address?.line1 && isBlankAddress(snapshot.get('address'))) {\n    if (!snapshot.get('addressErasedAt')) seed['address'] = address\n  }\n\n  // An existing doc with nothing missing needs no write at all — the common\n  // case on every sign-in after the first.\n  if (snapshot.exists && !Object.keys(seed).length) {\n    return { created: false, fields: [] }\n  }\n  // A doc with no name to seed is still worth creating: it is where the\n  // avatar and the notification mutes land, and its absence is what made\n  // those read as \"this account has none\" rather than \"not set yet\".\n  if (!snapshot.exists) seed['createdAt'] = FieldValue.serverTimestamp()\n\n  await ref.set(seed, { merge: true })\n  return {\n    created: !snapshot.exists,\n    fields: Object.keys(seed).filter((key) => key !== 'createdAt'),\n  }\n}\n\n/**\n * \"Delete the phone number you hold for me\" — the second half of Privacy\n * Policy v4 §11 (AGL-1592). Deliberately adjacent to `seedUserProfile`,\n * because the two are halves of one invariant: this sets the marker that one\n * reads, and changing either without the other silently restores the defect.\n *\n * WHAT IT DOES, AND WHY IT IS NOT JUST A DELETE\n *\n *  1. Removes `users/{uid}.phoneNumber` outright (`FieldValue.delete()`, not\n *     `null` — the request was to stop holding it, and a nulled field still\n *     reads as \"we have a phone slot for this person\").\n *  2. Stamps `phoneNumberErasedAt`, which is what stops the IdP re-asserting\n *     it on the next sign-in.\n *  3. Writes a suppression record for the number, with `erasePhoneOnFile`.\n *\n * Step 3 is the one that looks contradictory and is not. Deleting every copy\n * of a number does NOT protect the person from being called — it destroys the\n * only artefact that could recognise them, so the same number arriving later\n * from a customer's CRM, a support ticket, or their own re-typed profile is a\n * number we have never heard of and will happily dial. The minimal retained\n * record is what makes the deletion request mean what the person meant by it.\n * The full reasoning, and the statutory carve-outs it rests on, are in\n * contact-suppression.ts.\n *\n * §11 does not currently say this. It should — see the wording proposed on\n * AGL-1592. Do not resolve the mismatch by making the code forget the number.\n *\n * WHY THE MARKER LIVES ON A CLIENT-WRITABLE DOCUMENT. `users/{uid}` is\n * writable by its owner (and by staff) under the Firestore rules, so this\n * marker is not tamper-proof. It does not need to be: the only party who can\n * clear it is the person it protects, and a person clearing their own erasure\n * marker is a person changing their mind, not an attacker. The adversary here\n * is our own seeding code path, which is server-side and honours it. Moving\n * the marker to a server-only document would buy nothing and cost a second\n * read on every sign-in.\n *\n * A stale marker is harmless: it only ever suppresses an IdP prefill, and a\n * user who types a number back in has a non-blank field, which the seed skips\n * anyway.\n *\n * @param phoneNumber the number to suppress. Defaults to whatever the profile\n *        currently holds — pass it explicitly when the request named a number\n *        we do not have on file.\n * @returns `suppressed` is the E.164 that went onto the do-not-contact list,\n *          or null when there was no recognizable number to record.\n */\nexport async function forgetUserPhoneNumber(input: {\n  uid: string\n  phoneNumber?: string | null\n  /** Staff member who took the request, for the suppression record. */\n  recordedByUid?: string | null\n  note?: string | null\n  firestore?: any\n}): Promise<{ cleared: boolean; suppressed: string | null }> {\n  const db = input.firestore ?? firestore()\n  const ref = db.collection('users').doc(input.uid)\n  const snapshot = await ref.get()\n  const onFile = snapshot.exists ? snapshot.get('phoneNumber') : null\n  const target = normalizePhone(input.phoneNumber ?? onFile)\n\n  // The suppression is written FIRST. If it fails, the number is still on the\n  // profile and the request is visibly unfulfilled — which is recoverable by\n  // retrying. The other order deletes our only copy of the number and then\n  // fails to record it, leaving nothing to retry with.\n  let suppressed: string | null = null\n  if (target) {\n    const result = await suppressPhoneContact({\n      phoneNumber: target,\n      source: 'erasure-request',\n      uid: input.uid,\n      recordedByUid: input.recordedByUid ?? null,\n      note: input.note ?? null,\n      erasePhoneOnFile: true,\n      ...(input.firestore ? { firestore: input.firestore } : {}),\n    })\n    suppressed = result.phoneNumber\n  }\n\n  // The marker is stamped even when no number was recognizable, so a later\n  // IdP assertion for this account is refused too. Someone who asks us to\n  // stop holding their number has asked about the account, not only about the\n  // digits we happened to have at the time.\n  await ref.set(\n    {\n      phoneNumber: FieldValue.delete(),\n      phoneNumberErasedAt: FieldValue.serverTimestamp(),\n    },\n    { merge: true },\n  )\n  return { cleared: Boolean(onFile), suppressed }\n}\n\n/**\n * \"Delete the address you hold for me\" (AGL-1963) — the address half of the\n * same §11 invariant `forgetUserPhoneNumber` implements for the phone, and\n * deliberately adjacent to both for the same reason: this sets the marker\n * that `seedUserProfile` reads, and changing either without the other\n * silently restores the defect.\n *\n * A guard whose marker nothing ever writes is decorative, so this exists\n * before anything needs it. Two callers do:\n *\n *  - Manage Account, when someone clears their own address. That is the\n *    common case by a wide margin — nobody files a support ticket to remove\n *    a street address, they empty the field — and without a marker their\n *    next SSO sign-in puts it straight back.\n *  - Staff, handling an erasure request against an account the person can no\n *    longer sign in to.\n *\n * `FieldValue.delete()`, not `null`, on the same reasoning as the phone: the\n * request was to stop holding it, and a nulled field still reads as \"we have\n * an address slot for this person\".\n *\n * REVERSIBLE BY THE PERSON IT PROTECTS, and only by them. `users/{uid}` is\n * writable by its owner (and by staff) under the Firestore rules, so this\n * marker is not tamper-proof and does not need to be — the adversary it\n * guards against is our own seeding path, which is server-side and honours\n * it. Someone who types an address back in has a non-blank field, which the\n * seed skips anyway — and Manage Account drops the marker on that same save,\n * so opting back into IdP prefill is just filling the field in again.\n */\nexport async function forgetUserAddress(input: {\n  uid: string\n  firestore?: any\n}): Promise<{ cleared: boolean }> {\n  const db = input.firestore ?? firestore()\n  const ref = db.collection('users').doc(input.uid)\n  const snapshot = await ref.get()\n  const onFile = snapshot.exists && !isBlankAddress(snapshot.get('address'))\n  await ref.set(\n    {\n      address: FieldValue.delete(),\n      addressErasedAt: FieldValue.serverTimestamp(),\n    },\n    { merge: true },\n  )\n  return { cleared: Boolean(onFile) }\n}\n\nexport default seedUserProfile\n"],"names":["splitDisplayName","isBlankAddress","normalizeAddress","normalizePhone","FieldValue","getContactSuppression","suppressPhoneContact","firebaseAdmin","firestore","app","seedUserProfile","uid","input","ref","collection","doc","snapshot","get","firstName","lastName","displayName","blank","value","trim","seed","photoUrl","phoneNumber","refused","Boolean","suppression","undefined","erasePhoneOnFile","revokedAt","error","console","address","line1","exists","Object","keys","length","created","fields","serverTimestamp","set","merge","filter","key","forgetUserPhoneNumber","db","onFile","target","suppressed","result","source","recordedByUid","note","delete","phoneNumberErasedAt","cleared","forgetUserAddress","addressErasedAt"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;CAeC,GAED,SAASA,gBAAgB,QAAQ,2BAA0B;AAC3D,SACEC,cAAc,EACdC,gBAAgB,EAChBC,cAAc,QAET,sBAAqB;AAC5B,SAASC,UAAU,QAAQ,2BAA0B;AACrD,SACEC,qBAAqB,EACrBC,oBAAoB,QACf,2BAAuB;AAC9B,OAAOC,mBAAmB,sBAAkB;AAE5C,MAAMC,YAAY,IAAMD,cAAcE,GAAG,GAAGD,SAAS;AA0BrD;;;;;;;;;;;;;CAaC,GACD,OAAO,eAAeE,gBACpBC,GAAW,EACXC,QAA8B,CAAC,CAAC;QAEnBA;QAwCTA,iBAiCAA;IAzEJ,MAAMC,MAAM,EAACD,mBAAAA,MAAMJ,SAAS,YAAfI,mBAAmBJ,aAAaM,UAAU,CAAC,SAASC,GAAG,CAACJ;IACrE,MAAMK,WAAW,MAAMH,IAAII,GAAG;IAC9B,MAAM,EAAEC,SAAS,EAAEC,QAAQ,EAAE,GAAGnB,iBAAiBY,MAAMQ,WAAW;IAElE,MAAMC,QAAQ,CAACC,QACb,OAAOA,UAAU,YAAY,CAACA,MAAMC,IAAI;IAE1C,MAAMC,OAAgC,CAAC;IACvC,IAAIN,aAAaG,MAAML,SAASC,GAAG,CAAC,eAAeO,IAAI,CAAC,YAAY,GAAGN;IACvE,IAAIC,YAAYE,MAAML,SAASC,GAAG,CAAC,cAAcO,IAAI,CAAC,WAAW,GAAGL;IACpE,4EAA4E;IAC5E,yEAAyE;IACzE,2EAA2E;IAC3E,4CAA4C;IAC5C,EAAE;IACF,wEAAwE;IACxE,0EAA0E;IAC1E,2EAA2E;IAC3E,wEAAwE;IACxE,0EAA0E;IAC1E,6BAA6B;IAC7B,EAAE;IACF,0EAA0E;IAC1E,oEAAoE;IACpE,2EAA2E;IAC3E,wEAAwE;IACxE,oEAAoE;IACpE,uEAAuE;IACvE,EAAE;IACF,wEAAwE;IACxE,qEAAqE;IACrE,2EAA2E;IAC3E,sEAAsE;IACtE,qEAAqE;IACrE,4CAA4C;IAC5C,EAAE;IACF,uEAAuE;IACvE,2EAA2E;IAC3E,uEAAuE;IACvE,+DAA+D;IAC/D,IAAIP,EAAAA,kBAAAA,MAAMa,QAAQ,qBAAdb,gBAAgBW,IAAI,OAAMF,MAAML,SAASC,GAAG,CAAC,cAAc;QAC7D,IAAI,CAACD,SAASC,GAAG,CAAC,qBAAqBO,IAAI,CAAC,WAAW,GAAGZ,MAAMa,QAAQ,CAACF,IAAI;IAC/E;IACA,0EAA0E;IAC1E,2CAA2C;IAC3C,EAAE;IACF,2EAA2E;IAC3E,uEAAuE;IACvE,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,yDAAyD;IACzD,EAAE;IACF,yDAAyD;IACzD,EAAE;IACF,4EAA4E;IAC5E,2EAA2E;IAC3E,mDAAmD;IACnD,6EAA6E;IAC7E,mEAAmE;IACnE,yEAAyE;IACzE,wEAAwE;IACxE,wCAAwC;IACxC,EAAE;IACF,6EAA6E;IAC7E,0EAA0E;IAC1E,wEAAwE;IACxE,EAAE;IACF,6EAA6E;IAC7E,yEAAyE;IACzE,2EAA2E;IAC3E,sBAAsB;IACtB,IAAIX,EAAAA,qBAAAA,MAAMc,WAAW,qBAAjBd,mBAAmBW,IAAI,OAAMF,MAAML,SAASC,GAAG,CAAC,iBAAiB;QACnE,IAAIU,UAAUC,QAAQZ,SAASC,GAAG,CAAC;QACnC,IAAI,CAACU,SAAS;YACZ,IAAI;oBAGAf;gBAFF,MAAMiB,cAAc,MAAMxB,sBACxBO,MAAMc,WAAW,GACjBd,oBAAAA,MAAMJ,SAAS,YAAfI,oBAAmBkB;gBAErBH,UAAUC,QAAQC,+BAAAA,YAAaE,gBAAgB,KAAK,EAACF,+BAAAA,YAAaG,SAAS;YAC7E,EAAE,OAAOC,OAAO;gBACd,sEAAsE;gBACtE,mEAAmE;gBACnE,qEAAqE;gBACrE,8DAA8D;gBAC9DC,QAAQD,KAAK,CACX,gEACAA;gBAEFN,UAAU;YACZ;QACF;QACA,IAAI,CAACA,SAASH,IAAI,CAAC,cAAc,GAAGZ,MAAMc,WAAW,CAACH,IAAI;IAC5D;IAEA,2EAA2E;IAC3E,2EAA2E;IAC3E,6DAA6D;IAC7D,EAAE;IACF,4EAA4E;IAC5E,wEAAwE;IACxE,4EAA4E;IAC5E,2EAA2E;IAC3E,yEAAyE;IACzE,eAAe;IACf,EAAE;IACF,0EAA0E;IAC1E,4EAA4E;IAC5E,wEAAwE;IACxE,EAAE;IACF,6EAA6E;IAC7E,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,0EAA0E;IAC1E,sEAAsE;IACtE,EAAE;IACF,4EAA4E;IAC5E,wEAAwE;IACxE,2EAA2E;IAC3E,yEAAyE;IACzE,4EAA4E;IAC5E,6EAA6E;IAC7E,yEAAyE;IACzE,0EAA0E;IAC1E,sEAAsE;IACtE,EAAE;IACF,4EAA4E;IAC5E,0DAA0D;IAC1D,EAAE;IACF,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,2EAA2E;IAC3E,0EAA0E;IAC1E,yEAAyE;IACzE,sDAAsD;IACtD,EAAE;IACF,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,4EAA4E;IAC5E,4EAA4E;IAC5E,wCAAwC;IACxC,EAAE;IACF,6EAA6E;IAC7E,kEAAkE;IAClE,0EAA0E;IAC1E,oEAAoE;IACpE,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,gCAAgC;IAChC,EAAE;IACF,+EAA+E;IAC/E,2EAA2E;IAC3E,4EAA4E;IAC5E,8EAA8E;IAC9E,2EAA2E;IAC3E,6CAA6C;IAC7C,MAAMY,UAAUjC,iBAAiBU,MAAMuB,OAAO;IAC9C,IAAIA,CAAAA,2BAAAA,QAASC,KAAK,KAAInC,eAAee,SAASC,GAAG,CAAC,aAAa;QAC7D,IAAI,CAACD,SAASC,GAAG,CAAC,oBAAoBO,IAAI,CAAC,UAAU,GAAGW;IAC1D;IAEA,0EAA0E;IAC1E,yCAAyC;IACzC,IAAInB,SAASqB,MAAM,IAAI,CAACC,OAAOC,IAAI,CAACf,MAAMgB,MAAM,EAAE;QAChD,OAAO;YAAEC,SAAS;YAAOC,QAAQ,EAAE;QAAC;IACtC;IACA,sEAAsE;IACtE,uEAAuE;IACvE,mEAAmE;IACnE,IAAI,CAAC1B,SAASqB,MAAM,EAAEb,IAAI,CAAC,YAAY,GAAGpB,WAAWuC,eAAe;IAEpE,MAAM9B,IAAI+B,GAAG,CAACpB,MAAM;QAAEqB,OAAO;IAAK;IAClC,OAAO;QACLJ,SAAS,CAACzB,SAASqB,MAAM;QACzBK,QAAQJ,OAAOC,IAAI,CAACf,MAAMsB,MAAM,CAAC,CAACC,MAAQA,QAAQ;IACpD;AACF;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6CC,GACD,OAAO,eAAeC,sBAAsBpC,KAO3C;QACYA,kBAImBA;IAJ9B,MAAMqC,MAAKrC,mBAAAA,MAAMJ,SAAS,YAAfI,mBAAmBJ;IAC9B,MAAMK,MAAMoC,GAAGnC,UAAU,CAAC,SAASC,GAAG,CAACH,MAAMD,GAAG;IAChD,MAAMK,WAAW,MAAMH,IAAII,GAAG;IAC9B,MAAMiC,SAASlC,SAASqB,MAAM,GAAGrB,SAASC,GAAG,CAAC,iBAAiB;IAC/D,MAAMkC,SAAShD,gBAAeS,qBAAAA,MAAMc,WAAW,YAAjBd,qBAAqBsC;IAEnD,4EAA4E;IAC5E,2EAA2E;IAC3E,yEAAyE;IACzE,qDAAqD;IACrD,IAAIE,aAA4B;IAChC,IAAID,QAAQ;YAKOvC,sBACTA;QALR,MAAMyC,SAAS,MAAM/C,qBAAqB;YACxCoB,aAAayB;YACbG,QAAQ;YACR3C,KAAKC,MAAMD,GAAG;YACd4C,aAAa,GAAE3C,uBAAAA,MAAM2C,aAAa,YAAnB3C,uBAAuB;YACtC4C,IAAI,GAAE5C,cAAAA,MAAM4C,IAAI,YAAV5C,cAAc;YACpBmB,kBAAkB;WACdnB,MAAMJ,SAAS,GAAG;YAAEA,WAAWI,MAAMJ,SAAS;QAAC,IAAI,CAAC;QAE1D4C,aAAaC,OAAO3B,WAAW;IACjC;IAEA,yEAAyE;IACzE,wEAAwE;IACxE,4EAA4E;IAC5E,0CAA0C;IAC1C,MAAMb,IAAI+B,GAAG,CACX;QACElB,aAAatB,WAAWqD,MAAM;QAC9BC,qBAAqBtD,WAAWuC,eAAe;IACjD,GACA;QAAEE,OAAO;IAAK;IAEhB,OAAO;QAAEc,SAAS/B,QAAQsB;QAASE;IAAW;AAChD;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BC,GACD,OAAO,eAAeQ,kBAAkBhD,KAGvC;QACYA;IAAX,MAAMqC,MAAKrC,mBAAAA,MAAMJ,SAAS,YAAfI,mBAAmBJ;IAC9B,MAAMK,MAAMoC,GAAGnC,UAAU,CAAC,SAASC,GAAG,CAACH,MAAMD,GAAG;IAChD,MAAMK,WAAW,MAAMH,IAAII,GAAG;IAC9B,MAAMiC,SAASlC,SAASqB,MAAM,IAAI,CAACpC,eAAee,SAASC,GAAG,CAAC;IAC/D,MAAMJ,IAAI+B,GAAG,CACX;QACET,SAAS/B,WAAWqD,MAAM;QAC1BI,iBAAiBzD,WAAWuC,eAAe;IAC7C,GACA;QAAEE,OAAO;IAAK;IAEhB,OAAO;QAAEc,SAAS/B,QAAQsB;IAAQ;AACpC;AAEA,eAAexC,gBAAe"}

package/src/lib/server/vercel-drain-signature.d.ts

@@ -0,0 +1,30 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Is `signature` the drain signature for `rawBody` under `secret`?
+ *
+ * `secret` is passed in rather than read from the environment here so the
+ * caller owns the "unset means reject" decision visibly, and so the test can
+ * prove rejection without mutating `process.env`.
+ */
+export declare function isValidDrainSignature(rawBody: string, signature: string | null | undefined, secret: string | undefined): boolean;
+/**
+ * The signature Vercel would send for this body — test and tooling helper.
+ * Exported so the spec signs its fixtures the way the real sender does
+ * instead of restating the algorithm, which would let both drift together.
+ */
+export declare function drainSignatureFor(rawBody: string, secret: string): string;

package/src/lib/server/vercel-drain-signature.js

@@ -0,0 +1,61 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * `x-vercel-signature` verification for the log-drain receiver (AGL-1921).
+ *
+ * Its own module, with no dependency beyond `node:crypto`, so the security
+ * boundary can be tested without a Firebase app, a credential or a fetch —
+ * and so nothing in the ingest path can be imported without it.
+ *
+ * Vercel documents the header as `hmac-sha1(rawBody, drainSecret)` in hex
+ * (docs/drains/security). Two consequences that are easy to get wrong:
+ *
+ * 1. **RAW body.** `await request.text()` BEFORE any parse. Parsing and
+ *    re-serializing changes key order and whitespace and will not reproduce
+ *    the digest, and the failure looks like a wrong secret rather than a bug.
+ * 2. **Timing-safe compare.** A plain `===` on a hex digest leaks the digest
+ *    a byte at a time to an attacker who can post repeatedly, which for an
+ *    endpoint whose URL is discoverable is the entire attack.
+ *
+ * FAILS CLOSED at every branch: no secret configured, no header, wrong
+ * length, wrong value — all false. There is no configuration of this function
+ * under which an unsigned body is accepted.
+ */ import { createHmac, timingSafeEqual } from "node:crypto";
+/**
+ * Is `signature` the drain signature for `rawBody` under `secret`?
+ *
+ * `secret` is passed in rather than read from the environment here so the
+ * caller owns the "unset means reject" decision visibly, and so the test can
+ * prove rejection without mutating `process.env`.
+ */ export function isValidDrainSignature(rawBody, signature, secret) {
+    if (!secret) return false;
+    if (!signature) return false;
+    const expected = createHmac('sha1', secret).update(rawBody, 'utf8').digest('hex');
+    const provided = signature.trim().toLowerCase();
+    // `timingSafeEqual` THROWS on a length mismatch, which would be a 500 and a
+    // length oracle at once; compare lengths first and reject.
+    if (provided.length !== expected.length) return false;
+    return timingSafeEqual(Buffer.from(provided, 'utf8'), Buffer.from(expected, 'utf8'));
+}
+/**
+ * The signature Vercel would send for this body — test and tooling helper.
+ * Exported so the spec signs its fixtures the way the real sender does
+ * instead of restating the algorithm, which would let both drift together.
+ */ export function drainSignatureFor(rawBody, secret) {
+    return createHmac('sha1', secret).update(rawBody, 'utf8').digest('hex');
+}
+
+//# sourceMappingURL=vercel-drain-signature.js.map

package/src/lib/server/vercel-drain-signature.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/vercel-drain-signature.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * `x-vercel-signature` verification for the log-drain receiver (AGL-1921).\n *\n * Its own module, with no dependency beyond `node:crypto`, so the security\n * boundary can be tested without a Firebase app, a credential or a fetch —\n * and so nothing in the ingest path can be imported without it.\n *\n * Vercel documents the header as `hmac-sha1(rawBody, drainSecret)` in hex\n * (docs/drains/security). Two consequences that are easy to get wrong:\n *\n * 1. **RAW body.** `await request.text()` BEFORE any parse. Parsing and\n *    re-serializing changes key order and whitespace and will not reproduce\n *    the digest, and the failure looks like a wrong secret rather than a bug.\n * 2. **Timing-safe compare.** A plain `===` on a hex digest leaks the digest\n *    a byte at a time to an attacker who can post repeatedly, which for an\n *    endpoint whose URL is discoverable is the entire attack.\n *\n * FAILS CLOSED at every branch: no secret configured, no header, wrong\n * length, wrong value — all false. There is no configuration of this function\n * under which an unsigned body is accepted.\n */\nimport { createHmac, timingSafeEqual } from 'node:crypto'\n\n/**\n * Is `signature` the drain signature for `rawBody` under `secret`?\n *\n * `secret` is passed in rather than read from the environment here so the\n * caller owns the \"unset means reject\" decision visibly, and so the test can\n * prove rejection without mutating `process.env`.\n */\nexport function isValidDrainSignature(\n  rawBody: string,\n  signature: string | null | undefined,\n  secret: string | undefined,\n): boolean {\n  if (!secret) return false\n  if (!signature) return false\n  const expected = createHmac('sha1', secret)\n    .update(rawBody, 'utf8')\n    .digest('hex')\n  const provided = signature.trim().toLowerCase()\n  // `timingSafeEqual` THROWS on a length mismatch, which would be a 500 and a\n  // length oracle at once; compare lengths first and reject.\n  if (provided.length !== expected.length) return false\n  return timingSafeEqual(\n    Buffer.from(provided, 'utf8'),\n    Buffer.from(expected, 'utf8'),\n  )\n}\n\n/**\n * The signature Vercel would send for this body — test and tooling helper.\n * Exported so the spec signs its fixtures the way the real sender does\n * instead of restating the algorithm, which would let both drift together.\n */\nexport function drainSignatureFor(rawBody: string, secret: string): string {\n  return createHmac('sha1', secret).update(rawBody, 'utf8').digest('hex')\n}\n"],"names":["createHmac","timingSafeEqual","isValidDrainSignature","rawBody","signature","secret","expected","update","digest","provided","trim","toLowerCase","length","Buffer","from","drainSignatureFor"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;CAoBC,GACD,SAASA,UAAU,EAAEC,eAAe,QAAQ,cAAa;AAEzD;;;;;;CAMC,GACD,OAAO,SAASC,sBACdC,OAAe,EACfC,SAAoC,EACpCC,MAA0B;IAE1B,IAAI,CAACA,QAAQ,OAAO;IACpB,IAAI,CAACD,WAAW,OAAO;IACvB,MAAME,WAAWN,WAAW,QAAQK,QACjCE,MAAM,CAACJ,SAAS,QAChBK,MAAM,CAAC;IACV,MAAMC,WAAWL,UAAUM,IAAI,GAAGC,WAAW;IAC7C,4EAA4E;IAC5E,2DAA2D;IAC3D,IAAIF,SAASG,MAAM,KAAKN,SAASM,MAAM,EAAE,OAAO;IAChD,OAAOX,gBACLY,OAAOC,IAAI,CAACL,UAAU,SACtBI,OAAOC,IAAI,CAACR,UAAU;AAE1B;AAEA;;;;CAIC,GACD,OAAO,SAASS,kBAAkBZ,OAAe,EAAEE,MAAc;IAC/D,OAAOL,WAAW,QAAQK,QAAQE,MAAM,CAACJ,SAAS,QAAQK,MAAM,CAAC;AACnE"}