@harborclient/team-hub 0.2.2 → 0.2.3

package/dist/cli.js

@@ -431,7 +431,8 @@ function mapFirestoreCollection(id, data) {
     createdAt: data.createdAt,
     updatedAt: data.updatedAt ?? data.createdAt,
     createdByUserId: data.createdByUserId ?? null,
-    updatedByUserId: data.updatedByUserId ?? null
+    updatedByUserId: data.updatedByUserId ?? null,
+    deletionLocked: data.deletionLocked ?? false
   };
 }
 function mapFirestoreEnvironment(id, data) {
@@ -442,7 +443,8 @@ function mapFirestoreEnvironment(id, data) {
     createdAt: data.createdAt,
     updatedAt: data.updatedAt ?? data.createdAt,
     createdByUserId: data.createdByUserId ?? null,
-    updatedByUserId: data.updatedByUserId ?? null
+    updatedByUserId: data.updatedByUserId ?? null,
+    deletionLocked: data.deletionLocked ?? false
   };
 }
 function mapFirestoreFolder(id, data) {
@@ -988,7 +990,8 @@ var FirestoreDatabase = class _FirestoreDatabase {
       createdAt: now,
       updatedAt: now,
       createdByUserId: actingUserId,
-      updatedByUserId: actingUserId
+      updatedByUserId: actingUserId,
+      deletionLocked: false
     };
     await this.requireClient().collection(COLLECTIONS_COLLECTION).doc(id).set(data);
     await this.recordAuditEntry(actingUserId, "create", "collection", id);
@@ -1050,6 +1053,46 @@ var FirestoreDatabase = class _FirestoreDatabase {
     ];
     await this.commitBatchedDeletes(refs);
   }
+  /**
+   * Finds a collection by stable identifier.
+   *
+   * @param id - Collection ID to look up.
+   */
+  async findCollectionById(id) {
+    const snapshot = await this.requireClient().collection(COLLECTIONS_COLLECTION).doc(id).get();
+    if (!snapshot.exists) {
+      return null;
+    }
+    return mapFirestoreCollection(id, snapshot.data());
+  }
+  /**
+   * Updates whether non-admin users may delete a collection.
+   *
+   * @param id - Collection ID to update.
+   * @param deletionLocked - When true, user-role tokens cannot delete the collection.
+   * @param actingUserId - Admin user performing the update.
+   */
+  async setCollectionDeletionLocked(id, deletionLocked, actingUserId) {
+    const docRef = this.requireClient().collection(COLLECTIONS_COLLECTION).doc(id);
+    const snapshot = await docRef.get();
+    if (!snapshot.exists) {
+      throw new Error("Collection not found");
+    }
+    const updatedAt = /* @__PURE__ */ new Date();
+    await docRef.update({
+      deletionLocked,
+      updatedAt,
+      updatedByUserId: actingUserId
+    });
+    await this.recordAuditEntry(actingUserId, "update", "collection", id);
+    const existing = snapshot.data();
+    return mapFirestoreCollection(id, {
+      ...existing,
+      deletionLocked,
+      updatedAt,
+      updatedByUserId: actingUserId
+    });
+  }
   /**
    * Lists all environments ordered by name.
    */
@@ -1075,7 +1118,8 @@ var FirestoreDatabase = class _FirestoreDatabase {
       createdAt: now,
       updatedAt: now,
       createdByUserId: actingUserId,
-      updatedByUserId: actingUserId
+      updatedByUserId: actingUserId,
+      deletionLocked: false
     };
     await this.requireClient().collection(ENVIRONMENTS_COLLECTION).doc(id).set(data);
     await this.recordAuditEntry(actingUserId, "create", "environment", id);
@@ -1121,6 +1165,46 @@ var FirestoreDatabase = class _FirestoreDatabase {
     await this.recordAuditEntry(actingUserId, "delete", "environment", id);
     await this.requireClient().collection(ENVIRONMENTS_COLLECTION).doc(id).delete();
   }
+  /**
+   * Finds an environment by stable identifier.
+   *
+   * @param id - Environment ID to look up.
+   */
+  async findEnvironmentById(id) {
+    const snapshot = await this.requireClient().collection(ENVIRONMENTS_COLLECTION).doc(id).get();
+    if (!snapshot.exists) {
+      return null;
+    }
+    return mapFirestoreEnvironment(id, snapshot.data());
+  }
+  /**
+   * Updates whether non-admin users may delete an environment.
+   *
+   * @param id - Environment ID to update.
+   * @param deletionLocked - When true, user-role tokens cannot delete the environment.
+   * @param actingUserId - Admin user performing the update.
+   */
+  async setEnvironmentDeletionLocked(id, deletionLocked, actingUserId) {
+    const docRef = this.requireClient().collection(ENVIRONMENTS_COLLECTION).doc(id);
+    const snapshot = await docRef.get();
+    if (!snapshot.exists) {
+      throw new Error("Environment not found");
+    }
+    const updatedAt = /* @__PURE__ */ new Date();
+    await docRef.update({
+      deletionLocked,
+      updatedAt,
+      updatedByUserId: actingUserId
+    });
+    await this.recordAuditEntry(actingUserId, "update", "environment", id);
+    const existing = snapshot.data();
+    return mapFirestoreEnvironment(id, {
+      ...existing,
+      deletionLocked,
+      updatedAt,
+      updatedByUserId: actingUserId
+    });
+  }
   /**
    * Lists all saved requests in a collection.
    *
@@ -1731,7 +1815,8 @@ function mapCollectionSqlRow(row) {
     createdAt: row.created_at,
     updatedAt: row.updated_at ?? row.created_at,
     createdByUserId: row.created_by_user_id ?? null,
-    updatedByUserId: row.updated_by_user_id ?? null
+    updatedByUserId: row.updated_by_user_id ?? null,
+    deletionLocked: Boolean(row.deletion_locked)
   };
 }
 function mapEnvironmentSqlRow(row) {
@@ -1742,7 +1827,8 @@ function mapEnvironmentSqlRow(row) {
     createdAt: row.created_at,
     updatedAt: row.updated_at ?? row.created_at,
     createdByUserId: row.created_by_user_id ?? null,
-    updatedByUserId: row.updated_by_user_id ?? null
+    updatedByUserId: row.updated_by_user_id ?? null,
+    deletionLocked: Boolean(row.deletion_locked)
   };
 }
 function mapFolderSqlRow(row) {
@@ -1985,6 +2071,14 @@ CREATE TABLE IF NOT EXISTS llm_usage_log (
 )
 `.trim();
 var MYSQL_DEFAULT_AUTH_JSON = DEFAULT_AUTH_JSON;
+var COLLECTIONS_DELETION_LOCKED_MIGRATION_SQL = `
+ALTER TABLE collections
+  ADD COLUMN IF NOT EXISTS deletion_locked TINYINT(1) NOT NULL DEFAULT 0;
+`.trim();
+var ENVIRONMENTS_DELETION_LOCKED_MIGRATION_SQL = `
+ALTER TABLE environments
+  ADD COLUMN IF NOT EXISTS deletion_locked TINYINT(1) NOT NULL DEFAULT 0;
+`.trim();
 var MYSQL_MIGRATIONS = [
   USERS_MIGRATION_SQL,
   API_TOKENS_MIGRATION_SQL,
@@ -2005,7 +2099,9 @@ var MYSQL_MIGRATIONS = [
   FOLDERS_BACKFILL_UPDATED_AT_SQL,
   USERS_LLM_MIGRATION_SQL,
   LLM_USAGE_MIGRATION_SQL,
-  LLM_USAGE_LOG_MIGRATION_SQL
+  LLM_USAGE_LOG_MIGRATION_SQL,
+  COLLECTIONS_DELETION_LOCKED_MIGRATION_SQL,
+  ENVIRONMENTS_DELETION_LOCKED_MIGRATION_SQL
 ];
 
 // src/db/mysql/schemas.ts
@@ -2062,8 +2158,8 @@ function serializeAccessList(access) {
   return JSON.stringify(access);
 }
 var USER_SELECT_COLUMNS = `id, name, role, collection_access, environment_access, llm_access, llm_models, llm_monthly_token_limit, created_at, updated_at, created_by_user_id, updated_by_user_id`;
-var COLLECTION_SELECT_COLUMNS = `id, name, variables, headers, auth, pre_request_script, post_request_script, created_at, updated_at, created_by_user_id, updated_by_user_id`;
-var ENVIRONMENT_SELECT_COLUMNS = `id, name, variables, created_at, updated_at, created_by_user_id, updated_by_user_id`;
+var COLLECTION_SELECT_COLUMNS = `id, name, variables, headers, auth, pre_request_script, post_request_script, created_at, updated_at, created_by_user_id, updated_by_user_id, deletion_locked`;
+var ENVIRONMENT_SELECT_COLUMNS = `id, name, variables, created_at, updated_at, created_by_user_id, updated_by_user_id, deletion_locked`;
 var FOLDER_SELECT_COLUMNS = `id, collection_id, name, sort_order, created_at, updated_at, created_by_user_id, updated_by_user_id`;
 var REQUEST_SELECT_COLUMNS = `id, collection_id, folder_id, name, method, url, headers, params, auth, body, body_type, pre_request_script, post_request_script, comment, sort_order, created_at, updated_at, created_by_user_id, updated_by_user_id`;
 var API_TOKEN_SELECT_COLUMNS = `id, user_id, name, token_hash, token_prefix, created_at, last_used_at, revoked_at, created_by_user_id, updated_by_user_id`;
@@ -2655,6 +2751,50 @@ var MysqlDatabase = class _MysqlDatabase {
     await this.recordAuditEntry(actingUserId, "delete", "collection", id);
     await this.executeStatement("DELETE FROM collections WHERE id = ?", [id]);
   }
+  /**
+   * Finds a collection by stable identifier.
+   *
+   * @param id - Collection ID to look up.
+   */
+  async findCollectionById(id) {
+    const rows = await this.queryRows(
+      `${COLLECTION_SELECT} WHERE id = ?`,
+      [id]
+    );
+    const row = rows[0];
+    return row ? mapCollectionSqlRow(row) : null;
+  }
+  /**
+   * Updates whether non-admin users may delete a collection.
+   *
+   * @param id - Collection ID to update.
+   * @param deletionLocked - When true, user-role tokens cannot delete the collection.
+   * @param actingUserId - Admin user performing the update.
+   */
+  async setCollectionDeletionLocked(id, deletionLocked, actingUserId) {
+    const updatedAt = /* @__PURE__ */ new Date();
+    const result = await this.executeStatement(
+      `UPDATE collections
+      SET deletion_locked = ?,
+        updated_at = ?,
+        updated_by_user_id = ?
+      WHERE id = ?`,
+      [deletionLocked ? 1 : 0, updatedAt, actingUserId, id]
+    );
+    if ((result.affectedRows ?? 0) === 0) {
+      throw new Error("Collection not found");
+    }
+    await this.recordAuditEntry(actingUserId, "update", "collection", id);
+    const rows = await this.queryRows(
+      `${COLLECTION_SELECT} WHERE id = ?`,
+      [id]
+    );
+    const row = rows[0];
+    if (!row) {
+      throw new Error("Collection not found");
+    }
+    return mapCollectionSqlRow(row);
+  }
   /**
    * Lists all environments ordered by name.
    */
@@ -2738,6 +2878,50 @@ var MysqlDatabase = class _MysqlDatabase {
     await this.recordAuditEntry(actingUserId, "delete", "environment", id);
     await this.executeStatement("DELETE FROM environments WHERE id = ?", [id]);
   }
+  /**
+   * Finds an environment by stable identifier.
+   *
+   * @param id - Environment ID to look up.
+   */
+  async findEnvironmentById(id) {
+    const rows = await this.queryRows(
+      `${ENVIRONMENT_SELECT} WHERE id = ?`,
+      [id]
+    );
+    const row = rows[0];
+    return row ? mapEnvironmentSqlRow(row) : null;
+  }
+  /**
+   * Updates whether non-admin users may delete an environment.
+   *
+   * @param id - Environment ID to update.
+   * @param deletionLocked - When true, user-role tokens cannot delete the environment.
+   * @param actingUserId - Admin user performing the update.
+   */
+  async setEnvironmentDeletionLocked(id, deletionLocked, actingUserId) {
+    const updatedAt = /* @__PURE__ */ new Date();
+    const result = await this.executeStatement(
+      `UPDATE environments
+      SET deletion_locked = ?,
+        updated_at = ?,
+        updated_by_user_id = ?
+      WHERE id = ?`,
+      [deletionLocked ? 1 : 0, updatedAt, actingUserId, id]
+    );
+    if ((result.affectedRows ?? 0) === 0) {
+      throw new Error("Environment not found");
+    }
+    await this.recordAuditEntry(actingUserId, "update", "environment", id);
+    const rows = await this.queryRows(
+      `${ENVIRONMENT_SELECT} WHERE id = ?`,
+      [id]
+    );
+    const row = rows[0];
+    if (!row) {
+      throw new Error("Environment not found");
+    }
+    return mapEnvironmentSqlRow(row);
+  }
   /**
    * Lists all saved requests in a collection.
    *
@@ -3590,6 +3774,14 @@ CREATE INDEX IF NOT EXISTS llm_usage_log_user_created_at_idx ON llm_usage_log (u
 
 CREATE INDEX IF NOT EXISTS llm_usage_log_period_idx ON llm_usage_log (period);
 `.trim();
+var COLLECTIONS_DELETION_LOCKED_MIGRATION_SQL2 = `
+ALTER TABLE collections
+  ADD COLUMN IF NOT EXISTS deletion_locked BOOLEAN NOT NULL DEFAULT FALSE;
+`.trim();
+var ENVIRONMENTS_DELETION_LOCKED_MIGRATION_SQL2 = `
+ALTER TABLE environments
+  ADD COLUMN IF NOT EXISTS deletion_locked BOOLEAN NOT NULL DEFAULT FALSE;
+`.trim();
 var POSTGRES_MIGRATIONS = [
   USERS_MIGRATION_SQL2,
   API_TOKENS_MIGRATION_SQL2,
@@ -3610,7 +3802,9 @@ var POSTGRES_MIGRATIONS = [
   FOLDERS_BACKFILL_UPDATED_AT_SQL2,
   USERS_LLM_MIGRATION_SQL2,
   LLM_USAGE_MIGRATION_SQL2,
-  LLM_USAGE_LOG_MIGRATION_SQL2
+  LLM_USAGE_LOG_MIGRATION_SQL2,
+  COLLECTIONS_DELETION_LOCKED_MIGRATION_SQL2,
+  ENVIRONMENTS_DELETION_LOCKED_MIGRATION_SQL2
 ];
 
 // src/db/postgres/schemas.ts
@@ -4172,6 +4366,46 @@ var PostgresDatabase = class _PostgresDatabase {
     await this.recordAuditEntry(actingUserId, "delete", "collection", id);
     await this.query("DELETE FROM collections WHERE id = $1", [id]);
   }
+  /**
+   * Finds a collection by stable identifier.
+   *
+   * @param id - Collection ID to look up.
+   */
+  async findCollectionById(id) {
+    const result = await this.query(`${COLLECTION_SELECT2} WHERE id = $1`, [id]);
+    const row = result.rows[0];
+    return row ? mapCollectionSqlRow(row) : null;
+  }
+  /**
+   * Updates whether non-admin users may delete a collection.
+   *
+   * @param id - Collection ID to update.
+   * @param deletionLocked - When true, user-role tokens cannot delete the collection.
+   * @param actingUserId - Admin user performing the update.
+   */
+  async setCollectionDeletionLocked(id, deletionLocked, actingUserId) {
+    const updatedAt = /* @__PURE__ */ new Date();
+    const result = await this.query(
+      `UPDATE collections
+      SET deletion_locked = $1,
+        updated_at = $2,
+        updated_by_user_id = $3
+      WHERE id = $4`,
+      [deletionLocked, updatedAt, actingUserId, id]
+    );
+    if ((result.rowCount ?? 0) === 0) {
+      throw new Error("Collection not found");
+    }
+    await this.recordAuditEntry(actingUserId, "update", "collection", id);
+    const selectResult = await this.query(`${COLLECTION_SELECT2} WHERE id = $1`, [
+      id
+    ]);
+    const row = selectResult.rows[0];
+    if (!row) {
+      throw new Error("Collection not found");
+    }
+    return mapCollectionSqlRow(row);
+  }
   /**
    * Lists all environments ordered by name.
    */
@@ -4250,6 +4484,47 @@ var PostgresDatabase = class _PostgresDatabase {
     await this.recordAuditEntry(actingUserId, "delete", "environment", id);
     await this.query("DELETE FROM environments WHERE id = $1", [id]);
   }
+  /**
+   * Finds an environment by stable identifier.
+   *
+   * @param id - Environment ID to look up.
+   */
+  async findEnvironmentById(id) {
+    const result = await this.query(`${ENVIRONMENT_SELECT2} WHERE id = $1`, [id]);
+    const row = result.rows[0];
+    return row ? mapEnvironmentSqlRow(row) : null;
+  }
+  /**
+   * Updates whether non-admin users may delete an environment.
+   *
+   * @param id - Environment ID to update.
+   * @param deletionLocked - When true, user-role tokens cannot delete the environment.
+   * @param actingUserId - Admin user performing the update.
+   */
+  async setEnvironmentDeletionLocked(id, deletionLocked, actingUserId) {
+    const updatedAt = /* @__PURE__ */ new Date();
+    const result = await this.query(
+      `UPDATE environments
+      SET deletion_locked = $1,
+        updated_at = $2,
+        updated_by_user_id = $3
+      WHERE id = $4`,
+      [deletionLocked, updatedAt, actingUserId, id]
+    );
+    if ((result.rowCount ?? 0) === 0) {
+      throw new Error("Environment not found");
+    }
+    await this.recordAuditEntry(actingUserId, "update", "environment", id);
+    const selectResult = await this.query(
+      `${ENVIRONMENT_SELECT2} WHERE id = $1`,
+      [id]
+    );
+    const row = selectResult.rows[0];
+    if (!row) {
+      throw new Error("Environment not found");
+    }
+    return mapEnvironmentSqlRow(row);
+  }
   /**
    * Lists all saved requests in a collection.
    *
@@ -5744,6 +6019,9 @@ function canUseDataApi(user) {
 function canListCollections(user) {
   return canUseDataApi(user) || canUseManagementApi(user);
 }
+function canListEnvironments(user) {
+  return canUseDataApi(user) || canUseManagementApi(user);
+}
 function hasWildcardAccess(access) {
   return access.includes("*");
 }
@@ -5772,20 +6050,14 @@ function canCreateEnvironment(user) {
   return user.role === "user" && hasWildcardAccess(user.environmentAccess);
 }
 function filterAccessibleCollections(user, collections) {
-  if (user.role === "admin") {
-    return [];
-  }
-  if (hasWildcardAccess(user.collectionAccess)) {
+  if (user.role === "admin" || hasWildcardAccess(user.collectionAccess)) {
     return collections;
   }
   const allowed = new Set(user.collectionAccess);
   return collections.filter((collection) => allowed.has(collection.id));
 }
 function filterAccessibleEnvironments(user, environments) {
-  if (user.role === "admin") {
-    return [];
-  }
-  if (hasWildcardAccess(user.environmentAccess)) {
+  if (user.role === "admin" || hasWildcardAccess(user.environmentAccess)) {
     return environments;
   }
   const allowed = new Set(user.environmentAccess);
@@ -5810,6 +6082,17 @@ function isOverMonthlyLimit(totalTokens, limit) {
   return totalTokens >= limit;
 }
 
+// src/db/deletionLockedError.ts
+var DeletionLockedError = class extends Error {
+  /**
+   * @param entityType - Human-readable entity kind shown in the error message.
+   */
+  constructor(entityType) {
+    super(`Deletion is locked for this ${entityType}.`);
+    this.name = "DeletionLockedError";
+  }
+};
+
 // src/server/routes/schemas/common.ts
 import { z as z5 } from "zod/v4";
 var errorResponseSchema = z5.object({
@@ -5886,6 +6169,10 @@ function handleDbError(reply, error) {
     void reply.code(400).send(errorResponseSchema.parse({ error: error.message }));
     return true;
   }
+  if (error instanceof DeletionLockedError) {
+    void reply.code(403).send(errorResponseSchema.parse({ error: error.message }));
+    return true;
+  }
   if (isDuplicateUserNameDbError(error)) {
     void reply.code(400).send(errorResponseSchema.parse({ error: DUPLICATE_USER_NAME_MESSAGE }));
     return true;
@@ -5990,7 +6277,19 @@ var llmUsageSummaryResponseSchema = z7.object({
 // src/server/routes/schemas/admin.ts
 var adminResourceOptionSchema = z8.object({
   id: z8.string(),
-  name: z8.string()
+  name: z8.string(),
+  deletionLocked: z8.boolean()
+});
+var adminEntityConfigSchema = z8.object({
+  id: z8.string(),
+  name: z8.string(),
+  deletionLocked: z8.boolean()
+});
+var updateAdminCollectionBodySchema = z8.object({
+  deletionLocked: z8.boolean()
+});
+var updateAdminEnvironmentBodySchema = z8.object({
+  deletionLocked: z8.boolean()
 });
 var listAdminCollectionsResponseSchema = z8.object({
   collections: z8.array(adminResourceOptionSchema)
@@ -6107,7 +6406,8 @@ var collectionRecordSchema = z9.object({
   createdAt: timestampSchema,
   updatedAt: timestampSchema,
   createdByUserId: z9.string().nullable(),
-  updatedByUserId: z9.string().nullable()
+  updatedByUserId: z9.string().nullable(),
+  deletionLocked: z9.boolean()
 });
 var environmentRecordSchema = z9.object({
   id: z9.string(),
@@ -6116,7 +6416,8 @@ var environmentRecordSchema = z9.object({
   createdAt: timestampSchema,
   updatedAt: timestampSchema,
   createdByUserId: z9.string().nullable(),
-  updatedByUserId: z9.string().nullable()
+  updatedByUserId: z9.string().nullable(),
+  deletionLocked: z9.boolean()
 });
 var folderRecordSchema = z9.object({
   id: z9.string(),
@@ -6405,7 +6706,8 @@ async function registerAdminRoutes(app, options) {
         return reply.send({
           collections: collections.map((collection) => ({
             id: collection.id,
-            name: collection.name
+            name: collection.name,
+            deletionLocked: collection.deletionLocked
           }))
         });
       } catch (error) {
@@ -6438,7 +6740,8 @@ async function registerAdminRoutes(app, options) {
         return reply.send({
           environments: environments.map((environment) => ({
             id: environment.id,
-            name: environment.name
+            name: environment.name,
+            deletionLocked: environment.deletionLocked
           }))
         });
       } catch (error) {
@@ -6449,6 +6752,154 @@ async function registerAdminRoutes(app, options) {
       }
     }
   });
+  routes.route({
+    method: "DELETE",
+    url: "/admin/collections/:id",
+    schema: {
+      params: idParamSchema,
+      response: {
+        204: emptyResponseSchema,
+        403: errorResponseSchema,
+        404: errorResponseSchema
+      }
+    },
+    /**
+     * Deletes a collection regardless of deletion lock state.
+     */
+    handler: async (request, reply) => {
+      try {
+        const user = requireAuthenticatedUser(request);
+        if (denyUnlessAllowed(reply, canUseManagementApi(user))) {
+          return;
+        }
+        const collection = await db.findCollectionById(request.params.id);
+        if (!collection) {
+          void reply.code(404).send({ error: "Collection not found" });
+          return;
+        }
+        await db.deleteCollection(request.params.id, user.id);
+        return reply.code(204).send(null);
+      } catch (error) {
+        if (handleDbError(reply, error)) {
+          return;
+        }
+        throw error;
+      }
+    }
+  });
+  routes.route({
+    method: "PUT",
+    url: "/admin/collections/:id",
+    schema: {
+      params: idParamSchema,
+      body: updateAdminCollectionBodySchema,
+      response: {
+        200: adminEntityConfigSchema,
+        403: errorResponseSchema,
+        404: errorResponseSchema
+      }
+    },
+    /**
+     * Updates admin configuration for a collection.
+     */
+    handler: async (request, reply) => {
+      try {
+        const user = requireAuthenticatedUser(request);
+        if (denyUnlessAllowed(reply, canUseManagementApi(user))) {
+          return;
+        }
+        const collection = await db.setCollectionDeletionLocked(
+          request.params.id,
+          request.body.deletionLocked,
+          user.id
+        );
+        return reply.send({
+          id: collection.id,
+          name: collection.name,
+          deletionLocked: collection.deletionLocked
+        });
+      } catch (error) {
+        if (handleDbError(reply, error)) {
+          return;
+        }
+        throw error;
+      }
+    }
+  });
+  routes.route({
+    method: "DELETE",
+    url: "/admin/environments/:id",
+    schema: {
+      params: idParamSchema,
+      response: {
+        204: emptyResponseSchema,
+        403: errorResponseSchema,
+        404: errorResponseSchema
+      }
+    },
+    /**
+     * Deletes an environment regardless of deletion lock state.
+     */
+    handler: async (request, reply) => {
+      try {
+        const user = requireAuthenticatedUser(request);
+        if (denyUnlessAllowed(reply, canUseManagementApi(user))) {
+          return;
+        }
+        const environment = await db.findEnvironmentById(request.params.id);
+        if (!environment) {
+          void reply.code(404).send({ error: "Environment not found" });
+          return;
+        }
+        await db.deleteEnvironment(request.params.id, user.id);
+        return reply.code(204).send(null);
+      } catch (error) {
+        if (handleDbError(reply, error)) {
+          return;
+        }
+        throw error;
+      }
+    }
+  });
+  routes.route({
+    method: "PUT",
+    url: "/admin/environments/:id",
+    schema: {
+      params: idParamSchema,
+      body: updateAdminEnvironmentBodySchema,
+      response: {
+        200: adminEntityConfigSchema,
+        403: errorResponseSchema,
+        404: errorResponseSchema
+      }
+    },
+    /**
+     * Updates admin configuration for an environment.
+     */
+    handler: async (request, reply) => {
+      try {
+        const user = requireAuthenticatedUser(request);
+        if (denyUnlessAllowed(reply, canUseManagementApi(user))) {
+          return;
+        }
+        const environment = await db.setEnvironmentDeletionLocked(
+          request.params.id,
+          request.body.deletionLocked,
+          user.id
+        );
+        return reply.send({
+          id: environment.id,
+          name: environment.name,
+          deletionLocked: environment.deletionLocked
+        });
+      } catch (error) {
+        if (handleDbError(reply, error)) {
+          return;
+        }
+        throw error;
+      }
+    }
+  });
   routes.route({
     method: "GET",
     url: "/admin/llm/models",
@@ -6905,6 +7356,14 @@ async function registerCollectionRoutes(app, db) {
         )) {
           return;
         }
+        const collection = await db.findCollectionById(request.params.id);
+        if (!collection) {
+          void reply.code(404).send({ error: "Collection not found" });
+          return;
+        }
+        if (collection.deletionLocked) {
+          throw new DeletionLockedError("collection");
+        }
         await db.deleteCollection(request.params.id, user.id);
         return reply.code(204).send(null);
       } catch (error) {
@@ -6934,7 +7393,7 @@ async function registerEnvironmentRoutes(app, db) {
     handler: async (request, reply) => {
       try {
         const user = requireAuthenticatedUser(request);
-        if (denyUnlessAllowed(reply, canUseDataApi(user))) {
+        if (denyUnlessAllowed(reply, canListEnvironments(user))) {
           return;
         }
         const environments = await db.listEnvironments();
@@ -7041,6 +7500,14 @@ async function registerEnvironmentRoutes(app, db) {
         )) {
           return;
         }
+        const environment = await db.findEnvironmentById(request.params.id);
+        if (!environment) {
+          void reply.code(404).send({ error: "Environment not found" });
+          return;
+        }
+        if (environment.deletionLocked) {
+          throw new DeletionLockedError("environment");
+        }
         await db.deleteEnvironment(request.params.id, user.id);
         return reply.code(204).send(null);
       } catch (error) {