@aglyn/tenant-data-admin 1.0.0-beta.219 → 1.0.0-beta.221

package/src/lib/server/leaving-notice.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/leaving-notice.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*==========================================\n * THE \"YOU'RE LEAVING THIS SITE\" NOTICE, SERVER HALF (AGL-3452).\n *\n * Who gets it, which hosts are exempt, and the signature that keeps the\n * notice route from becoming an open redirect. The client half — rewriting\n * an href, the click interceptor — is `@aglyn/aglyn/app-utils/leaving-notice`.\n *\n * ## Who\n *\n * A site whose workspace is on the FREE plan (the effective plan, so a dead\n * subscription counts as free, as it does for every entitlement) and in its\n * first {@link LEAVING_NOTICE_DAYS} days — the same window, read through the\n * same `isYoungWorkspaceAge`, as the soft phishing rules. Paid and older\n * workspaces are untouched, and a workspace whose creation date cannot be\n * read is an existing customer, never a new one.\n *\n * ## Why signed\n *\n * The notice lives on the site's own host and its Continue button goes\n * wherever `?to=` says. Unsigned, any site's notice would be a page that\n * vouches for any address anyone puts in a link — the hop this feature exists\n * to remove. So the server signs each outside address it finds on a page it\n * renders, bound to that site, and the route shows a Continue button only for\n * an address whose signature checks out. Everything else is refused.\n *\n * The signature carries no expiry on purpose. The route never redirects on\n * its own, so a signature that outlives its page buys nothing but one more\n * view of the same warning — while an expiring one would break the links an\n * ISR-cached page is still serving the moment the window closes.\n *=========================================*/\n\nimport { createHmac } from 'crypto'\nimport { DOCS_BASE_URL } from '@aglyn/aglyn/app-utils/docs-help'\nimport {\n  type LeavingNoticeConfig,\n  leavingDestination,\n  normalizeLeavingDestination,\n} from '@aglyn/aglyn/app-utils/leaving-notice'\nimport { resolveEffectivePlan } from '@aglyn/aglyn/app-utils/plan-entitlements'\nimport {\n  PLATFORM_HOME_URL,\n  PLATFORM_SUPPORT_URL,\n  platformConsoleOrigin,\n} from '@aglyn/aglyn/app-utils/platform-brand'\nimport {\n  type SiteReturnHost,\n  siteOwnHosts,\n} from '@aglyn/aglyn/app-utils/site-return-url'\nimport { TENANT_APEX } from '@aglyn/aglyn/app-utils/tenant-apex'\nimport {\n  isYoungWorkspaceAge,\n  OUTBOUND_REVIEW_YOUNG_DAYS,\n  registrableDomain,\n} from '@aglyn/shared-util-email/outbound-phishing-screen'\nimport { tokenSigningSecret } from './media-signing'\nimport { orgAgeDays, orgCreatedMs } from './org-age'\nimport { safeEqual } from './safe-equal'\n\n/** How long a new free workspace's sites carry the notice. */\nexport const LEAVING_NOTICE_DAYS = OUTBOUND_REVIEW_YOUNG_DAYS\n\nconst DAY_MS = 86_400_000\n\n/**\n * The most outside addresses one page is signed for. A page with more is a\n * link farm, and the ones past the cap still go through the notice — which\n * refuses them — rather than around it.\n */\nexport const LEAVING_NOTICE_MAX_DESTINATIONS = 500\n\n/** Deepest a page payload is walked; composed node maps sit far above it. */\nconst MAX_WALK_DEPTH = 64\n\n/** Longest string scanned for embedded addresses (a long entry body). */\nconst MAX_SCANNED_STRING = 200_000\n\n/**\n * When a workspace's notice window closes (epoch ms), or `null` when its\n * sites carry no notice: a paid plan, a workspace past its first\n * {@link LEAVING_NOTICE_DAYS} days, or one whose creation date is unreadable.\n *\n * Takes the org as loaded anywhere — a live document, or the render cache's\n * JSON copy, whose `createdAt` has lost its methods (`orgCreatedMs`).\n */\nexport function leavingNoticeEndsAt(\n  org: unknown,\n  nowMs: number = Date.now(),\n): number | null {\n  if (!org || typeof org !== 'object') return null\n  if (resolveEffectivePlan(org as never) !== 'free') return null\n  const createdAt = (org as { createdAt?: unknown }).createdAt\n  if (!isYoungWorkspaceAge(orgAgeDays(createdAt, nowMs))) return null\n  const createdMs = orgCreatedMs(createdAt)\n  return createdMs === null ? null : createdMs + LEAVING_NOTICE_DAYS * DAY_MS\n}\n\nfunction hostnameOf(raw: string | null | undefined): string | null {\n  if (!raw) return null\n  try {\n    const url = new URL(raw)\n    if (url.protocol !== 'http:' && url.protocol !== 'https:') return null\n    return url.hostname.toLowerCase() || null\n  } catch {\n    return null\n  }\n}\n\n/**\n * The hosts a link may reach without the notice: the site's own (its\n * subdomain, its custom domain and `www.` of it) and the platform's own — the\n * marketing site, console, support and docs, each with every name under its\n * registrable domain, plus the bare tenant apex.\n *\n * Other sites on the tenant apex are NOT exempt. They are other customers'\n * sites, and a chain of two new free sites is the same hop as one.\n */\nexport function leavingNoticeHosts(\n  site: SiteReturnHost | null | undefined,\n): string[] {\n  const hosts = new Set<string>(siteOwnHosts(site))\n  const apex = TENANT_APEX.toLowerCase()\n  hosts.add(apex)\n  const apexRegistrable = registrableDomain(apex)\n  for (const raw of [\n    PLATFORM_HOME_URL,\n    platformConsoleOrigin(),\n    PLATFORM_SUPPORT_URL,\n    DOCS_BASE_URL,\n  ]) {\n    const hostname = hostnameOf(raw)\n    if (!hostname) continue\n    hosts.add(hostname)\n    const registrable = registrableDomain(hostname)\n    // A platform name under the tenant apex itself must not exempt the apex:\n    // that would exempt every customer's site with it.\n    if (registrable.includes('.') && registrable !== apexRegistrable) {\n      hosts.add(`.${registrable}`)\n    }\n  }\n  return [...hosts]\n}\n\n/** An address as it appears in text: scheme, then anything a URL may hold. */\nconst EMBEDDED_URL = /https?:\\/\\/[^\\s\"'<>()[\\]{}\\\\^`|]+/gi\n\n/** Characters prose puts after an address that the address does not own. */\nconst TRAILING_PROSE = /[.,;:!?'\"*_~]+$/\n\n/** A whole value shaped like an absolute or protocol-relative address. */\nconst ADDRESS_SHAPE = /^\\s*(?:https?:|[\\\\/]{2})/i\n\n/**\n * Every outside address a rendered page could link to: each string in the\n * payload that is one, and each one embedded in a string (Markdown, rich\n * text HTML, a plain sentence). Over-collecting is harmless — a signature\n * nobody follows is never read — and under-collecting only sends a link to a\n * refusal, never around the notice.\n *\n * Returned normalized, the spelling the client looks signatures up by.\n */\nexport function collectLeavingDestinations(\n  value: unknown,\n  hosts: readonly string[],\n  limit: number = LEAVING_NOTICE_MAX_DESTINATIONS,\n): string[] {\n  const found = new Set<string>()\n  const consider = (candidate: string) => {\n    if (found.size >= limit) return\n    const destination = leavingDestination(candidate, hosts)\n    if (destination) found.add(destination)\n  }\n  const scan = (text: string) => {\n    if (ADDRESS_SHAPE.test(text)) consider(text)\n    if (!text.includes('http')) return\n    const scanned =\n      text.length > MAX_SCANNED_STRING ? text.slice(0, MAX_SCANNED_STRING) : text\n    for (const match of scanned.matchAll(EMBEDDED_URL)) {\n      const raw = match[0]\n      consider(raw)\n      const trimmed = raw.replace(TRAILING_PROSE, '')\n      if (trimmed !== raw) consider(trimmed)\n      // An href inside stored HTML is entity-encoded; the DOM decodes it.\n      if (trimmed.includes('&amp;')) consider(trimmed.replace(/&amp;/g, '&'))\n    }\n  }\n  const walk = (node: unknown, depth: number) => {\n    if (found.size >= limit || depth > MAX_WALK_DEPTH) return\n    if (typeof node === 'string') {\n      scan(node)\n    } else if (Array.isArray(node)) {\n      for (const item of node) walk(item, depth + 1)\n    } else if (node && typeof node === 'object') {\n      for (const item of Object.values(node)) walk(item, depth + 1)\n    }\n  }\n  walk(value, 0)\n  return [...found]\n}\n\nfunction leavingSignature(hostId: string, destination: string): string {\n  return createHmac('sha256', tokenSigningSecret())\n    .update(`leaving-notice:v1:${hostId}:${destination}`)\n    .digest('base64url')\n}\n\n/**\n * The signature for one destination on one site. Throws when the deployment\n * has no signing secret, like every signer of it.\n */\nexport function signLeavingDestination(\n  hostId: string,\n  destination: string,\n): string {\n  const normalized = normalizeLeavingDestination(destination)\n  if (!hostId || !normalized) {\n    throw new Error('A leaving-notice signature needs a site and an address')\n  }\n  return leavingSignature(hostId, normalized)\n}\n\n/**\n * Whether `signature` was issued for `destination` on this site. False for\n * anything else — another site's signature, an edited address, a missing\n * secret (fail closed).\n */\nexport function verifyLeavingDestination(\n  hostId: string,\n  destination: unknown,\n  signature: unknown,\n): boolean {\n  if (!hostId || typeof signature !== 'string' || signature.length > 128) {\n    return false\n  }\n  const normalized = normalizeLeavingDestination(destination)\n  if (!normalized) return false\n  let expected: string\n  try {\n    expected = leavingSignature(hostId, normalized)\n  } catch {\n    return false\n  }\n  return safeEqual(signature, expected)\n}\n\n/** Signs a page's destinations for one site. */\nexport function signLeavingDestinations(\n  hostId: string,\n  destinations: readonly string[],\n): Record<string, string> {\n  const sigs: Record<string, string> = {}\n  for (const destination of destinations) {\n    sigs[destination] = leavingSignature(hostId, destination)\n  }\n  return sigs\n}\n\n/** Whether this deployment can sign at all. */\nfunction canSign(): boolean {\n  try {\n    tokenSigningSecret()\n    return true\n  } catch {\n    return false\n  }\n}\n\n/**\n * What a published page of this site carries, or `null` when the site is not\n * in its window.\n *\n * `content` is everything the page renders from — its props, its nodes —\n * walked for outside addresses to sign.\n *\n * A deployment with no signing secret gets no notice, loudly. The route\n * could verify nothing there and would refuse every link on every new free\n * site; an outage of every outbound link is not a safer failure than the\n * links working as they did before this existed.\n */\nexport function leavingNoticeConfig(options: {\n  hostId: string | null | undefined\n  site: SiteReturnHost | null | undefined\n  org: unknown\n  content?: unknown\n  nowMs?: number\n}): LeavingNoticeConfig | null {\n  const { hostId, site, org, content } = options\n  if (!hostId || !site) return null\n  const until = leavingNoticeEndsAt(org, options.nowMs)\n  if (until === null) return null\n  if (!canSign()) {\n    console.error(\n      '[leaving-notice] TOKEN_SIGNING_SECRET is not configured; the notice is off',\n    )\n    return null\n  }\n  const hosts = leavingNoticeHosts(site)\n  return {\n    until,\n    hosts,\n    sigs: signLeavingDestinations(\n      hostId,\n      collectLeavingDestinations(content, hosts),\n    ),\n  }\n}\n\n/**\n * Only the signatures, for a payload that arrives after its page — a gated\n * screen's nodes (`enrichGatedScreenPage`). `null` outside the window.\n */\nexport function leavingNoticeSignatures(options: {\n  hostId: string | null | undefined\n  site: SiteReturnHost | null | undefined\n  org: unknown\n  content: unknown\n  nowMs?: number\n}): Record<string, string> | null {\n  const config = leavingNoticeConfig(options)\n  return config && Object.keys(config.sigs).length ? config.sigs : null\n}\n"],"names":["createHmac","DOCS_BASE_URL","leavingDestination","normalizeLeavingDestination","resolveEffectivePlan","PLATFORM_HOME_URL","PLATFORM_SUPPORT_URL","platformConsoleOrigin","siteOwnHosts","TENANT_APEX","isYoungWorkspaceAge","OUTBOUND_REVIEW_YOUNG_DAYS","registrableDomain","tokenSigningSecret","orgAgeDays","orgCreatedMs","safeEqual","LEAVING_NOTICE_DAYS","DAY_MS","LEAVING_NOTICE_MAX_DESTINATIONS","MAX_WALK_DEPTH","MAX_SCANNED_STRING","leavingNoticeEndsAt","org","nowMs","Date","now","createdAt","createdMs","hostnameOf","raw","url","URL","protocol","hostname","toLowerCase","leavingNoticeHosts","site","hosts","Set","apex","add","apexRegistrable","registrable","includes","EMBEDDED_URL","TRAILING_PROSE","ADDRESS_SHAPE","collectLeavingDestinations","value","limit","found","consider","candidate","size","destination","scan","text","test","scanned","length","slice","match","matchAll","trimmed","replace","walk","node","depth","Array","isArray","item","Object","values","leavingSignature","hostId","update","digest","signLeavingDestination","normalized","Error","verifyLeavingDestination","signature","expected","signLeavingDestinations","destinations","sigs","canSign","leavingNoticeConfig","options","content","until","console","error","leavingNoticeSignatures","config","keys"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2CA6B2C,GAE3C,SAASA,UAAU,QAAQ,SAAQ;AACnC,SAASC,aAAa,QAAQ,mCAAkC;AAChE,SAEEC,kBAAkB,EAClBC,2BAA2B,QACtB,wCAAuC;AAC9C,SAASC,oBAAoB,QAAQ,2CAA0C;AAC/E,SACEC,iBAAiB,EACjBC,oBAAoB,EACpBC,qBAAqB,QAChB,wCAAuC;AAC9C,SAEEC,YAAY,QACP,yCAAwC;AAC/C,SAASC,WAAW,QAAQ,qCAAoC;AAChE,SACEC,mBAAmB,EACnBC,0BAA0B,EAC1BC,iBAAiB,QACZ,oDAAmD;AAC1D,SAASC,kBAAkB,QAAQ,qBAAiB;AACpD,SAASC,UAAU,EAAEC,YAAY,QAAQ,eAAW;AACpD,SAASC,SAAS,QAAQ,kBAAc;AAExC,4DAA4D,GAC5D,OAAO,MAAMC,sBAAsBN,2BAA0B;AAE7D,MAAMO,SAAS;AAEf;;;;CAIC,GACD,OAAO,MAAMC,kCAAkC,IAAG;AAElD,2EAA2E,GAC3E,MAAMC,iBAAiB;AAEvB,uEAAuE,GACvE,MAAMC,qBAAqB;AAE3B;;;;;;;CAOC,GACD,OAAO,SAASC,oBACdC,GAAY,EACZC,QAAgBC,KAAKC,GAAG,EAAE;IAE1B,IAAI,CAACH,OAAO,OAAOA,QAAQ,UAAU,OAAO;IAC5C,IAAInB,qBAAqBmB,SAAkB,QAAQ,OAAO;IAC1D,MAAMI,YAAY,AAACJ,IAAgCI,SAAS;IAC5D,IAAI,CAACjB,oBAAoBI,WAAWa,WAAWH,SAAS,OAAO;IAC/D,MAAMI,YAAYb,aAAaY;IAC/B,OAAOC,cAAc,OAAO,OAAOA,YAAYX,sBAAsBC;AACvE;AAEA,SAASW,WAAWC,GAA8B;IAChD,IAAI,CAACA,KAAK,OAAO;IACjB,IAAI;QACF,MAAMC,MAAM,IAAIC,IAAIF;QACpB,IAAIC,IAAIE,QAAQ,KAAK,WAAWF,IAAIE,QAAQ,KAAK,UAAU,OAAO;QAClE,OAAOF,IAAIG,QAAQ,CAACC,WAAW,MAAM;IACvC,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAEA;;;;;;;;CAQC,GACD,OAAO,SAASC,mBACdC,IAAuC;IAEvC,MAAMC,QAAQ,IAAIC,IAAY/B,aAAa6B;IAC3C,MAAMG,OAAO/B,YAAY0B,WAAW;IACpCG,MAAMG,GAAG,CAACD;IACV,MAAME,kBAAkB9B,kBAAkB4B;IAC1C,KAAK,MAAMV,OAAO;QAChBzB;QACAE;QACAD;QACAL;KACD,CAAE;QACD,MAAMiC,WAAWL,WAAWC;QAC5B,IAAI,CAACI,UAAU;QACfI,MAAMG,GAAG,CAACP;QACV,MAAMS,cAAc/B,kBAAkBsB;QACtC,yEAAyE;QACzE,mDAAmD;QACnD,IAAIS,YAAYC,QAAQ,CAAC,QAAQD,gBAAgBD,iBAAiB;YAChEJ,MAAMG,GAAG,CAAC,CAAC,CAAC,EAAEE,aAAa;QAC7B;IACF;IACA,OAAO;WAAIL;KAAM;AACnB;AAEA,4EAA4E,GAC5E,MAAMO,eAAe;AAErB,0EAA0E,GAC1E,MAAMC,iBAAiB;AAEvB,wEAAwE,GACxE,MAAMC,gBAAgB;AAEtB;;;;;;;;CAQC,GACD,OAAO,SAASC,2BACdC,KAAc,EACdX,KAAwB,EACxBY,QAAgB/B,+BAA+B;IAE/C,MAAMgC,QAAQ,IAAIZ;IAClB,MAAMa,WAAW,CAACC;QAChB,IAAIF,MAAMG,IAAI,IAAIJ,OAAO;QACzB,MAAMK,cAAcrD,mBAAmBmD,WAAWf;QAClD,IAAIiB,aAAaJ,MAAMV,GAAG,CAACc;IAC7B;IACA,MAAMC,OAAO,CAACC;QACZ,IAAIV,cAAcW,IAAI,CAACD,OAAOL,SAASK;QACvC,IAAI,CAACA,KAAKb,QAAQ,CAAC,SAAS;QAC5B,MAAMe,UACJF,KAAKG,MAAM,GAAGvC,qBAAqBoC,KAAKI,KAAK,CAAC,GAAGxC,sBAAsBoC;QACzE,KAAK,MAAMK,SAASH,QAAQI,QAAQ,CAAClB,cAAe;YAClD,MAAMf,MAAMgC,KAAK,CAAC,EAAE;YACpBV,SAAStB;YACT,MAAMkC,UAAUlC,IAAImC,OAAO,CAACnB,gBAAgB;YAC5C,IAAIkB,YAAYlC,KAAKsB,SAASY;YAC9B,oEAAoE;YACpE,IAAIA,QAAQpB,QAAQ,CAAC,UAAUQ,SAASY,QAAQC,OAAO,CAAC,UAAU;QACpE;IACF;IACA,MAAMC,OAAO,CAACC,MAAeC;QAC3B,IAAIjB,MAAMG,IAAI,IAAIJ,SAASkB,QAAQhD,gBAAgB;QACnD,IAAI,OAAO+C,SAAS,UAAU;YAC5BX,KAAKW;QACP,OAAO,IAAIE,MAAMC,OAAO,CAACH,OAAO;YAC9B,KAAK,MAAMI,QAAQJ,KAAMD,KAAKK,MAAMH,QAAQ;QAC9C,OAAO,IAAID,QAAQ,OAAOA,SAAS,UAAU;YAC3C,KAAK,MAAMI,QAAQC,OAAOC,MAAM,CAACN,MAAOD,KAAKK,MAAMH,QAAQ;QAC7D;IACF;IACAF,KAAKjB,OAAO;IACZ,OAAO;WAAIE;KAAM;AACnB;AAEA,SAASuB,iBAAiBC,MAAc,EAAEpB,WAAmB;IAC3D,OAAOvD,WAAW,UAAUa,sBACzB+D,MAAM,CAAC,CAAC,kBAAkB,EAAED,OAAO,CAAC,EAAEpB,aAAa,EACnDsB,MAAM,CAAC;AACZ;AAEA;;;CAGC,GACD,OAAO,SAASC,uBACdH,MAAc,EACdpB,WAAmB;IAEnB,MAAMwB,aAAa5E,4BAA4BoD;IAC/C,IAAI,CAACoB,UAAU,CAACI,YAAY;QAC1B,MAAM,IAAIC,MAAM;IAClB;IACA,OAAON,iBAAiBC,QAAQI;AAClC;AAEA;;;;CAIC,GACD,OAAO,SAASE,yBACdN,MAAc,EACdpB,WAAoB,EACpB2B,SAAkB;IAElB,IAAI,CAACP,UAAU,OAAOO,cAAc,YAAYA,UAAUtB,MAAM,GAAG,KAAK;QACtE,OAAO;IACT;IACA,MAAMmB,aAAa5E,4BAA4BoD;IAC/C,IAAI,CAACwB,YAAY,OAAO;IACxB,IAAII;IACJ,IAAI;QACFA,WAAWT,iBAAiBC,QAAQI;IACtC,EAAE,eAAM;QACN,OAAO;IACT;IACA,OAAO/D,UAAUkE,WAAWC;AAC9B;AAEA,8CAA8C,GAC9C,OAAO,SAASC,wBACdT,MAAc,EACdU,YAA+B;IAE/B,MAAMC,OAA+B,CAAC;IACtC,KAAK,MAAM/B,eAAe8B,aAAc;QACtCC,IAAI,CAAC/B,YAAY,GAAGmB,iBAAiBC,QAAQpB;IAC/C;IACA,OAAO+B;AACT;AAEA,6CAA6C,GAC7C,SAASC;IACP,IAAI;QACF1E;QACA,OAAO;IACT,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAEA;;;;;;;;;;;CAWC,GACD,OAAO,SAAS2E,oBAAoBC,OAMnC;IACC,MAAM,EAAEd,MAAM,EAAEtC,IAAI,EAAEd,GAAG,EAAEmE,OAAO,EAAE,GAAGD;IACvC,IAAI,CAACd,UAAU,CAACtC,MAAM,OAAO;IAC7B,MAAMsD,QAAQrE,oBAAoBC,KAAKkE,QAAQjE,KAAK;IACpD,IAAImE,UAAU,MAAM,OAAO;IAC3B,IAAI,CAACJ,WAAW;QACdK,QAAQC,KAAK,CACX;QAEF,OAAO;IACT;IACA,MAAMvD,QAAQF,mBAAmBC;IACjC,OAAO;QACLsD;QACArD;QACAgD,MAAMF,wBACJT,QACA3B,2BAA2B0C,SAASpD;IAExC;AACF;AAEA;;;CAGC,GACD,OAAO,SAASwD,wBAAwBL,OAMvC;IACC,MAAMM,SAASP,oBAAoBC;IACnC,OAAOM,UAAUvB,OAAOwB,IAAI,CAACD,OAAOT,IAAI,EAAE1B,MAAM,GAAGmC,OAAOT,IAAI,GAAG;AACnE"}

package/src/lib/server/link-reputation-review.d.ts

@@ -0,0 +1,54 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/** What one chunk of the re-check did. */
+export interface LivePageLinkRecheck {
+    /** Sites this chunk walked. */
+    sites: number;
+    /** Live pages with foreign links among them. */
+    pages: number;
+    /** Distinct foreign hosts looked up. */
+    hosts: number;
+    /** Of those, how many Web Risk lists. */
+    listed: number;
+    /** Hosts nobody could answer for: not evidence, looked up again next time. */
+    unknown: number;
+    /** Pages sent back through the review with a listed host. */
+    reviewed: number;
+    /** Of those, how many the review held (or found already rejected). */
+    held: number;
+    /** The sites a hold was placed on, whose cached pages need dropping. */
+    heldHostIds: string[];
+    nextCursor: string | null;
+    done: boolean;
+}
+/** Sites walked per chunk. */
+export declare const LINK_RECHECK_SITES_PER_CHUNK = 200;
+/**
+ * Re-check the foreign hosts of every live page, a chunk of sites at a time
+ * (`cursor` resumes after the last site of the previous chunk). A site that
+ * is locked is skipped: nothing of it serves. A page with a newly listed host
+ * goes back through {@link reviewHostedPage} with that listing as an extra
+ * signal, so what a hold does is decided in one place.
+ */
+export declare function recheckLivePageLinks(options?: {
+    cursor?: string | null;
+    sitesPerChunk?: number;
+    nowMs?: number;
+    firestore?: FirebaseFirestore.Firestore;
+    /** Walk and count only: no lookup, no review. */
+    dryRun?: boolean;
+}): Promise<LivePageLinkRecheck>;

package/src/lib/server/link-reputation-review.js

@@ -0,0 +1,144 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /*==========================================
+ * THE DAILY LINK RE-CHECK (AGL-3451).
+ *
+ * The page review (`hosted-page-review.ts`), the redirect review and the send
+ * seam look up every foreign host a page, a redirect or a message points at
+ * as it goes out. What is already live is not re-reviewed until somebody
+ * publishes it again — and a harvester is often listed only after the page
+ * linking to it went up.
+ *
+ * So {@link recheckLivePageLinks} walks every live page's foreign hosts, as
+ * the review noted them beside the version it served
+ * (`pageReviews/{screenId}.foreignHosts`), looks them up again, and sends
+ * each page with a newly listed host back through `reviewHostedPage` with the
+ * listing as an extra signal — the same path, so it is held or flagged, its
+ * row filed, and a young workspace's security hold requested (AGL-3450),
+ * exactly as at render. The console's `/api/admin/web-risk-recheck` runs it
+ * a chunk of sites at a time.
+ *=========================================*/ import { MAX_REPUTATION_HOSTS_PER_LOOKUP, webRiskSignals } from "@aglyn/shared-util-email/link-reputation";
+import { FieldPath } from "firebase-admin/firestore";
+import firebaseAdmin from "./firebase-admin.js";
+import { PAGE_REVIEW_SUBCOLLECTION, reviewHostedPage } from "./hosted-page-review.js";
+import { lookupHostReputation } from "./web-risk.js";
+/** Sites walked per chunk. */ export const LINK_RECHECK_SITES_PER_CHUNK = 200;
+/** Sites whose page notes are read at once. */ const SITE_READ_CONCURRENCY = 20;
+/** The budget of each group of hosts looked up within a chunk. */ const RECHECK_DEADLINE_MS = 15000;
+/**
+ * Re-check the foreign hosts of every live page, a chunk of sites at a time
+ * (`cursor` resumes after the last site of the previous chunk). A site that
+ * is locked is skipped: nothing of it serves. A page with a newly listed host
+ * goes back through {@link reviewHostedPage} with that listing as an extra
+ * signal, so what a hold does is decided in one place.
+ */ export async function recheckLivePageLinks(options = {}) {
+    var _options_firestore, _options_nowMs, _options_sitesPerChunk, _ref;
+    const firestore = (_options_firestore = options.firestore) != null ? _options_firestore : firebaseAdmin.app().firestore();
+    const nowMs = (_options_nowMs = options.nowMs) != null ? _options_nowMs : Date.now();
+    const limit = (_options_sitesPerChunk = options.sitesPerChunk) != null ? _options_sitesPerChunk : LINK_RECHECK_SITES_PER_CHUNK;
+    let query = firestore.collection('hosts').orderBy(FieldPath.documentId()).select('suspendedAt').limit(limit);
+    if (options.cursor) query = query.startAfter(options.cursor);
+    const sites = await query.get();
+    const pages = [];
+    const live = sites.docs.filter((site)=>site.get('suspendedAt') == null);
+    for(let at = 0; at < live.length; at += SITE_READ_CONCURRENCY){
+        const batch = live.slice(at, at + SITE_READ_CONCURRENCY);
+        const notes = await Promise.all(batch.map((site)=>site.ref.collection(PAGE_REVIEW_SUBCOLLECTION).where('foreignHostCount', '>', 0).limit(500).get().then((reviews)=>({
+                    site,
+                    reviews
+                }))));
+        for (const { site, reviews } of notes){
+            for (const review of reviews.docs){
+                const versionId = review.get('servedVersionId');
+                const hosts = review.get('foreignHosts');
+                if (typeof versionId !== 'string' || !versionId || !Array.isArray(hosts)) continue;
+                pages.push({
+                    hostId: site.id,
+                    screenId: review.id,
+                    versionId,
+                    hosts: hosts.filter((host)=>typeof host === 'string')
+                });
+            }
+        }
+    }
+    const distinct = [
+        ...new Set(pages.flatMap((page)=>page.hosts))
+    ];
+    const last = sites.docs[sites.docs.length - 1];
+    const chunk = {
+        sites: sites.size,
+        pages: pages.length,
+        hosts: distinct.length,
+        nextCursor: sites.size < limit ? null : (_ref = last == null ? void 0 : last.id) != null ? _ref : null,
+        done: sites.size < limit
+    };
+    if (options.dryRun) {
+        return _extends({}, chunk, {
+            listed: 0,
+            unknown: 0,
+            reviewed: 0,
+            held: 0,
+            heldHostIds: []
+        });
+    }
+    const listed = new Map();
+    let unknown = 0;
+    for(let at = 0; at < distinct.length; at += MAX_REPUTATION_HOSTS_PER_LOOKUP){
+        const answer = await lookupHostReputation(distinct.slice(at, at + MAX_REPUTATION_HOSTS_PER_LOOKUP), {
+            deadlineMs: RECHECK_DEADLINE_MS,
+            nowMs
+        });
+        for (const hit of answer.hits)listed.set(hit.host, hit);
+        unknown += answer.unknown.length;
+    }
+    let reviewed = 0;
+    let held = 0;
+    const heldHostIds = new Set();
+    for (const page of pages){
+        const hits = page.hosts.map((host)=>listed.get(host)).filter(Boolean);
+        if (!hits.length) continue;
+        reviewed += 1;
+        try {
+            const outcome = await reviewHostedPage({
+                hostId: page.hostId,
+                screenId: page.screenId,
+                versionId: page.versionId,
+                // The page itself is not composed here: the listing is the finding.
+                nodes: {},
+                extraSignals: webRiskSignals(hits),
+                nowMs
+            });
+            if (outcome.outcome !== 'serve') {
+                held += 1;
+                heldHostIds.add(page.hostId);
+            }
+        } catch (error) {
+            console.error('[link-reputation] a live page could not be re-reviewed', page.hostId, page.screenId, error);
+        }
+    }
+    return _extends({}, chunk, {
+        listed: listed.size,
+        unknown,
+        reviewed,
+        held,
+        heldHostIds: [
+            ...heldHostIds
+        ]
+    });
+}
+
+//# sourceMappingURL=link-reputation-review.js.map

package/src/lib/server/link-reputation-review.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/link-reputation-review.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*==========================================\n * THE DAILY LINK RE-CHECK (AGL-3451).\n *\n * The page review (`hosted-page-review.ts`), the redirect review and the send\n * seam look up every foreign host a page, a redirect or a message points at\n * as it goes out. What is already live is not re-reviewed until somebody\n * publishes it again — and a harvester is often listed only after the page\n * linking to it went up.\n *\n * So {@link recheckLivePageLinks} walks every live page's foreign hosts, as\n * the review noted them beside the version it served\n * (`pageReviews/{screenId}.foreignHosts`), looks them up again, and sends\n * each page with a newly listed host back through `reviewHostedPage` with the\n * listing as an extra signal — the same path, so it is held or flagged, its\n * row filed, and a young workspace's security hold requested (AGL-3450),\n * exactly as at render. The console's `/api/admin/web-risk-recheck` runs it\n * a chunk of sites at a time.\n *=========================================*/\n\nimport {\n  type HostReputationHit,\n  MAX_REPUTATION_HOSTS_PER_LOOKUP,\n  webRiskSignals,\n} from '@aglyn/shared-util-email/link-reputation'\nimport { FieldPath } from 'firebase-admin/firestore'\nimport firebaseAdmin from './firebase-admin'\nimport { PAGE_REVIEW_SUBCOLLECTION, reviewHostedPage } from './hosted-page-review'\nimport { lookupHostReputation } from './web-risk'\n\n/** One live page whose foreign hosts the review noted. */\ninterface LivePageLinks {\n  hostId: string\n  screenId: string\n  versionId: string\n  hosts: string[]\n}\n\n/** What one chunk of the re-check did. */\nexport interface LivePageLinkRecheck {\n  /** Sites this chunk walked. */\n  sites: number\n  /** Live pages with foreign links among them. */\n  pages: number\n  /** Distinct foreign hosts looked up. */\n  hosts: number\n  /** Of those, how many Web Risk lists. */\n  listed: number\n  /** Hosts nobody could answer for: not evidence, looked up again next time. */\n  unknown: number\n  /** Pages sent back through the review with a listed host. */\n  reviewed: number\n  /** Of those, how many the review held (or found already rejected). */\n  held: number\n  /** The sites a hold was placed on, whose cached pages need dropping. */\n  heldHostIds: string[]\n  nextCursor: string | null\n  done: boolean\n}\n\n/** Sites walked per chunk. */\nexport const LINK_RECHECK_SITES_PER_CHUNK = 200\n/** Sites whose page notes are read at once. */\nconst SITE_READ_CONCURRENCY = 20\n/** The budget of each group of hosts looked up within a chunk. */\nconst RECHECK_DEADLINE_MS = 15_000\n\n/**\n * Re-check the foreign hosts of every live page, a chunk of sites at a time\n * (`cursor` resumes after the last site of the previous chunk). A site that\n * is locked is skipped: nothing of it serves. A page with a newly listed host\n * goes back through {@link reviewHostedPage} with that listing as an extra\n * signal, so what a hold does is decided in one place.\n */\nexport async function recheckLivePageLinks(\n  options: {\n    cursor?: string | null\n    sitesPerChunk?: number\n    nowMs?: number\n    firestore?: FirebaseFirestore.Firestore\n    /** Walk and count only: no lookup, no review. */\n    dryRun?: boolean\n  } = {},\n): Promise<LivePageLinkRecheck> {\n  const firestore = options.firestore ?? firebaseAdmin.app().firestore()\n  const nowMs = options.nowMs ?? Date.now()\n  const limit = options.sitesPerChunk ?? LINK_RECHECK_SITES_PER_CHUNK\n  let query = firestore\n    .collection('hosts')\n    .orderBy(FieldPath.documentId())\n    .select('suspendedAt')\n    .limit(limit)\n  if (options.cursor) query = query.startAfter(options.cursor)\n  const sites = await query.get()\n\n  const pages: LivePageLinks[] = []\n  const live = sites.docs.filter((site) => site.get('suspendedAt') == null)\n  for (let at = 0; at < live.length; at += SITE_READ_CONCURRENCY) {\n    const batch = live.slice(at, at + SITE_READ_CONCURRENCY)\n    const notes = await Promise.all(\n      batch.map((site) =>\n        site.ref\n          .collection(PAGE_REVIEW_SUBCOLLECTION)\n          .where('foreignHostCount', '>', 0)\n          .limit(500)\n          .get()\n          .then((reviews) => ({ site, reviews })),\n      ),\n    )\n    for (const { site, reviews } of notes) {\n      for (const review of reviews.docs) {\n        const versionId = review.get('servedVersionId')\n        const hosts = review.get('foreignHosts')\n        if (typeof versionId !== 'string' || !versionId || !Array.isArray(hosts)) continue\n        pages.push({\n          hostId: site.id,\n          screenId: review.id,\n          versionId,\n          hosts: hosts.filter((host): host is string => typeof host === 'string'),\n        })\n      }\n    }\n  }\n\n  const distinct = [...new Set(pages.flatMap((page) => page.hosts))]\n  const last = sites.docs[sites.docs.length - 1]\n  const chunk = {\n    sites: sites.size,\n    pages: pages.length,\n    hosts: distinct.length,\n    nextCursor: sites.size < limit ? null : (last?.id ?? null),\n    done: sites.size < limit,\n  }\n  if (options.dryRun) {\n    return { ...chunk, listed: 0, unknown: 0, reviewed: 0, held: 0, heldHostIds: [] }\n  }\n  const listed = new Map<string, HostReputationHit>()\n  let unknown = 0\n  for (let at = 0; at < distinct.length; at += MAX_REPUTATION_HOSTS_PER_LOOKUP) {\n    const answer = await lookupHostReputation(\n      distinct.slice(at, at + MAX_REPUTATION_HOSTS_PER_LOOKUP),\n      { deadlineMs: RECHECK_DEADLINE_MS, nowMs },\n    )\n    for (const hit of answer.hits) listed.set(hit.host, hit)\n    unknown += answer.unknown.length\n  }\n\n  let reviewed = 0\n  let held = 0\n  const heldHostIds = new Set<string>()\n  for (const page of pages) {\n    const hits = page.hosts.map((host) => listed.get(host)).filter(Boolean) as HostReputationHit[]\n    if (!hits.length) continue\n    reviewed += 1\n    try {\n      const outcome = await reviewHostedPage({\n        hostId: page.hostId,\n        screenId: page.screenId,\n        versionId: page.versionId,\n        // The page itself is not composed here: the listing is the finding.\n        nodes: {},\n        extraSignals: webRiskSignals(hits),\n        nowMs,\n      })\n      if (outcome.outcome !== 'serve') {\n        held += 1\n        heldHostIds.add(page.hostId)\n      }\n    } catch (error) {\n      console.error('[link-reputation] a live page could not be re-reviewed', page.hostId, page.screenId, error)\n    }\n  }\n\n  return {\n    ...chunk,\n    listed: listed.size,\n    unknown,\n    reviewed,\n    held,\n    heldHostIds: [...heldHostIds],\n  }\n}\n"],"names":["MAX_REPUTATION_HOSTS_PER_LOOKUP","webRiskSignals","FieldPath","firebaseAdmin","PAGE_REVIEW_SUBCOLLECTION","reviewHostedPage","lookupHostReputation","LINK_RECHECK_SITES_PER_CHUNK","SITE_READ_CONCURRENCY","RECHECK_DEADLINE_MS","recheckLivePageLinks","options","firestore","app","nowMs","Date","now","limit","sitesPerChunk","query","collection","orderBy","documentId","select","cursor","startAfter","sites","get","pages","live","docs","filter","site","at","length","batch","slice","notes","Promise","all","map","ref","where","then","reviews","review","versionId","hosts","Array","isArray","push","hostId","id","screenId","host","distinct","Set","flatMap","page","last","chunk","size","nextCursor","done","dryRun","listed","unknown","reviewed","held","heldHostIds","Map","answer","deadlineMs","hit","hits","set","Boolean","outcome","nodes","extraSignals","add","error","console"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;2CAiB2C,GAE3C,SAEEA,+BAA+B,EAC/BC,cAAc,QACT,2CAA0C;AACjD,SAASC,SAAS,QAAQ,2BAA0B;AACpD,OAAOC,mBAAmB,sBAAkB;AAC5C,SAASC,yBAAyB,EAAEC,gBAAgB,QAAQ,0BAAsB;AAClF,SAASC,oBAAoB,QAAQ,gBAAY;AAgCjD,4BAA4B,GAC5B,OAAO,MAAMC,+BAA+B,IAAG;AAC/C,6CAA6C,GAC7C,MAAMC,wBAAwB;AAC9B,gEAAgE,GAChE,MAAMC,sBAAsB;AAE5B;;;;;;CAMC,GACD,OAAO,eAAeC,qBACpBC,UAOI,CAAC,CAAC;QAEYA,oBACJA,gBACAA;IAFd,MAAMC,aAAYD,qBAAAA,QAAQC,SAAS,YAAjBD,qBAAqBR,cAAcU,GAAG,GAAGD,SAAS;IACpE,MAAME,SAAQH,iBAAAA,QAAQG,KAAK,YAAbH,iBAAiBI,KAAKC,GAAG;IACvC,MAAMC,SAAQN,yBAAAA,QAAQO,aAAa,YAArBP,yBAAyBJ;IACvC,IAAIY,QAAQP,UACTQ,UAAU,CAAC,SACXC,OAAO,CAACnB,UAAUoB,UAAU,IAC5BC,MAAM,CAAC,eACPN,KAAK,CAACA;IACT,IAAIN,QAAQa,MAAM,EAAEL,QAAQA,MAAMM,UAAU,CAACd,QAAQa,MAAM;IAC3D,MAAME,QAAQ,MAAMP,MAAMQ,GAAG;IAE7B,MAAMC,QAAyB,EAAE;IACjC,MAAMC,OAAOH,MAAMI,IAAI,CAACC,MAAM,CAAC,CAACC,OAASA,KAAKL,GAAG,CAAC,kBAAkB;IACpE,IAAK,IAAIM,KAAK,GAAGA,KAAKJ,KAAKK,MAAM,EAAED,MAAMzB,sBAAuB;QAC9D,MAAM2B,QAAQN,KAAKO,KAAK,CAACH,IAAIA,KAAKzB;QAClC,MAAM6B,QAAQ,MAAMC,QAAQC,GAAG,CAC7BJ,MAAMK,GAAG,CAAC,CAACR,OACTA,KAAKS,GAAG,CACLrB,UAAU,CAAChB,2BACXsC,KAAK,CAAC,oBAAoB,KAAK,GAC/BzB,KAAK,CAAC,KACNU,GAAG,GACHgB,IAAI,CAAC,CAACC,UAAa,CAAA;oBAAEZ;oBAAMY;gBAAQ,CAAA;QAG1C,KAAK,MAAM,EAAEZ,IAAI,EAAEY,OAAO,EAAE,IAAIP,MAAO;YACrC,KAAK,MAAMQ,UAAUD,QAAQd,IAAI,CAAE;gBACjC,MAAMgB,YAAYD,OAAOlB,GAAG,CAAC;gBAC7B,MAAMoB,QAAQF,OAAOlB,GAAG,CAAC;gBACzB,IAAI,OAAOmB,cAAc,YAAY,CAACA,aAAa,CAACE,MAAMC,OAAO,CAACF,QAAQ;gBAC1EnB,MAAMsB,IAAI,CAAC;oBACTC,QAAQnB,KAAKoB,EAAE;oBACfC,UAAUR,OAAOO,EAAE;oBACnBN;oBACAC,OAAOA,MAAMhB,MAAM,CAAC,CAACuB,OAAyB,OAAOA,SAAS;gBAChE;YACF;QACF;IACF;IAEA,MAAMC,WAAW;WAAI,IAAIC,IAAI5B,MAAM6B,OAAO,CAAC,CAACC,OAASA,KAAKX,KAAK;KAAG;IAClE,MAAMY,OAAOjC,MAAMI,IAAI,CAACJ,MAAMI,IAAI,CAACI,MAAM,GAAG,EAAE;IAC9C,MAAM0B,QAAQ;QACZlC,OAAOA,MAAMmC,IAAI;QACjBjC,OAAOA,MAAMM,MAAM;QACnBa,OAAOQ,SAASrB,MAAM;QACtB4B,YAAYpC,MAAMmC,IAAI,GAAG5C,QAAQ,eAAQ0C,wBAAAA,KAAMP,EAAE,mBAAI;QACrDW,MAAMrC,MAAMmC,IAAI,GAAG5C;IACrB;IACA,IAAIN,QAAQqD,MAAM,EAAE;QAClB,OAAO,aAAKJ;YAAOK,QAAQ;YAAGC,SAAS;YAAGC,UAAU;YAAGC,MAAM;YAAGC,aAAa,EAAE;;IACjF;IACA,MAAMJ,SAAS,IAAIK;IACnB,IAAIJ,UAAU;IACd,IAAK,IAAIjC,KAAK,GAAGA,KAAKsB,SAASrB,MAAM,EAAED,MAAMjC,gCAAiC;QAC5E,MAAMuE,SAAS,MAAMjE,qBACnBiD,SAASnB,KAAK,CAACH,IAAIA,KAAKjC,kCACxB;YAAEwE,YAAY/D;YAAqBK;QAAM;QAE3C,KAAK,MAAM2D,OAAOF,OAAOG,IAAI,CAAET,OAAOU,GAAG,CAACF,IAAInB,IAAI,EAAEmB;QACpDP,WAAWK,OAAOL,OAAO,CAAChC,MAAM;IAClC;IAEA,IAAIiC,WAAW;IACf,IAAIC,OAAO;IACX,MAAMC,cAAc,IAAIb;IACxB,KAAK,MAAME,QAAQ9B,MAAO;QACxB,MAAM8C,OAAOhB,KAAKX,KAAK,CAACP,GAAG,CAAC,CAACc,OAASW,OAAOtC,GAAG,CAAC2B,OAAOvB,MAAM,CAAC6C;QAC/D,IAAI,CAACF,KAAKxC,MAAM,EAAE;QAClBiC,YAAY;QACZ,IAAI;YACF,MAAMU,UAAU,MAAMxE,iBAAiB;gBACrC8C,QAAQO,KAAKP,MAAM;gBACnBE,UAAUK,KAAKL,QAAQ;gBACvBP,WAAWY,KAAKZ,SAAS;gBACzB,oEAAoE;gBACpEgC,OAAO,CAAC;gBACRC,cAAc9E,eAAeyE;gBAC7B5D;YACF;YACA,IAAI+D,QAAQA,OAAO,KAAK,SAAS;gBAC/BT,QAAQ;gBACRC,YAAYW,GAAG,CAACtB,KAAKP,MAAM;YAC7B;QACF,EAAE,OAAO8B,OAAO;YACdC,QAAQD,KAAK,CAAC,0DAA0DvB,KAAKP,MAAM,EAAEO,KAAKL,QAAQ,EAAE4B;QACtG;IACF;IAEA,OAAO,aACFrB;QACHK,QAAQA,OAAOJ,IAAI;QACnBK;QACAC;QACAC;QACAC,aAAa;eAAIA;SAAY;;AAEjC"}

package/src/lib/server/media-cdn-rate-limit.d.ts

@@ -22,9 +22,12 @@ import { type ClientIpHeaders } from '@aglyn/aglyn/app-utils/request-ip';
  * much of it one caller could take. The firewall bypasses the route on
  * purpose, because link-preview crawlers and Gmail's image proxy cannot solve
  * a challenge ("Public asset delivery bypass" in
- * `tools/scripts/lib/firewall-posture.mjs`). Both middlewares exclude `/api/*`,
- * and no WAF rule covers the path. `serveMediaCdn` is the one piece of code
- * every request passes through, so the limit lives there.
+ * `tools/scripts/lib/firewall-posture.mjs`). Both middlewares exclude `/api/*`.
+ * The edge counts the path too, ahead of that bypass ("Media CDN per-IP rate
+ * limit", 1,500 requests a minute per address), but it sees one stream of
+ * requests per address: only `serveMediaCdn` can tell an image from a film,
+ * skip a 304, and fold an IPv6 address to its /64, so the ceilings on what one
+ * caller is served live here.
  *
  * ## What is counted
  *

package/src/lib/server/media-cdn-rate-limit.js

@@ -22,9 +22,12 @@ import { consumeRateLimit } from "./rate-limit-store.js";
  * much of it one caller could take. The firewall bypasses the route on
  * purpose, because link-preview crawlers and Gmail's image proxy cannot solve
  * a challenge ("Public asset delivery bypass" in
- * `tools/scripts/lib/firewall-posture.mjs`). Both middlewares exclude `/api/*`,
- * and no WAF rule covers the path. `serveMediaCdn` is the one piece of code
- * every request passes through, so the limit lives there.
+ * `tools/scripts/lib/firewall-posture.mjs`). Both middlewares exclude `/api/*`.
+ * The edge counts the path too, ahead of that bypass ("Media CDN per-IP rate
+ * limit", 1,500 requests a minute per address), but it sees one stream of
+ * requests per address: only `serveMediaCdn` can tell an image from a film,
+ * skip a 304, and fold an IPv6 address to its /64, so the ceilings on what one
+ * caller is served live here.
  *
  * ## What is counted
  *

package/src/lib/server/media-cdn-rate-limit.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/media-cdn-rate-limit.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  type ClientIpHeaders,\n  readClientIp,\n} from '@aglyn/aglyn/app-utils/request-ip'\nimport { consumeRateLimit } from './rate-limit-store'\n\n/**\n * The media CDN's per-caller limit (AGL-2812).\n *\n * `/api/media/cdn/*` is anonymous public delivery, and nothing bounded how\n * much of it one caller could take. The firewall bypasses the route on\n * purpose, because link-preview crawlers and Gmail's image proxy cannot solve\n * a challenge (\"Public asset delivery bypass\" in\n * `tools/scripts/lib/firewall-posture.mjs`). Both middlewares exclude `/api/*`,\n * and no WAF rule covers the path. `serveMediaCdn` is the one piece of code\n * every request passes through, so the limit lives there.\n *\n * ## What is counted\n *\n * A GET that gets past every access gate, the lockdown and quarantine\n * refusals and the 304 exit, which is where the Storage reads begin. Those\n * refusals, a 304 and a HEAD send no file, so a revalidating browser, a\n * crawler's HEAD and a probe for a deleted id spend nothing. The counter's\n * Firestore write is paid only where the delivery it guards is about to cost\n * more. The count starts beside the metadata read, so a request that then\n * finds no object in Storage, or asks for an unsatisfiable range, has been\n * counted too.\n *\n * ## Two budgets, split where the edge splits them\n *\n * Images and everything else are counted separately, on the line\n * `mediaCdnEdgeCacheable` already draws (AGL-1515):\n *\n * - **Images** are held by the edge, so only a miss reaches the function, and\n *   images are what link-preview crawlers and Gmail's image proxy fetch.\n * - **Everything else** (video, audio, PDFs, documents) is `private`, so every\n *   request reaches the function, and it is where the bytes are: a video\n *   master is a single request for up to 200 MB.\n *\n * Separate keys also mean a DAM grid's burst of tiles cannot spend the budget\n * the video on the same page needs, or the reverse.\n *\n * ## Thresholds, from measured traffic\n *\n * Read from both mounts' production request logs on 2026-09-11: the tenant's\n * last seven days (2026-09-04 08:01 to 2026-09-11 07:56 UTC), and the\n * console's last sixteen hours, which is all it retains. Only requests that\n * reached the function count, since an edge hit never runs this code.\n *\n * | measured | busiest minute, whole route |\n * | -- | -- |\n * | image deliveries (200 and 206) | 98 |\n * | every other delivery (200 and 206) | 31 |\n * | every request, with 304s, 404s and edge hits | 236 |\n * | link-preview crawlers and other bots, together | 32 |\n * | Gmail's image proxy | none in the sample |\n *\n * Each of those minutes was one browser: the image peak was a single Chrome\n * session pulling 129 distinct assets, and the non-image peak a single session\n * following 31 `?download=1` links. No asset took more than 4 range requests\n * in a minute. Over thirty days the day documents count 30,855 origin serves\n * in all, and 4,234 on the busiest day.\n *\n * Each ceiling is at least five times the busiest minute the whole route\n * served in its class. No single address can reach it with a pattern the route\n * has actually seen, even if every request in that minute had been its own:\n *\n * - {@link MEDIA_CDN_IMAGE_RATE_LIMIT}, 600: 6.1 times the image peak, and more\n *   than 18 times every crawler together.\n * - {@link MEDIA_CDN_NON_IMAGE_RATE_LIMIT}, 180: 5.8 times the non-image peak.\n *   Tenant video uploads are paused (AGL-2830), so film playback is barely in\n *   the sample. A page of twelve films at four ranges a minute each still fits\n *   more than three times over.\n *\n * ## Keyed on the caller alone\n *\n * The key is the caller's address and the class: not the site, the asset or\n * the query string. Cycling media ids, cache-busting a URL with a junk query\n * parameter, or switching between the tenant and console mounts all land in\n * the same counter.\n *\n * The address comes from `readClientIp`, which reads the hop the platform\n * wrote rather than one a caller can prepend. An IPv6 address counts by its\n * `/64`: one subscriber is routinely handed a whole `/64`, so keying on the\n * full address would give that subscriber 2^64 budgets.\n *\n * A request with no readable address is not counted at all. One shared bucket\n * for every unaddressable caller would refuse all of them together the moment\n * a proxy stopped naming callers, which is media delivery taken down by its\n * own limiter (see `NO_CLIENT_ADDRESS_BUCKET`). Vercel always names the caller,\n * so production does not reach that branch.\n *\n * ## Fails open\n *\n * Only a durable count past the ceiling refuses. Everything else admits:\n *\n * - **Contended, or no answer inside the budget.** `consumeRateLimit` reports\n *   both as `allowed: false` with `contended: true`. That is the store saying\n *   it could not count, not that the caller is over, and reading it as a\n *   refusal is how a slow counter fails every request closed.\n * - **The store is down.** `consumeRateLimit` falls back to its per-instance\n *   count and flags `degraded`. The episode is still recorded and still\n *   reaches `/api/health/rate-limits`; the request is admitted.\n * - **Anything thrown.** Counting may never be the reason a delivery fails.\n *\n * Delivery is the product, and the counter and the media document share one\n * Firestore. While the counter cannot answer, the document read in front of it\n * is usually failing too, and refusing would add a second outage to the first.\n *\n * ## Latency\n *\n * `serveMediaCdn` starts the count beside the Storage metadata read, so its\n * two round trips overlap one the request already pays. It gets\n * {@link MEDIA_CDN_RATE_LIMIT_BUDGET_MS} rather than the store's 2.5 s\n * default, and a request whose count has not come back by then is admitted.\n *\n * ## What it does not bound\n *\n * The bytes in one request, a caller spread across many addresses, and an\n * org's total delivery. A WAF rule, a signed or referrer-checked public URL and\n * a per-org byte cap are the controls for those. Each one changes what an\n * `og:image`, a mailed image or an embed is able to fetch, so none of them is\n * decided here.\n */\n\n/** Fixed 60 s window, the same as every other limiter on the store. */\nexport const MEDIA_CDN_RATE_WINDOW_MS = 60_000\n\n/** Image deliveries one caller may start in a window; see \"Thresholds\". */\nexport const MEDIA_CDN_IMAGE_RATE_LIMIT = 600\n\n/** Non-image deliveries one caller may start in a window; see \"Thresholds\". */\nexport const MEDIA_CDN_NON_IMAGE_RATE_LIMIT = 180\n\n/**\n * How long a delivery waits for its count before it is admitted uncounted.\n *\n * The store's default is 2.5 s, sized for a password attempt that can afford\n * to wait. A video seek cannot. The count's two round trips were measured at\n * about 0.6 s end to end including the request itself (`rate-limit-store.ts`),\n * and they run beside the metadata read, so 1 s is ample for an answer and\n * short enough that a stalled store costs a player one short pause.\n */\nexport const MEDIA_CDN_RATE_LIMIT_BUDGET_MS = 1_000\n\n/** Which budget a delivery spends: `mediaCdnEdgeCacheable` of what it serves. */\nexport type MediaCdnRateClass = 'image' | 'non-image'\n\n/**\n * The address a caller is counted under: an IPv4 address as it is, an IPv6\n * address as its `/64`.\n *\n * `readClientIp` has already normalized the address, so an IPv6 value here is\n * lower-case hex and colons. Anything that does not expand to eight groups is\n * counted under the value as given, which can only be narrower than a `/64`.\n */\nexport function mediaCdnRateLimitCaller(address: string): string {\n  if (!address.includes(':')) return address\n  const halves = address.split('::')\n  if (halves.length > 2) return address\n  const head = halves[0] ? halves[0].split(':') : []\n  const tail = halves.length === 2 && halves[1] ? halves[1].split(':') : []\n  const elided = halves.length === 2 ? 8 - head.length - tail.length : 0\n  if (elided < 0 || (halves.length === 2 && elided === 0)) return address\n  const groups = [...head, ...Array<string>(elided).fill('0'), ...tail]\n  if (groups.length !== 8 || !groups.every((group) => /^[0-9a-f]{1,4}$/.test(group))) {\n    return address\n  }\n  return `${groups\n    .slice(0, 4)\n    .map((group) => group.replace(/^0+(?=[0-9a-f])/, ''))\n    .join(':')}::/64`\n}\n\n/** The counter key for one caller's budget in one class. */\nexport function mediaCdnRateLimitKey(\n  rateClass: MediaCdnRateClass,\n  address: string,\n): string {\n  return `media-cdn:${rateClass}:${mediaCdnRateLimitCaller(address)}`\n}\n\nexport interface MediaCdnRateLimitOptions {\n  /** The request's headers, node-style or `Headers`-shaped. */\n  headers: ClientIpHeaders\n  /** `req.socket.remoteAddress`, which `readClientIp` consults last. */\n  remoteAddress?: string | null\n  rateClass: MediaCdnRateClass\n  limit?: number\n  windowMs?: number\n  budgetMs?: number\n  nowMs?: number\n  /** Injectable for tests; defaults to the Admin SDK's Firestore. */\n  firestore?: unknown\n}\n\nexport interface MediaCdnRateLimitRefusal {\n  /** Whole seconds until the caller's window ends, never less than 1. */\n  retryAfterSeconds: number\n}\n\n/**\n * Counts one delivery against its caller, and answers with a refusal only\n * when the durable count is past the ceiling. `null` means serve.\n *\n * Never rejects: see \"Fails open\" above.\n */\nexport async function mediaCdnRateLimitRefusal(\n  options: MediaCdnRateLimitOptions,\n): Promise<MediaCdnRateLimitRefusal | null> {\n  try {\n    const address = readClientIp(options.headers, {\n      remoteAddress: options.remoteAddress,\n    })\n    if (!address) return null\n    const nowMs = options.nowMs ?? Date.now()\n    const rate = await consumeRateLimit(\n      mediaCdnRateLimitKey(options.rateClass, address),\n      {\n        limit:\n          options.limit ??\n          (options.rateClass === 'image'\n            ? MEDIA_CDN_IMAGE_RATE_LIMIT\n            : MEDIA_CDN_NON_IMAGE_RATE_LIMIT),\n        windowMs: options.windowMs ?? MEDIA_CDN_RATE_WINDOW_MS,\n        budgetMs: options.budgetMs ?? MEDIA_CDN_RATE_LIMIT_BUDGET_MS,\n        now: nowMs,\n        firestore: options.firestore,\n      },\n    )\n    if (rate.allowed || rate.contended || rate.degraded) return null\n    return {\n      retryAfterSeconds: Math.max(1, Math.ceil((rate.resetMs - nowMs) / 1000)),\n    }\n  } catch {\n    return null\n  }\n}\n"],"names":["readClientIp","consumeRateLimit","MEDIA_CDN_RATE_WINDOW_MS","MEDIA_CDN_IMAGE_RATE_LIMIT","MEDIA_CDN_NON_IMAGE_RATE_LIMIT","MEDIA_CDN_RATE_LIMIT_BUDGET_MS","mediaCdnRateLimitCaller","address","includes","halves","split","length","head","tail","elided","groups","Array","fill","every","group","test","slice","map","replace","join","mediaCdnRateLimitKey","rateClass","mediaCdnRateLimitRefusal","options","headers","remoteAddress","nowMs","Date","now","rate","limit","windowMs","budgetMs","firestore","allowed","contended","degraded","retryAfterSeconds","Math","max","ceil","resetMs"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAEEA,YAAY,QACP,oCAAmC;AAC1C,SAASC,gBAAgB,QAAQ,wBAAoB;AAErD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqHC,GAED,qEAAqE,GACrE,OAAO,MAAMC,2BAA2B,MAAM;AAE9C,yEAAyE,GACzE,OAAO,MAAMC,6BAA6B,IAAG;AAE7C,6EAA6E,GAC7E,OAAO,MAAMC,iCAAiC,IAAG;AAEjD;;;;;;;;CAQC,GACD,OAAO,MAAMC,iCAAiC,KAAK;AAKnD;;;;;;;CAOC,GACD,OAAO,SAASC,wBAAwBC,OAAe;IACrD,IAAI,CAACA,QAAQC,QAAQ,CAAC,MAAM,OAAOD;IACnC,MAAME,SAASF,QAAQG,KAAK,CAAC;IAC7B,IAAID,OAAOE,MAAM,GAAG,GAAG,OAAOJ;IAC9B,MAAMK,OAAOH,MAAM,CAAC,EAAE,GAAGA,MAAM,CAAC,EAAE,CAACC,KAAK,CAAC,OAAO,EAAE;IAClD,MAAMG,OAAOJ,OAAOE,MAAM,KAAK,KAAKF,MAAM,CAAC,EAAE,GAAGA,MAAM,CAAC,EAAE,CAACC,KAAK,CAAC,OAAO,EAAE;IACzE,MAAMI,SAASL,OAAOE,MAAM,KAAK,IAAI,IAAIC,KAAKD,MAAM,GAAGE,KAAKF,MAAM,GAAG;IACrE,IAAIG,SAAS,KAAML,OAAOE,MAAM,KAAK,KAAKG,WAAW,GAAI,OAAOP;IAChE,MAAMQ,SAAS;WAAIH;WAASI,MAAcF,QAAQG,IAAI,CAAC;WAASJ;KAAK;IACrE,IAAIE,OAAOJ,MAAM,KAAK,KAAK,CAACI,OAAOG,KAAK,CAAC,CAACC,QAAU,kBAAkBC,IAAI,CAACD,SAAS;QAClF,OAAOZ;IACT;IACA,OAAO,GAAGQ,OACPM,KAAK,CAAC,GAAG,GACTC,GAAG,CAAC,CAACH,QAAUA,MAAMI,OAAO,CAAC,mBAAmB,KAChDC,IAAI,CAAC,KAAK,KAAK,CAAC;AACrB;AAEA,0DAA0D,GAC1D,OAAO,SAASC,qBACdC,SAA4B,EAC5BnB,OAAe;IAEf,OAAO,CAAC,UAAU,EAAEmB,UAAU,CAAC,EAAEpB,wBAAwBC,UAAU;AACrE;AAqBA;;;;;CAKC,GACD,OAAO,eAAeoB,yBACpBC,OAAiC;IAEjC,IAAI;YAKYA,gBAKRA,gBAIQA,mBACAA;QAdd,MAAMrB,UAAUP,aAAa4B,QAAQC,OAAO,EAAE;YAC5CC,eAAeF,QAAQE,aAAa;QACtC;QACA,IAAI,CAACvB,SAAS,OAAO;QACrB,MAAMwB,SAAQH,iBAAAA,QAAQG,KAAK,YAAbH,iBAAiBI,KAAKC,GAAG;QACvC,MAAMC,OAAO,MAAMjC,iBACjBwB,qBAAqBG,QAAQF,SAAS,EAAEnB,UACxC;YACE4B,KAAK,GACHP,iBAAAA,QAAQO,KAAK,YAAbP,iBACCA,QAAQF,SAAS,KAAK,UACnBvB,6BACAC;YACNgC,QAAQ,GAAER,oBAAAA,QAAQQ,QAAQ,YAAhBR,oBAAoB1B;YAC9BmC,QAAQ,GAAET,oBAAAA,QAAQS,QAAQ,YAAhBT,oBAAoBvB;YAC9B4B,KAAKF;YACLO,WAAWV,QAAQU,SAAS;QAC9B;QAEF,IAAIJ,KAAKK,OAAO,IAAIL,KAAKM,SAAS,IAAIN,KAAKO,QAAQ,EAAE,OAAO;QAC5D,OAAO;YACLC,mBAAmBC,KAAKC,GAAG,CAAC,GAAGD,KAAKE,IAAI,CAAC,AAACX,CAAAA,KAAKY,OAAO,GAAGf,KAAI,IAAK;QACpE;IACF,EAAE,eAAM;QACN,OAAO;IACT;AACF"}
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/media-cdn-rate-limit.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  type ClientIpHeaders,\n  readClientIp,\n} from '@aglyn/aglyn/app-utils/request-ip'\nimport { consumeRateLimit } from './rate-limit-store'\n\n/**\n * The media CDN's per-caller limit (AGL-2812).\n *\n * `/api/media/cdn/*` is anonymous public delivery, and nothing bounded how\n * much of it one caller could take. The firewall bypasses the route on\n * purpose, because link-preview crawlers and Gmail's image proxy cannot solve\n * a challenge (\"Public asset delivery bypass\" in\n * `tools/scripts/lib/firewall-posture.mjs`). Both middlewares exclude `/api/*`.\n * The edge counts the path too, ahead of that bypass (\"Media CDN per-IP rate\n * limit\", 1,500 requests a minute per address), but it sees one stream of\n * requests per address: only `serveMediaCdn` can tell an image from a film,\n * skip a 304, and fold an IPv6 address to its /64, so the ceilings on what one\n * caller is served live here.\n *\n * ## What is counted\n *\n * A GET that gets past every access gate, the lockdown and quarantine\n * refusals and the 304 exit, which is where the Storage reads begin. Those\n * refusals, a 304 and a HEAD send no file, so a revalidating browser, a\n * crawler's HEAD and a probe for a deleted id spend nothing. The counter's\n * Firestore write is paid only where the delivery it guards is about to cost\n * more. The count starts beside the metadata read, so a request that then\n * finds no object in Storage, or asks for an unsatisfiable range, has been\n * counted too.\n *\n * ## Two budgets, split where the edge splits them\n *\n * Images and everything else are counted separately, on the line\n * `mediaCdnEdgeCacheable` already draws (AGL-1515):\n *\n * - **Images** are held by the edge, so only a miss reaches the function, and\n *   images are what link-preview crawlers and Gmail's image proxy fetch.\n * - **Everything else** (video, audio, PDFs, documents) is `private`, so every\n *   request reaches the function, and it is where the bytes are: a video\n *   master is a single request for up to 200 MB.\n *\n * Separate keys also mean a DAM grid's burst of tiles cannot spend the budget\n * the video on the same page needs, or the reverse.\n *\n * ## Thresholds, from measured traffic\n *\n * Read from both mounts' production request logs on 2026-09-11: the tenant's\n * last seven days (2026-09-04 08:01 to 2026-09-11 07:56 UTC), and the\n * console's last sixteen hours, which is all it retains. Only requests that\n * reached the function count, since an edge hit never runs this code.\n *\n * | measured | busiest minute, whole route |\n * | -- | -- |\n * | image deliveries (200 and 206) | 98 |\n * | every other delivery (200 and 206) | 31 |\n * | every request, with 304s, 404s and edge hits | 236 |\n * | link-preview crawlers and other bots, together | 32 |\n * | Gmail's image proxy | none in the sample |\n *\n * Each of those minutes was one browser: the image peak was a single Chrome\n * session pulling 129 distinct assets, and the non-image peak a single session\n * following 31 `?download=1` links. No asset took more than 4 range requests\n * in a minute. Over thirty days the day documents count 30,855 origin serves\n * in all, and 4,234 on the busiest day.\n *\n * Each ceiling is at least five times the busiest minute the whole route\n * served in its class. No single address can reach it with a pattern the route\n * has actually seen, even if every request in that minute had been its own:\n *\n * - {@link MEDIA_CDN_IMAGE_RATE_LIMIT}, 600: 6.1 times the image peak, and more\n *   than 18 times every crawler together.\n * - {@link MEDIA_CDN_NON_IMAGE_RATE_LIMIT}, 180: 5.8 times the non-image peak.\n *   Tenant video uploads are paused (AGL-2830), so film playback is barely in\n *   the sample. A page of twelve films at four ranges a minute each still fits\n *   more than three times over.\n *\n * ## Keyed on the caller alone\n *\n * The key is the caller's address and the class: not the site, the asset or\n * the query string. Cycling media ids, cache-busting a URL with a junk query\n * parameter, or switching between the tenant and console mounts all land in\n * the same counter.\n *\n * The address comes from `readClientIp`, which reads the hop the platform\n * wrote rather than one a caller can prepend. An IPv6 address counts by its\n * `/64`: one subscriber is routinely handed a whole `/64`, so keying on the\n * full address would give that subscriber 2^64 budgets.\n *\n * A request with no readable address is not counted at all. One shared bucket\n * for every unaddressable caller would refuse all of them together the moment\n * a proxy stopped naming callers, which is media delivery taken down by its\n * own limiter (see `NO_CLIENT_ADDRESS_BUCKET`). Vercel always names the caller,\n * so production does not reach that branch.\n *\n * ## Fails open\n *\n * Only a durable count past the ceiling refuses. Everything else admits:\n *\n * - **Contended, or no answer inside the budget.** `consumeRateLimit` reports\n *   both as `allowed: false` with `contended: true`. That is the store saying\n *   it could not count, not that the caller is over, and reading it as a\n *   refusal is how a slow counter fails every request closed.\n * - **The store is down.** `consumeRateLimit` falls back to its per-instance\n *   count and flags `degraded`. The episode is still recorded and still\n *   reaches `/api/health/rate-limits`; the request is admitted.\n * - **Anything thrown.** Counting may never be the reason a delivery fails.\n *\n * Delivery is the product, and the counter and the media document share one\n * Firestore. While the counter cannot answer, the document read in front of it\n * is usually failing too, and refusing would add a second outage to the first.\n *\n * ## Latency\n *\n * `serveMediaCdn` starts the count beside the Storage metadata read, so its\n * two round trips overlap one the request already pays. It gets\n * {@link MEDIA_CDN_RATE_LIMIT_BUDGET_MS} rather than the store's 2.5 s\n * default, and a request whose count has not come back by then is admitted.\n *\n * ## What it does not bound\n *\n * The bytes in one request, a caller spread across many addresses, and an\n * org's total delivery. A WAF rule, a signed or referrer-checked public URL and\n * a per-org byte cap are the controls for those. Each one changes what an\n * `og:image`, a mailed image or an embed is able to fetch, so none of them is\n * decided here.\n */\n\n/** Fixed 60 s window, the same as every other limiter on the store. */\nexport const MEDIA_CDN_RATE_WINDOW_MS = 60_000\n\n/** Image deliveries one caller may start in a window; see \"Thresholds\". */\nexport const MEDIA_CDN_IMAGE_RATE_LIMIT = 600\n\n/** Non-image deliveries one caller may start in a window; see \"Thresholds\". */\nexport const MEDIA_CDN_NON_IMAGE_RATE_LIMIT = 180\n\n/**\n * How long a delivery waits for its count before it is admitted uncounted.\n *\n * The store's default is 2.5 s, sized for a password attempt that can afford\n * to wait. A video seek cannot. The count's two round trips were measured at\n * about 0.6 s end to end including the request itself (`rate-limit-store.ts`),\n * and they run beside the metadata read, so 1 s is ample for an answer and\n * short enough that a stalled store costs a player one short pause.\n */\nexport const MEDIA_CDN_RATE_LIMIT_BUDGET_MS = 1_000\n\n/** Which budget a delivery spends: `mediaCdnEdgeCacheable` of what it serves. */\nexport type MediaCdnRateClass = 'image' | 'non-image'\n\n/**\n * The address a caller is counted under: an IPv4 address as it is, an IPv6\n * address as its `/64`.\n *\n * `readClientIp` has already normalized the address, so an IPv6 value here is\n * lower-case hex and colons. Anything that does not expand to eight groups is\n * counted under the value as given, which can only be narrower than a `/64`.\n */\nexport function mediaCdnRateLimitCaller(address: string): string {\n  if (!address.includes(':')) return address\n  const halves = address.split('::')\n  if (halves.length > 2) return address\n  const head = halves[0] ? halves[0].split(':') : []\n  const tail = halves.length === 2 && halves[1] ? halves[1].split(':') : []\n  const elided = halves.length === 2 ? 8 - head.length - tail.length : 0\n  if (elided < 0 || (halves.length === 2 && elided === 0)) return address\n  const groups = [...head, ...Array<string>(elided).fill('0'), ...tail]\n  if (groups.length !== 8 || !groups.every((group) => /^[0-9a-f]{1,4}$/.test(group))) {\n    return address\n  }\n  return `${groups\n    .slice(0, 4)\n    .map((group) => group.replace(/^0+(?=[0-9a-f])/, ''))\n    .join(':')}::/64`\n}\n\n/** The counter key for one caller's budget in one class. */\nexport function mediaCdnRateLimitKey(\n  rateClass: MediaCdnRateClass,\n  address: string,\n): string {\n  return `media-cdn:${rateClass}:${mediaCdnRateLimitCaller(address)}`\n}\n\nexport interface MediaCdnRateLimitOptions {\n  /** The request's headers, node-style or `Headers`-shaped. */\n  headers: ClientIpHeaders\n  /** `req.socket.remoteAddress`, which `readClientIp` consults last. */\n  remoteAddress?: string | null\n  rateClass: MediaCdnRateClass\n  limit?: number\n  windowMs?: number\n  budgetMs?: number\n  nowMs?: number\n  /** Injectable for tests; defaults to the Admin SDK's Firestore. */\n  firestore?: unknown\n}\n\nexport interface MediaCdnRateLimitRefusal {\n  /** Whole seconds until the caller's window ends, never less than 1. */\n  retryAfterSeconds: number\n}\n\n/**\n * Counts one delivery against its caller, and answers with a refusal only\n * when the durable count is past the ceiling. `null` means serve.\n *\n * Never rejects: see \"Fails open\" above.\n */\nexport async function mediaCdnRateLimitRefusal(\n  options: MediaCdnRateLimitOptions,\n): Promise<MediaCdnRateLimitRefusal | null> {\n  try {\n    const address = readClientIp(options.headers, {\n      remoteAddress: options.remoteAddress,\n    })\n    if (!address) return null\n    const nowMs = options.nowMs ?? Date.now()\n    const rate = await consumeRateLimit(\n      mediaCdnRateLimitKey(options.rateClass, address),\n      {\n        limit:\n          options.limit ??\n          (options.rateClass === 'image'\n            ? MEDIA_CDN_IMAGE_RATE_LIMIT\n            : MEDIA_CDN_NON_IMAGE_RATE_LIMIT),\n        windowMs: options.windowMs ?? MEDIA_CDN_RATE_WINDOW_MS,\n        budgetMs: options.budgetMs ?? MEDIA_CDN_RATE_LIMIT_BUDGET_MS,\n        now: nowMs,\n        firestore: options.firestore,\n      },\n    )\n    if (rate.allowed || rate.contended || rate.degraded) return null\n    return {\n      retryAfterSeconds: Math.max(1, Math.ceil((rate.resetMs - nowMs) / 1000)),\n    }\n  } catch {\n    return null\n  }\n}\n"],"names":["readClientIp","consumeRateLimit","MEDIA_CDN_RATE_WINDOW_MS","MEDIA_CDN_IMAGE_RATE_LIMIT","MEDIA_CDN_NON_IMAGE_RATE_LIMIT","MEDIA_CDN_RATE_LIMIT_BUDGET_MS","mediaCdnRateLimitCaller","address","includes","halves","split","length","head","tail","elided","groups","Array","fill","every","group","test","slice","map","replace","join","mediaCdnRateLimitKey","rateClass","mediaCdnRateLimitRefusal","options","headers","remoteAddress","nowMs","Date","now","rate","limit","windowMs","budgetMs","firestore","allowed","contended","degraded","retryAfterSeconds","Math","max","ceil","resetMs"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAEEA,YAAY,QACP,oCAAmC;AAC1C,SAASC,gBAAgB,QAAQ,wBAAoB;AAErD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwHC,GAED,qEAAqE,GACrE,OAAO,MAAMC,2BAA2B,MAAM;AAE9C,yEAAyE,GACzE,OAAO,MAAMC,6BAA6B,IAAG;AAE7C,6EAA6E,GAC7E,OAAO,MAAMC,iCAAiC,IAAG;AAEjD;;;;;;;;CAQC,GACD,OAAO,MAAMC,iCAAiC,KAAK;AAKnD;;;;;;;CAOC,GACD,OAAO,SAASC,wBAAwBC,OAAe;IACrD,IAAI,CAACA,QAAQC,QAAQ,CAAC,MAAM,OAAOD;IACnC,MAAME,SAASF,QAAQG,KAAK,CAAC;IAC7B,IAAID,OAAOE,MAAM,GAAG,GAAG,OAAOJ;IAC9B,MAAMK,OAAOH,MAAM,CAAC,EAAE,GAAGA,MAAM,CAAC,EAAE,CAACC,KAAK,CAAC,OAAO,EAAE;IAClD,MAAMG,OAAOJ,OAAOE,MAAM,KAAK,KAAKF,MAAM,CAAC,EAAE,GAAGA,MAAM,CAAC,EAAE,CAACC,KAAK,CAAC,OAAO,EAAE;IACzE,MAAMI,SAASL,OAAOE,MAAM,KAAK,IAAI,IAAIC,KAAKD,MAAM,GAAGE,KAAKF,MAAM,GAAG;IACrE,IAAIG,SAAS,KAAML,OAAOE,MAAM,KAAK,KAAKG,WAAW,GAAI,OAAOP;IAChE,MAAMQ,SAAS;WAAIH;WAASI,MAAcF,QAAQG,IAAI,CAAC;WAASJ;KAAK;IACrE,IAAIE,OAAOJ,MAAM,KAAK,KAAK,CAACI,OAAOG,KAAK,CAAC,CAACC,QAAU,kBAAkBC,IAAI,CAACD,SAAS;QAClF,OAAOZ;IACT;IACA,OAAO,GAAGQ,OACPM,KAAK,CAAC,GAAG,GACTC,GAAG,CAAC,CAACH,QAAUA,MAAMI,OAAO,CAAC,mBAAmB,KAChDC,IAAI,CAAC,KAAK,KAAK,CAAC;AACrB;AAEA,0DAA0D,GAC1D,OAAO,SAASC,qBACdC,SAA4B,EAC5BnB,OAAe;IAEf,OAAO,CAAC,UAAU,EAAEmB,UAAU,CAAC,EAAEpB,wBAAwBC,UAAU;AACrE;AAqBA;;;;;CAKC,GACD,OAAO,eAAeoB,yBACpBC,OAAiC;IAEjC,IAAI;YAKYA,gBAKRA,gBAIQA,mBACAA;QAdd,MAAMrB,UAAUP,aAAa4B,QAAQC,OAAO,EAAE;YAC5CC,eAAeF,QAAQE,aAAa;QACtC;QACA,IAAI,CAACvB,SAAS,OAAO;QACrB,MAAMwB,SAAQH,iBAAAA,QAAQG,KAAK,YAAbH,iBAAiBI,KAAKC,GAAG;QACvC,MAAMC,OAAO,MAAMjC,iBACjBwB,qBAAqBG,QAAQF,SAAS,EAAEnB,UACxC;YACE4B,KAAK,GACHP,iBAAAA,QAAQO,KAAK,YAAbP,iBACCA,QAAQF,SAAS,KAAK,UACnBvB,6BACAC;YACNgC,QAAQ,GAAER,oBAAAA,QAAQQ,QAAQ,YAAhBR,oBAAoB1B;YAC9BmC,QAAQ,GAAET,oBAAAA,QAAQS,QAAQ,YAAhBT,oBAAoBvB;YAC9B4B,KAAKF;YACLO,WAAWV,QAAQU,SAAS;QAC9B;QAEF,IAAIJ,KAAKK,OAAO,IAAIL,KAAKM,SAAS,IAAIN,KAAKO,QAAQ,EAAE,OAAO;QAC5D,OAAO;YACLC,mBAAmBC,KAAKC,GAAG,CAAC,GAAGD,KAAKE,IAAI,CAAC,AAACX,CAAAA,KAAKY,OAAO,GAAGf,KAAI,IAAK;QACpE;IACF,EAAE,eAAM;QACN,OAAO;IACT;AACF"}

package/src/lib/server/member-email-aliases.d.ts

@@ -14,7 +14,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-import { type MemberEmailAlias, type MemberEmailAliasAddRefusal } from '@aglyn/aglyn/app-utils/member-email-aliases';
+import { type MemberEmailAlias, type MemberEmailAliasAddRefusal, type RosterMember } from '@aglyn/aglyn/app-utils/member-email-aliases';
 /** Confirmation emails one member may cause per hour, across addresses. */
 export declare const MEMBER_EMAIL_ALIAS_SENDS_PER_MEMBER_PER_HOUR = 10;
 /**
@@ -33,6 +33,14 @@ export interface MemberEmailAliasRefused {
 }
 /** The addresses one member has added in one workspace, confirmed or not. */
 export declare function loadMemberEmailAliases(firestore: FirebaseFirestore.Firestore, orgId: string, uid: string): Promise<MemberEmailAlias[]>;
+/**
+ * The workspace's people and every address that is theirs — the member
+ * documents and every member's stored alias document, two reads under the
+ * org, reduced by `memberAddressRoster` to each member's sign-in address and
+ * the aliases they have confirmed (AGL-2975). What a received message is
+ * matched against to tell the team's own mail from a correspondent's.
+ */
+export declare function loadMemberAddressRoster(firestore: FirebaseFirestore.Firestore, orgId: string): Promise<RosterMember[]>;
 export type MemberEmailAliasAdded = {
     ok: true;
     alias: MemberEmailAlias;

package/src/lib/server/member-email-aliases.js

@@ -14,7 +14,7 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
- */ import { evaluateMemberEmailAliasAdd, isVerifiedMemberEmailAlias, MEMBER_EMAIL_ALIAS_CONFIRM_PARAM, MEMBER_EMAIL_ALIAS_CONFIRM_TTL_MS, MEMBER_EMAIL_ALIASES_COLLECTION, normalizeMemberEmailAlias, readMemberEmailAliases } from "@aglyn/aglyn/app-utils/member-email-aliases";
+ */ import { evaluateMemberEmailAliasAdd, isVerifiedMemberEmailAlias, MEMBER_EMAIL_ALIAS_CONFIRM_PARAM, MEMBER_EMAIL_ALIAS_CONFIRM_TTL_MS, MEMBER_EMAIL_ALIASES_COLLECTION, memberAddressRoster, normalizeMemberEmailAlias, readMemberEmailAliases } from "@aglyn/aglyn/app-utils/member-email-aliases";
 import { resolveBrandingProfile } from "@aglyn/aglyn/server";
 import { isEmailConfigured, sendEmail } from "@aglyn/shared-util-email";
 import { createHmac } from "crypto";
@@ -88,6 +88,30 @@ function memberRef(firestore, orgId, uid) {
     const snapshot = await aliasesRef(firestore, orgId, uid).get();
     return readMemberEmailAliases(snapshot.exists ? snapshot.data() : null);
 }
+/**
+ * The workspace's people and every address that is theirs — the member
+ * documents and every member's stored alias document, two reads under the
+ * org, reduced by `memberAddressRoster` to each member's sign-in address and
+ * the aliases they have confirmed (AGL-2975). What a received message is
+ * matched against to tell the team's own mail from a correspondent's.
+ */ export async function loadMemberAddressRoster(firestore, orgId) {
+    const orgRef = firestore.collection('orgs').doc(orgId);
+    const [members, aliases] = await Promise.all([
+        orgRef.collection('members').get(),
+        orgRef.collection(MEMBER_EMAIL_ALIASES_COLLECTION).get()
+    ]);
+    const rows = members.docs.map((doc)=>{
+        var _doc_data;
+        return _extends({}, (_doc_data = doc.data()) != null ? _doc_data : {}, {
+            $id: doc.id
+        });
+    });
+    const aliasDocuments = new Map(aliases.docs.map((doc)=>[
+            String(doc.id),
+            doc.data()
+        ]));
+    return memberAddressRoster(rows, aliasDocuments);
+}
 /**
  * Adds an address, unconfirmed, for a member of the workspace — or answers
  * the entry already waiting for it, so the caller sends another link. One