@aglyn/tenant-data-admin 1.0.0-beta.143

package/src/lib/server/lockdown.js

@@ -0,0 +1,643 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * Server half of the lockdown system (AGL-1501): the verdict every
+ * enforcement chokepoint asks for. The pure shape/precedence logic lives in
+ * `@aglyn/aglyn` `app-utils/lockdown.ts`; this module adds the Admin-SDK
+ * reads and the two properties only the server can hold:
+ *
+ * **The un-panic invariant.** A verified `staff` claim bypasses EVERY scope,
+ * unconditionally, before any read happens. A platform-wide lockdown must
+ * never lock out the staff who can lift it — a panic button that panics its
+ * own operator is worse than none. Nothing may be added to
+ * `getLockdownVerdict` above the staff check.
+ *
+ * **Fail-open on infrastructure error.** If the `lockdowns/platform` read
+ * throws (Firestore outage, emulator without the collection), the verdict is
+ * "not locked": an infrastructure blip must not weld the whole platform
+ * shut. The same posture as the sanctions gate on an absent geo signal
+ * (AGL-1492) and the release-flag reader on a missing template.
+ *
+ * **…except for takedowns (AGL-1621).** One class of lock inverts that cost
+ * function: a legal or abuse takedown must keep holding when Firestore is
+ * unreachable, because "we served it, our database was down" answers no
+ * court order. The class is an EXPLICIT stored field (`enforcement`), never
+ * inferred from scope or reason, and absent means `standard` — so every
+ * lock that exists today, and every lock an operator does not classify,
+ * keeps failing open exactly as before. See the takedown ledger below for
+ * how a classification survives the read that loses it.
+ */ import { featureLockdownDocId, orgFeatureLockdownDocId, isLockdownActive, isTakedownLockdown, lockdownFeatureStaffBypass, LOCKDOWNS_COLLECTION, lockdownBlocks, lockdownIntentForMethod, lockdownNotice, lockdownRetryAfterSeconds, domainLockdownDocId, normalizeHostLockdown, normalizeLockdownDoc, normalizeOrgLockdown, PLATFORM_LOCKDOWN_DOC_ID, resolveLockdown, userLockdownDocId } from "@aglyn/aglyn/server";
+import { getApp } from "firebase-admin/app";
+import firebaseAdmin from "./firebase-admin.js";
+/**
+ * Platform-doc TTL. Short on purpose: this is the panic path, and 15s is the
+ * worst-case lag between staff pressing the button and a warm server process
+ * refusing its next request. Per-request reads would be ~1 Firestore read
+ * per API call platform-wide, which AGL-1302 showed is real money at scale.
+ */ const PLATFORM_TTL_MS = 15000;
+/**
+ * ===================== THE TAKEDOWN LEDGER (AGL-1621) =====================
+ *
+ * Lockdown fails open, and that stays true for ordinary locks: an
+ * unreachable Firestore is an outage, not a lockdown, and a blip must never
+ * weld every customer site shut. But a legal or abuse TAKEDOWN has the
+ * opposite cost function — "we served the infringing content because our
+ * database was down" is not an answer to a court order. So takedown-class
+ * locks (`enforcement: 'takedown'`) hold through a failed read, and
+ * everything else keeps today's behaviour exactly.
+ *
+ * ## The ordering problem this exists to solve
+ *
+ * The classification is stored ON the lock document. When the read throws
+ * there IS no document, so the class cannot be consulted at failure time —
+ * the obvious implementation ("if the lock is a takedown, fail closed") is
+ * unimplementable as written, because the failure is precisely the loss of
+ * the thing it wants to branch on.
+ *
+ * The only honest source is what this process last SUCCESSFULLY read. So
+ * every successful read records its verdict here: a takedown is remembered,
+ * and anything else RETIRES the entry. A subsequent failed read consults
+ * the ledger instead of falling to null.
+ *
+ * ## What this does and does not guarantee — stated, not implied
+ *
+ * HOLDS: a takedown that a process has already observed keeps being
+ * enforced by that process for as long as Firestore is unreachable. That is
+ * the real incident shape — a takedown placed hours or days ago, then a
+ * Firestore blip — and it is what the decision asks for.
+ *
+ * DOES NOT HOLD: a COLD process that has never once read the takedown has
+ * nothing to remember and fails open, like everything else. Closing that
+ * gap needs a second carrier more available than Firestore (edge config or
+ * similar), which is a different and much larger change; pretending
+ * otherwise here would be worse than naming it. A takedown placed DURING a
+ * total Firestore outage is likewise not enforceable — the write itself
+ * cannot land.
+ *
+ * ## Two things it deliberately does not do
+ *
+ * It is NOT cleared by `invalidate*LockdownCache`. Those run after a staff
+ * write, and clearing the ledger there would mean a lock-then-outage
+ * sequence forgot the takedown at the exact moment it mattered. The next
+ * successful read is what retires an entry, and a lift IS such a read.
+ *
+ * It does not outlive the lock's own expiry: a held takedown is still
+ * checked against `isLockdownActive`, so a `untilMs` that has passed
+ * releases on schedule even while Firestore is down. A dead-man expiry must
+ * not become un-liftable by being classified.
+ */ const takedownLedger = new Map();
+/**
+ * Bounded like the user and domain caches, and for the same reason: two of
+ * the four keyed readers take their key from caller-controlled input.
+ * Eviction is least-recently-USED.
+ */ export const TAKEDOWN_LEDGER_MAX = 5000;
+/**
+ * Record what a SUCCESSFUL read saw. A takedown is remembered; anything
+ * else — no lock, an ordinary lock, or a lock whose class this build cannot
+ * interpret — retires the entry, which is how a lift takes effect.
+ */ function rememberTakedown(key, state) {
+    if (!state || !isTakedownLockdown(state)) {
+        takedownLedger.delete(key);
+        return;
+    }
+    // Re-insert to refresh recency before the LRU trim below.
+    takedownLedger.delete(key);
+    takedownLedger.set(key, state);
+    while(takedownLedger.size > TAKEDOWN_LEDGER_MAX){
+        const oldest = takedownLedger.keys().next().value;
+        if (oldest === undefined) break;
+        takedownLedger.delete(oldest);
+    }
+}
+/**
+ * What a FAILED read should serve: a remembered, still-active takedown, or
+ * null — which is the shipped fail-open answer and therefore the default
+ * for every lock that is not an observed takedown.
+ */ function heldTakedown(key, nowMs) {
+    const state = takedownLedger.get(key);
+    if (!state) return null;
+    if (!isLockdownActive(state, nowMs)) {
+        takedownLedger.delete(key);
+        return null;
+    }
+    return state;
+}
+/**
+ * Forget every remembered takedown. NOT part of the panic path and not
+ * called by the admin route — this exists for process-boundary and test
+ * setup, where a ledger surviving between cases would make one test's lock
+ * another test's fail-closed verdict.
+ */ export function resetTakedownLedger() {
+    takedownLedger.clear();
+}
+/** Ledger keys. Disjoint by construction — the doc-id prefixes already are. */ const PLATFORM_LEDGER_KEY = 'platform';
+const featureLedgerKey = (feature)=>featureLockdownDocId(feature);
+const userLedgerKey = (uid)=>userLockdownDocId(uid);
+const domainLedgerKey = (hostname)=>domainLockdownDocId(hostname);
+/**
+ * ORG and HOST scope (AGL-1881). These two locks have no document in
+ * `lockdowns/*` — they live as the `suspended*` family ON the org and host
+ * documents — so they never passed through a ledgered reader, and
+ * `getSiteLockdown` answered `null` flat when its reads threw. The route
+ * persists `suspendedEnforcement: 'takedown'` for both scopes all the same,
+ * from a control that promises the lock "keeps holding if Aglyn cannot reach
+ * the database". A court-ordered host takedown plus a partial Firestore
+ * outage therefore served the infringing site for the duration of the
+ * outage, which is the precise failure the mode exists to prevent.
+ *
+ * Keyed by HOST ID, both of them, including the org one. Every reader on
+ * this path is host-addressed, and on a failed read the org id is exactly as
+ * unreadable as the lock — `getOrgForHost` is the read that just threw. So
+ * "the org lock as seen through this host" is the only thing a failed read
+ * can look up, and it matches the ledger's existing warm-process semantics:
+ * an org takedown holds for each site a process has already read once.
+ *
+ * Distinct prefixes keep them disjoint from the four doc-id keys above
+ * (`platform`, `feature--`, `user--`, `domain--`).
+ */ const orgForHostLedgerKey = (hostId)=>`org--for-host--${hostId}`;
+const hostLedgerKey = (hostId)=>`host--${hostId}`;
+/**
+ * Record what a SUCCESSFUL site read saw, per scope. Same contract as the
+ * four `lockdowns/*` readers: a takedown is remembered, and anything else —
+ * no lock, an ordinary lock, a takedown DOWNGRADED to one — retires the
+ * entry, which is how a lift takes effect.
+ */ export function rememberSiteTakedown(hostId, states) {
+    rememberTakedown(orgForHostLedgerKey(hostId), states.org);
+    rememberTakedown(hostLedgerKey(hostId), states.host);
+}
+/**
+ * What a FAILED site read may still serve: the remembered, still-active
+ * takedowns at org and host scope, or nulls — which is the shipped fail-open
+ * answer and therefore the default for every lock that is not an observed
+ * takedown.
+ */ export function heldSiteTakedown(hostId, nowMs) {
+    return {
+        org: heldTakedown(orgForHostLedgerKey(hostId), nowMs),
+        host: heldTakedown(hostLedgerKey(hostId), nowMs)
+    };
+}
+let platformCache;
+let platformPending;
+/**
+ * Drop the in-process platform cache. Called by /api/admin/lockdown after a
+ * platform write so the process that took the action serves fresh verdicts
+ * immediately; other processes converge within PLATFORM_TTL_MS.
+ */ export function invalidatePlatformLockdownCache() {
+    platformCache = undefined;
+    platformPending = undefined;
+}
+/** `lockdowns/platform`, normalized; null = not locked (incl. on error). */ export async function getPlatformLockdown() {
+    if (platformCache && Date.now() - platformCache.at < PLATFORM_TTL_MS) {
+        return platformCache.state;
+    }
+    if (!platformPending) {
+        platformPending = (async ()=>{
+            let state;
+            try {
+                const snapshot = await firebaseAdmin.app().firestore().collection(LOCKDOWNS_COLLECTION).doc(PLATFORM_LOCKDOWN_DOC_ID).get();
+                state = snapshot.exists ? normalizeLockdownDoc(snapshot.data(), 'platform') : null;
+                rememberTakedown(PLATFORM_LEDGER_KEY, state);
+            } catch (unused) {
+                // Fail open: an unreachable Firestore is an outage, not a lockdown
+                // — UNLESS this process has already seen a takedown here, which is
+                // the one class that must survive the read failing (AGL-1621).
+                state = heldTakedown(PLATFORM_LEDGER_KEY, Date.now());
+            }
+            platformCache = {
+                at: Date.now(),
+                state
+            };
+            return state;
+        })().finally(()=>{
+            platformPending = undefined;
+        });
+    }
+    return platformPending;
+}
+/**
+ * Feature-doc cache (AGL-1510): same TTL and the same reasoning as the
+ * platform doc — feature gates sit on hot chokepoints (the session mint,
+ * every media ingress, the plugin dispatcher), and 15s is the worst-case
+ * lag between staff flipping a feature switch and a warm process enforcing
+ * it. One map for all keys; the admin route invalidates after every write.
+ */ /**
+ * Keyed by DOCUMENT ID rather than by feature key since AGL-2927, so the
+ * platform-wide `feature--{key}` entry and each workspace's
+ * `feature--{key}--org--{orgId}` entry share one map, one TTL and one
+ * invalidation — the admin route's write clears both kinds at once.
+ */ const featureCache = new Map();
+const featurePending = new Map();
+/** Drop the in-process feature cache (all keys) after an admin write. */ export function invalidateFeatureLockdownCache() {
+    featureCache.clear();
+    featurePending.clear();
+}
+/** One feature-scope carrier, by document id — see `getFeatureLockdown`. */ async function readFeatureLockdownDoc(docId) {
+    const cached = featureCache.get(docId);
+    if (cached && Date.now() - cached.at < PLATFORM_TTL_MS) return cached.state;
+    let pending = featurePending.get(docId);
+    if (!pending) {
+        pending = (async ()=>{
+            let state;
+            try {
+                const snapshot = await firebaseAdmin.app().firestore().collection(LOCKDOWNS_COLLECTION).doc(docId).get();
+                state = snapshot.exists ? normalizeLockdownDoc(snapshot.data(), 'feature') : null;
+                rememberTakedown(docId, state);
+            } catch (unused) {
+                // Fail open, matching the platform read: an unreachable Firestore is
+                // an outage, not a feature lockdown. A takedown-class feature lock
+                // this process has already observed still holds (AGL-1621).
+                state = heldTakedown(docId, Date.now());
+            }
+            featureCache.set(docId, {
+                at: Date.now(),
+                state
+            });
+            return state;
+        })().finally(()=>{
+            featurePending.delete(docId);
+        });
+        featurePending.set(docId, pending);
+    }
+    return pending;
+}
+/** `lockdowns/feature--{key}`, normalized; null = not locked (incl. error). */ export async function getFeatureLockdown(feature) {
+    return readFeatureLockdownDoc(featureLedgerKey(feature));
+}
+/**
+ * `lockdowns/feature--{key}--org--{orgId}` (AGL-2927): the same capability
+ * paused for ONE workspace. Same cache, same TTL, same fail-open posture as
+ * the platform-wide document; null = not paused for that org.
+ */ export async function getOrgFeatureLockdown(feature, orgId) {
+    return readFeatureLockdownDoc(orgFeatureLockdownDocId(feature, orgId));
+}
+/**
+ * The feature verdict and refusal in one call (AGL-1510) — the one-line
+ * wiring a feature chokepoint carries:
+ *
+ *   const locked = await featureLockdownRefusal({ feature: 'checkout', staff })
+ *   if (locked) return locked
+ *
+ * Composition, not ranking: a PLATFORM lock implies every feature, so it is
+ * checked first (TTL-cached — routes that already ran the scope verdict pay
+ * no extra read), and the platform-scope staff bypass there is UNCHANGED
+ * and unconditional. The feature doc is checked second, and its staff
+ * bypass is per-feature (`lockdownFeatureStaffBypass`): granted where a
+ * staff action aids incident response (uploads, installs, ai-assist),
+ * withheld where it would BE the incident (checkout — a staff checkout
+ * session is still a real charge). A feature lock implies nothing about the
+ * org/host/user scopes — those stay with `lockdownRefusal` at the routes
+ * that carry it.
+ *
+ * A door that names the org it serves passes `orgId` (AGL-2927), and the
+ * workspace-scoped carrier for the same feature is checked third, under the
+ * same per-feature staff bypass: the staff AI pause is a spend stop on one
+ * customer, and a staff call made to verify the pause is ours to spend. A
+ * door that names no org — the plugin dispatcher, which gates by path
+ * before the body is read — sees the platform-wide document only, which is
+ * what it saw before.
+ */ export async function featureLockdownRefusal(options) {
+    var _options_nowMs;
+    var _options_orgId;
+    const nowMs = (_options_nowMs = options.nowMs) != null ? _options_nowMs : Date.now();
+    const platform = await getPlatformLockdown();
+    if (isLockdownActive(platform, nowMs)) {
+        // The un-panic invariant at the platform scope, unchanged.
+        if (options.staff === true) return null;
+        return lockdownJsonResponse(platform);
+    }
+    const bypass = options.staff === true && lockdownFeatureStaffBypass(options.feature);
+    const state = await getFeatureLockdown(options.feature);
+    if (isLockdownActive(state, nowMs)) {
+        return bypass ? null : lockdownJsonResponse(state);
+    }
+    const orgId = (_options_orgId = options.orgId) == null ? void 0 : _options_orgId.trim();
+    if (!orgId) return null;
+    const paused = await getOrgFeatureLockdown(options.feature, orgId);
+    if (!isLockdownActive(paused, nowMs)) return null;
+    return bypass ? null : lockdownJsonResponse(paused);
+}
+/**
+ * User-doc cache (AGL-1522): the last per-call read on the verdict path.
+ * AGL-1506 wired the verdict into ~36 routes plus the session mint/exchange,
+ * and every call carrying a `uid` paid one Firestore get on
+ * `lockdowns/user--{uid}` — an active console editor generated one read per
+ * wired mutation, against the AGL-1302 read budget. Same TTL, same pending
+ * dedupe, same fail-open posture as the platform and feature caches above —
+ * ONE cache pattern in this module, not three implementations.
+ *
+ * The staleness tradeoff, stated: a user locked mid-window keeps passing
+ * this check for up to PLATFORM_TTL_MS (15s) plus the caller's polling
+ * cadence — on every process EXCEPT the one that took the action, which
+ * refuses immediately because /api/admin/lockdown invalidates this uid's
+ * entry after the write (the platform/feature invalidation hook, mirrored).
+ * That bound is acceptable here for the same reason `media/sign` omits the
+ * user scope entirely: the hard kill never rode this read. A user lock also
+ * disables the Auth account and revokes refresh tokens, so the ID token
+ * stops refreshing and the session cookie dies at its next
+ * `verifySessionCookie(…, true)` — the cache can only delay the DISTINCT
+ * 423 body, not access itself, and 15s matches the platform scope's stated
+ * worst case and the drill's measured flip times.
+ *
+ * Bounded so a scan of uids cannot balloon a warm process: past
+ * USER_LOCKDOWN_CACHE_MAX entries the least-recently-USED is evicted (a
+ * cache hit refreshes recency, so active sessions survive a scan).
+ */ export const USER_LOCKDOWN_CACHE_MAX = 5000;
+const userCache = new Map();
+const userPending = new Map();
+/**
+ * Drop one uid's cached verdict (after a user lock/unlock write), or the
+ * whole cache when called bare. The acting process serves a fresh verdict
+ * immediately; other processes converge within PLATFORM_TTL_MS.
+ */ export function invalidateUserLockdownCache(uid) {
+    if (uid === undefined) {
+        userCache.clear();
+        userPending.clear();
+        return;
+    }
+    userCache.delete(uid);
+    userPending.delete(uid);
+}
+/** `lockdowns/user--{uid}`, normalized; null = not locked (incl. on error). */ export async function getUserLockdown(uid) {
+    const cached = userCache.get(uid);
+    if (cached && Date.now() - cached.at < PLATFORM_TTL_MS) {
+        // Re-insert to refresh recency: eviction is by least-recently-used, and
+        // an ACTIVE session must not be the one a uid scan pushes out.
+        userCache.delete(uid);
+        userCache.set(uid, cached);
+        return cached.state;
+    }
+    let pending = userPending.get(uid);
+    if (!pending) {
+        pending = (async ()=>{
+            let state;
+            try {
+                const snapshot = await firebaseAdmin.app().firestore().collection(LOCKDOWNS_COLLECTION).doc(userLockdownDocId(uid)).get();
+                state = snapshot.exists ? normalizeLockdownDoc(snapshot.data(), 'user') : null;
+                rememberTakedown(userLedgerKey(uid), state);
+            } catch (unused) {
+                // Fail open, matching the platform and feature reads: an unreachable
+                // Firestore is an outage, not a lockdown. An observed takedown-class
+                // user lock holds through it (AGL-1621).
+                state = heldTakedown(userLedgerKey(uid), Date.now());
+            }
+            userCache.delete(uid);
+            userCache.set(uid, {
+                at: Date.now(),
+                state
+            });
+            while(userCache.size > USER_LOCKDOWN_CACHE_MAX){
+                const oldest = userCache.keys().next().value;
+                if (oldest === undefined) break;
+                userCache.delete(oldest);
+            }
+            return state;
+        })().finally(()=>{
+            userPending.delete(uid);
+        });
+        userPending.set(uid, pending);
+    }
+    return pending;
+}
+/**
+ * DOMAIN-lock cache (AGL-1513), same shape and same TTL as the user cache.
+ *
+ * Bounded for the same reason and one more: the key is a HOSTNAME taken from
+ * the request, so an unbounded map here would be attacker-keyed by anyone who
+ * can point a DNS record at us — which, for the hijack incident this scope
+ * exists for, is the adversary by definition.
+ */ export const DOMAIN_LOCKDOWN_CACHE_MAX = 5000;
+const domainCache = new Map();
+const domainPending = new Map();
+/**
+ * Drop one hostname's cached verdict (after a domain lock/unlock write), or
+ * the whole cache when called bare.
+ */ export function invalidateDomainLockdownCache(hostname) {
+    if (hostname === undefined) {
+        domainCache.clear();
+        domainPending.clear();
+        return;
+    }
+    const key = hostname.trim().toLowerCase();
+    domainCache.delete(key);
+    domainPending.delete(key);
+}
+/**
+ * `lockdowns/domain--{hostname}`, normalized; null = not locked (incl. on
+ * error), matching every other reader here — an unreachable Firestore is an
+ * outage, not a lockdown.
+ */ export async function getDomainLockdown(hostname) {
+    const key = String(hostname != null ? hostname : '').trim().toLowerCase();
+    if (!key) return null;
+    const cached = domainCache.get(key);
+    if (cached && Date.now() - cached.at < PLATFORM_TTL_MS) {
+        // Re-insert to refresh recency, like the user cache: eviction is
+        // least-recently-USED, and a domain under active dispute is exactly the
+        // one a scan must not push out.
+        domainCache.delete(key);
+        domainCache.set(key, cached);
+        return cached.state;
+    }
+    let pending = domainPending.get(key);
+    if (!pending) {
+        pending = (async ()=>{
+            let state;
+            try {
+                const snapshot = await firebaseAdmin.app().firestore().collection(LOCKDOWNS_COLLECTION).doc(domainLockdownDocId(key)).get();
+                state = snapshot.exists ? normalizeLockdownDoc(snapshot.data(), 'domain') : null;
+                rememberTakedown(domainLedgerKey(key), state);
+            } catch (unused) {
+                // Fail open, as above — and, as above, an observed takedown holds.
+                // This is the scope where that matters most: AGL-1513's hijack and
+                // dispute incidents are takedowns almost by definition.
+                state = heldTakedown(domainLedgerKey(key), Date.now());
+            }
+            domainCache.delete(key);
+            domainCache.set(key, {
+                at: Date.now(),
+                state
+            });
+            while(domainCache.size > DOMAIN_LOCKDOWN_CACHE_MAX){
+                const oldest = domainCache.keys().next().value;
+                if (oldest === undefined) break;
+                domainCache.delete(oldest);
+            }
+            return state;
+        })().finally(()=>{
+            domainPending.delete(key);
+        });
+        domainPending.set(key, pending);
+    }
+    return pending;
+}
+/** The declared or derived intent of a verdict request; `write` by default. */ function verdictIntent(options) {
+    if (options.intent) return options.intent;
+    if (options.request) return lockdownIntentForMethod(options.request.method);
+    return 'write';
+}
+/**
+ * The one verdict: the lockdown that REFUSES this caller's request, or null.
+ * Precedence platform > org > host > user, strictness before width (from
+ * `resolveLockdown`).
+ *
+ * "Refuses this request" rather than "covers this caller" since AGL-1511: a
+ * read-only lock is active but does not refuse a read, and returning it
+ * anyway would make every wired chokepoint 423 a GET — a read-only mode that
+ * behaves exactly like a full one. The active state is still what
+ * `resolveLockdown` chose, so the staff probe and the notice copy see the
+ * real lock; only the ANSWER is intent-aware.
+ */ export async function getLockdownVerdict(options) {
+    var _options_nowMs;
+    // THE UN-PANIC INVARIANT. Staff are never locked out, by any scope, ever
+    // — they are the only ones who can lift a lockdown. Keep this line first:
+    // everything below it may read Firestore, and a staff verdict must not
+    // depend on any read succeeding.
+    //
+    // This line is also the whole of AGL-1511's "staff writes bypass
+    // read-only": staff bypass every scope AND every mode, unconditionally,
+    // and read-only exists precisely so staff can work while the world reads.
+    // A mode-aware staff rule below would be a second bypass to keep correct.
+    if (options.staff === true) return null;
+    const nowMs = (_options_nowMs = options.nowMs) != null ? _options_nowMs : Date.now();
+    const [platform, user] = await Promise.all([
+        getPlatformLockdown(),
+        options.uid ? getUserLockdown(options.uid) : Promise.resolve(null)
+    ]);
+    const state = resolveLockdown({
+        platform,
+        org: normalizeOrgLockdown(options.org),
+        host: normalizeHostLockdown(options.host),
+        user
+    }, nowMs);
+    return lockdownBlocks(state, verdictIntent(options)) ? state : null;
+}
+/**
+ * The refusal an API route returns for a locked caller: **423 Locked** with
+ * a machine-readable body, so an API consumer sees "suspended: billing" and
+ * not a mystery 403. Carries only the sanitized, user-facing subset — never
+ * the actor uid or staff rationale.
+ */ /**
+ * Verdict and refusal in one call — the two-line wiring every org-scoped
+ * API route carries (AGL-1506):
+ *
+ *   const locked = await lockdownRefusal({ staff, uid, org, host })
+ *   if (locked) return locked
+ *
+ * Null means "not locked, proceed". One mechanism: this delegates to
+ * `getLockdownVerdict` (so the un-panic invariant and fail-open posture are
+ * inherited, never re-implemented) and to `lockdownJsonResponse` for the
+ * distinct 423 body. Routes with a richer flow (the session mint clears
+ * cookies on refusal) keep calling the two halves directly.
+ */ export async function lockdownRefusal(options) {
+    const state = await getLockdownVerdict(options);
+    return state ? lockdownJsonResponse(state, {
+        notice: options.notice
+    }) : null;
+}
+export function lockdownJsonResponse(state, options) {
+    var _ref;
+    const notice = (_ref = options == null ? void 0 : options.notice) != null ? _ref : lockdownNotice(state);
+    const retryAfter = lockdownRetryAfterSeconds(state, Date.now());
+    return Response.json(_extends({
+        error: 'locked',
+        scope: state.scope
+    }, state.mode ? {
+        mode: state.mode
+    } : {}, state.feature ? {
+        feature: state.feature
+    } : {}, {
+        reason: state.reason,
+        title: notice.title,
+        message: notice.body
+    }, notice.contact ? {
+        contact: notice.contact
+    } : {}, typeof state.untilMs === 'number' ? {
+        untilMs: state.untilMs
+    } : {}), {
+        status: 423,
+        headers: _extends({
+            'Cache-Control': 'no-store'
+        }, retryAfter ? {
+            'Retry-After': String(retryAfter)
+        } : {})
+    });
+}
+/** Bounded: the panic page must render even when this call is the slow one. */ const IDENTITY_CONFIG_TIMEOUT_MS = 4000;
+export async function readSignupsCreationTriggerStatus() {
+    let token;
+    let projectId;
+    try {
+        var _app_options_projectId;
+        var _this, _app_options_credential;
+        // `getApp()`, not `firebaseAdmin.app()`: the local shim narrows the app
+        // to its four accessors and drops `options`, which is where the
+        // credential and the project id live. Same acquisition path as the
+        // error-beacon target (`client-error-report.ts`).
+        const app = getApp();
+        projectId = (_app_options_projectId = app.options.projectId) != null ? _app_options_projectId : process.env['NEXT_PUBLIC_FIREBASE_PROJECT_ID'];
+        token = (_this = await ((_app_options_credential = app.options.credential) == null ? void 0 : _app_options_credential.getAccessToken())) == null ? void 0 : _this.access_token;
+    } catch (unused) {
+        token = undefined;
+    }
+    if (!token || !projectId) {
+        return {
+            status: 'unknown',
+            reason: 'No admin credential or project id on this deployment, so the ' + 'Identity Platform config could not be read.'
+        };
+    }
+    const controller = new AbortController();
+    const timer = setTimeout(()=>controller.abort(), IDENTITY_CONFIG_TIMEOUT_MS);
+    try {
+        var _trigger_functionUri, _trigger_updateTime;
+        var _payload_blockingFunctions_triggers, _payload_blockingFunctions;
+        const response = await fetch(`https://identitytoolkit.googleapis.com/admin/v2/projects/${encodeURIComponent(projectId)}/config`, {
+            headers: {
+                Authorization: `Bearer ${token}`
+            },
+            signal: controller.signal
+        });
+        if (!response.ok) {
+            return {
+                status: 'unknown',
+                reason: `Identity Platform config read returned ${response.status}.`
+            };
+        }
+        const payload = await response.json();
+        // The trigger key Identity Platform uses is `beforeCreate`; the Firebase
+        // SDK's `beforeUserCreated` is what registers it. Absent means the valve
+        // is not deployed OR was deployed and never registered — indistinguishable
+        // from here, and both mean the same thing to an operator: creation is not
+        // being refused.
+        const trigger = (_payload_blockingFunctions = payload.blockingFunctions) == null ? void 0 : (_payload_blockingFunctions_triggers = _payload_blockingFunctions.triggers) == null ? void 0 : _payload_blockingFunctions_triggers['beforeCreate'];
+        if (!trigger) return {
+            status: 'absent'
+        };
+        return {
+            status: 'armed',
+            functionUri: (_trigger_functionUri = trigger.functionUri) != null ? _trigger_functionUri : null,
+            updateTime: (_trigger_updateTime = trigger.updateTime) != null ? _trigger_updateTime : null
+        };
+    } catch (error) {
+        return {
+            status: 'unknown',
+            reason: (error == null ? void 0 : error.name) === 'AbortError' ? 'Identity Platform config read timed out.' : 'Identity Platform config could not be read.'
+        };
+    } finally{
+        clearTimeout(timer);
+    }
+}
+
+//# sourceMappingURL=lockdown.js.map