fluxmail 0.4.1 → 0.6.0

package/dist/http/admin.js

@@ -1,14 +1,122 @@
 import { createRoute, z } from '@hono/zod-openapi';
+import { isIP } from 'node:net';
 import { EmailError, isEmailError } from '@fluxmail/core';
 import { prepareHostedGmailConnection, prepareHostedOutlookConnection } from '../accounts/gmailConnection.js';
-import { LICENSE_KEY_PATTERN } from '../licensing/client.js';
+import { EnvironmentControlledSettingError } from '../config.js';
+import { LICENSE_KEY_PATTERN, releaseLicense } from '../licensing/client.js';
 import { activateLicense } from '../licensing/activation.js';
-import { checkLicenseState, readLeaseRow } from '../licensing/entitlements.js';
+import { checkLicenseState, clearLease, readLeaseRow } from '../licensing/entitlements.js';
+import { loadInstanceId } from '../licensing/refresher.js';
 import { ADMIN_CAPABILITIES, MCP_CAPABILITIES, NAMED_PERMISSION_PROFILES, customPermissionPolicy, permissionPolicyForProfile, } from '../permissions.js';
-import { countUsableRootKeys, createApiKey, isUsableRootKey, listApiKeys, revokeApiKey, updateApiKey, } from '../storage/apiKeys.js';
+import { createApiKey, listApiKeys, revokeApiKey, updateApiKey } from '../storage/apiKeys.js';
 import { findMember } from '../storage/members.js';
+import { canAdminister, canSeeAccountMetadata } from '../authorization.js';
+import { operationIdForRequest } from './operationRoutes.js';
+import { logCodedFailure, logFailure } from '../logging.js';
 export const ADMIN_BODY_LIMIT = 64 * 1024;
 export const ADMIN_CONNECTION_TIMEOUT_MS = 30_000;
+export const adminOperationRoutes = {
+    createConnection: {
+        method: 'post',
+        path: '/api/v1/admin/connections',
+        operationId: 'createAdministrativeConnection',
+    },
+    testImapConnection: {
+        method: 'post',
+        path: '/api/v1/admin/imap/tests',
+        operationId: 'testAdministrativeImapConnection',
+    },
+    updateImapFolders: {
+        method: 'patch',
+        path: '/api/v1/admin/accounts/{accountId}/imap/folders',
+        operationId: 'updateAdministrativeImapFolders',
+    },
+    listApiKeys: {
+        method: 'get',
+        path: '/api/v1/admin/api-keys',
+        operationId: 'listAdministrativeApiKeys',
+    },
+    createApiKey: {
+        method: 'post',
+        path: '/api/v1/admin/api-keys',
+        operationId: 'createAdministrativeApiKey',
+    },
+    updateApiKey: {
+        method: 'patch',
+        path: '/api/v1/admin/api-keys/{keyId}',
+        operationId: 'updateAdministrativeApiKey',
+    },
+    revokeApiKey: {
+        method: 'delete',
+        path: '/api/v1/admin/api-keys/{keyId}',
+        operationId: 'revokeAdministrativeApiKey',
+    },
+    getOauthApps: {
+        method: 'get',
+        path: '/api/v1/admin/oauth-apps',
+        operationId: 'getAdministrativeOAuthApps',
+    },
+    putOauthApp: {
+        method: 'put',
+        path: '/api/v1/admin/oauth-apps/{provider}',
+        operationId: 'putAdministrativeOAuthApp',
+    },
+    deleteOauthApp: {
+        method: 'delete',
+        path: '/api/v1/admin/oauth-apps/{provider}',
+        operationId: 'deleteAdministrativeOAuthApp',
+    },
+    getLicense: {
+        method: 'get',
+        path: '/api/v1/admin/license',
+        operationId: 'getAdministrativeLicense',
+    },
+    activateLicense: {
+        method: 'post',
+        path: '/api/v1/admin/license/activate',
+        operationId: 'activateAdministrativeLicense',
+    },
+    deactivateLicense: {
+        method: 'delete',
+        path: '/api/v1/admin/license',
+        operationId: 'deactivateAdministrativeLicense',
+    },
+};
+export function adminOperationId(method, path) {
+    return operationIdForRequest(Object.values(adminOperationRoutes), method, path);
+}
+function firstForwardedElement(value) {
+    return value?.split(',', 1)[0]?.trim() || undefined;
+}
+function forwardedParameter(request, name) {
+    const first = firstForwardedElement(request.headers.get('forwarded'));
+    if (!first)
+        return undefined;
+    for (const parameter of first.split(';')) {
+        const [key, ...parts] = parameter.split('=');
+        if (key?.trim().toLowerCase() !== name)
+            continue;
+        return parts.join('=').trim().replace(/^"|"$/g, '');
+    }
+    return undefined;
+}
+function forwardedProtocol(request) {
+    return (forwardedParameter(request, 'proto') ?? firstForwardedElement(request.headers.get('x-forwarded-proto')))?.toLowerCase();
+}
+function forwardedAddress(request) {
+    const value = forwardedParameter(request, 'for') ?? firstForwardedElement(request.headers.get('x-forwarded-for'));
+    if (!value || value.toLowerCase() === 'unknown' || value.startsWith('_'))
+        return undefined;
+    if (value.startsWith('[')) {
+        const closingBracket = value.indexOf(']');
+        const address = closingBracket > 0 ? value.slice(1, closingBracket) : '';
+        return isIP(address) ? address : undefined;
+    }
+    if (isIP(value))
+        return value;
+    const ipv4WithPort = value.match(/^(.*):(\d+)$/)?.[1];
+    return ipv4WithPort && isIP(ipv4WithPort) === 4 ? ipv4WithPort : undefined;
+}
 function isLoopbackAddress(value) {
     const normalized = value
         .toLowerCase()
@@ -19,17 +127,29 @@ function isLoopbackAddress(value) {
 function isLoopbackHostname(value) {
     return value.toLowerCase() === 'localhost' || isLoopbackAddress(value);
 }
-export function administrationUsesHttps(request, connection) {
+export function administrationUsesHttps(request, connection, trustProxy = false) {
     if (connection?.encrypted)
         return true;
+    if (connection?.remoteAddress !== undefined && isLoopbackAddress(connection.remoteAddress))
+        return true;
+    if (trustProxy && forwardedProtocol(request) === 'https')
+        return true;
     if (connection?.remoteAddress !== undefined)
-        return isLoopbackAddress(connection.remoteAddress);
+        return false;
     const requestUrl = new URL(request.url);
     // No socket is available in Hono's in-memory helper or in non-Node adapters.
     // These paths use the request URL itself. Node requests must pass the peer
     // and TLS state above so headers and configuration cannot bless plaintext.
     return requestUrl.protocol === 'https:' || isLoopbackHostname(requestUrl.hostname);
 }
+export function requestClientAddress(request, connection, trustProxy = false) {
+    if (trustProxy) {
+        const forwarded = forwardedAddress(request);
+        if (forwarded)
+            return forwarded;
+    }
+    return connection?.remoteAddress ?? 'unknown';
+}
 export async function requestBodyExceedsLimit(request, limit = ADMIN_BODY_LIMIT) {
     const contentLength = request.headers.get('content-length');
     if (contentLength !== null) {
@@ -65,7 +185,6 @@ const username = z.string().min(1).max(320);
 const password = z.string().min(1).max(4096);
 const folderPath = z.string().min(1).max(1024);
 const security = z.enum(['tls', 'starttls']);
-const sharingMode = z.enum(['private', 'selected', 'all']);
 const folderRoles = ['sent', 'drafts', 'trash', 'archive', 'spam'];
 const FolderOverridesSchema = z
     .object({
@@ -120,10 +239,10 @@ const ImapSettingsSchema = z
     },
 });
 const SharingSchema = {
-    owner: identifier.optional(),
+    ownerMemberId: identifier.optional(),
     reauthorizeAccountId: identifier.optional(),
-    sharingMode: sharingMode.optional(),
-    shareWith: z.array(identifier).max(100).optional(),
+    sharedWithAll: z.boolean().optional(),
+    grantedMemberIds: z.array(identifier).max(100).optional(),
 };
 const ConnectionSchema = z
     .discriminatedUnion('provider', [
@@ -131,7 +250,7 @@ const ConnectionSchema = z
     z.object({ provider: z.literal('outlook'), ...SharingSchema }).strict(),
     z.object({ provider: z.literal('imap'), ...SharingSchema, ...ImapSettingsSchema.shape }).strict(),
 ])
-    .openapi({ example: { provider: 'gmail', owner: 'you@example.com' } });
+    .openapi({ example: { provider: 'gmail', ownerMemberId: 'you@example.com' } });
 const CapabilitySchema = z.enum([...MCP_CAPABILITIES, ...ADMIN_CAPABILITIES]);
 const AdminCapabilitySchema = z.enum(ADMIN_CAPABILITIES);
 const ApiKeyCreateSchema = z
@@ -195,7 +314,7 @@ const ApiKeySchema = z
     name: z.string(),
     createdAt: z.string(),
     lastUsedAt: z.string().nullable(),
-    memberId: z.string().nullable(),
+    memberId: z.string(),
     permissionProfile: z.enum([...NAMED_PERMISSION_PROFILES, 'custom']),
     capabilities: z.array(CapabilitySchema),
     supplementalCapabilities: z.array(AdminCapabilitySchema),
@@ -205,6 +324,35 @@ const ApiKeySchema = z
     .openapi('AdministrativeApiKey');
 const GenericDataSchema = z.object({ data: z.record(z.unknown()) }).strict();
 const ApiKeyCreateResponseSchema = z.object({ data: ApiKeySchema.extend({ key: z.string() }) }).strict();
+const OAuthProviderSchema = z.enum(['google', 'outlook']).openapi({ example: 'google' });
+const OAuthAppInputSchema = z
+    .object({
+    clientId: z.string().trim().min(1).max(2048).openapi({ example: 'client-id.apps.example.com' }),
+    clientSecret: z.string().trim().min(1).max(16_384).optional().openapi({ example: 'client-secret' }),
+    tenantId: z.string().trim().min(1).max(2048).optional().openapi({ example: 'common' }),
+    publicClient: z.boolean().optional(),
+})
+    .strict()
+    .openapi({ example: { clientId: 'client-id.apps.example.com', clientSecret: 'client-secret' } });
+const OAuthAppsResponseSchema = z
+    .object({
+    data: z.object({
+        google: z.object({
+            clientId: z.string(),
+            clientSecretConfigured: z.boolean(),
+            source: z.enum(['built-in', 'stored', 'environment', 'environment-file']),
+            mutable: z.boolean(),
+        }),
+        outlook: z.object({
+            clientId: z.string().nullable(),
+            tenantId: z.string().nullable(),
+            clientSecretConfigured: z.boolean(),
+            source: z.enum(['stored', 'environment', 'environment-file']).nullable(),
+            mutable: z.boolean(),
+        }),
+    }),
+})
+    .strict();
 const errors = {
     400: { content: { 'application/json': { schema: ErrorSchema } }, description: 'Invalid request' },
     401: { content: { 'application/json': { schema: ErrorSchema } }, description: 'Authentication required' },
@@ -247,11 +395,18 @@ function json(body, status = 200) {
     });
 }
 function requireAdmin(auth, capability) {
-    if (!auth.permissions.capabilities.includes(capability)) {
-        throw new AdminFailure('permission_denied', `This API key does not allow ${capability}.`, 403);
+    if (!canAdminister(auth, capability)) {
+        throw new AdminFailure('permission_denied', `This credential does not allow ${capability}.`, 403);
     }
-    if (auth.memberId !== null && auth.role !== 'admin') {
-        throw new AdminFailure('admin_role_required', 'The API key owner is not an admin member.', 403);
+}
+function requireAdminAccount(auth, account) {
+    if (!canSeeAccountMetadata(auth, account)) {
+        throw new EmailError('not_found', 'Mailbox not found.');
+    }
+}
+function requireUnscopedAccountCreation(auth) {
+    if (auth.accountIds !== null) {
+        throw new EmailError('permission_denied', 'This API key is limited to existing mailboxes.');
     }
 }
 function registry(deps) {
@@ -260,23 +415,20 @@ function registry(deps) {
     return deps.registry;
 }
 function resolveSharing(deps, input) {
-    const shareWith = input.shareWith ?? [];
-    if (input.reauthorizeAccountId && (input.owner || input.sharingMode || shareWith.length)) {
+    const grantedMemberIds = input.grantedMemberIds ?? [];
+    if (input.reauthorizeAccountId &&
+        (input.ownerMemberId || input.sharedWithAll !== undefined || grantedMemberIds.length)) {
         throw new EmailError('invalid_request', 'Ownership and sharing settings cannot be combined with reauthorizeAccountId.');
     }
     if (input.reauthorizeAccountId)
         return { reauthorizeAccountId: registry(deps).getAccount(input.reauthorizeAccountId).id };
-    if (!input.owner)
-        throw new EmailError('invalid_request', 'owner is required for a new mailbox.');
-    const memberId = findMember(deps.db, input.owner).id;
-    const mode = input.sharingMode ?? (shareWith.length ? 'selected' : 'private');
-    if (mode === 'selected' && !shareWith.length) {
-        throw new EmailError('invalid_request', 'shareWith is required when sharingMode is "selected".');
-    }
-    if (mode !== 'selected' && shareWith.length) {
-        throw new EmailError('invalid_request', 'shareWith can only be used when sharingMode is "selected".');
-    }
-    return { memberId, sharingMode: mode, sharedMemberIds: shareWith.map((ref) => findMember(deps.db, ref).id) };
+    if (!input.ownerMemberId)
+        throw new EmailError('invalid_request', 'ownerMemberId is required for a new mailbox.');
+    return {
+        ownerMemberId: findMember(deps.db, input.ownerMemberId).id,
+        sharedWithAll: input.sharedWithAll ?? false,
+        grantedMemberIds: grantedMemberIds.map((ref) => findMember(deps.db, ref).id),
+    };
 }
 function permissions(input) {
     return input.customCapabilities
@@ -295,19 +447,27 @@ function serializeApiKey(key) {
         lastUsedAt: key.lastUsedAt === null ? null : new Date(key.lastUsedAt).toISOString(),
     };
 }
-async function run(fn) {
+async function run(deps, fn) {
     try {
         return await fn();
     }
     catch (error) {
+        const context = {
+            productSurface: 'rest',
+            operation: 'administrative_request',
+        };
+        if (error instanceof AdminFailure) {
+            logCodedFailure(deps.logger, 'rest.operation_failed', error.code, error.message, context);
+        }
+        else {
+            logFailure(deps.logger, 'rest.operation_failed', error, context);
+        }
         return failureResponse(error);
     }
 }
 export function registerAdminRoutes(app, deps) {
     const connectionsRoute = createRoute({
-        method: 'post',
-        path: '/api/v1/admin/connections',
-        operationId: 'createAdministrativeConnection',
+        ...adminOperationRoutes.createConnection,
         summary: 'Create or reauthorize a connection',
         description: 'Create or reauthorize a Gmail, Outlook, or IMAP connection. Requires admin.accounts.',
         ...protectedRoute,
@@ -320,10 +480,17 @@ export function registerAdminRoutes(app, deps) {
             ...errors,
         },
     });
-    app.openapi(connectionsRoute, (c) => run(async () => {
-        requireAdmin(c.get('restAuth'), 'admin.accounts');
+    app.openapi(connectionsRoute, (c) => run(deps, async () => {
+        const auth = c.get('restAuth');
+        requireAdmin(auth, 'admin.accounts');
         const input = c.req.valid('json');
         const access = resolveSharing(deps, input);
+        if (access.reauthorizeAccountId) {
+            requireAdminAccount(auth, registry(deps).getAccount(access.reauthorizeAccountId));
+        }
+        else {
+            requireUnscopedAccountCreation(auth);
+        }
         if (input.provider === 'gmail' || input.provider === 'outlook') {
             if (!access.reauthorizeAccountId)
                 registry(deps).assertCanAddAccount();
@@ -358,13 +525,13 @@ export function registerAdminRoutes(app, deps) {
             folderOverrides: { ...previous?.folderOverrides, ...input.folderOverrides },
         };
         const warnings = await registry(deps).testImapCredentials(input.email, credentials, input.displayName, ADMIN_CONNECTION_TIMEOUT_MS);
-        const connected = registry(deps).addImapAccount(input.email, credentials, input.displayName, access.memberId, access.reauthorizeAccountId, access.sharingMode ? { sharingMode: access.sharingMode, sharedMemberIds: access.sharedMemberIds } : undefined);
+        const connected = registry(deps).addImapAccount(input.email, credentials, input.displayName, access.ownerMemberId, access.reauthorizeAccountId, access.ownerMemberId
+            ? { sharedWithAll: access.sharedWithAll ?? false, grantedMemberIds: access.grantedMemberIds }
+            : undefined);
         return json({ data: { account: connected, warnings } }, 201);
     }));
     const imapTestRoute = createRoute({
-        method: 'post',
-        path: '/api/v1/admin/imap/tests',
-        operationId: 'testAdministrativeImapConnection',
+        ...adminOperationRoutes.testImapConnection,
         summary: 'Test an IMAP connection',
         description: 'Test IMAP and SMTP settings without saving an account. Requires admin.accounts.',
         ...protectedRoute,
@@ -374,7 +541,7 @@ export function registerAdminRoutes(app, deps) {
             ...errors,
         },
     });
-    app.openapi(imapTestRoute, (c) => run(async () => {
+    app.openapi(imapTestRoute, (c) => run(deps, async () => {
         requireAdmin(c.get('restAuth'), 'admin.accounts');
         const input = c.req.valid('json');
         const warnings = await registry(deps).testImapCredentials(input.email, {
@@ -386,9 +553,7 @@ export function registerAdminRoutes(app, deps) {
         return json({ data: { ok: true, warnings } });
     }));
     const folderRoute = createRoute({
-        method: 'patch',
-        path: '/api/v1/admin/accounts/{accountId}/imap/folders',
-        operationId: 'updateAdministrativeImapFolders',
+        ...adminOperationRoutes.updateImapFolders,
         summary: 'Update IMAP folders',
         description: 'Update the folder overrides for an IMAP account. Requires admin.accounts.',
         ...protectedRoute,
@@ -401,11 +566,13 @@ export function registerAdminRoutes(app, deps) {
             ...errors,
         },
     });
-    app.openapi(folderRoute, (c) => run(async () => {
-        requireAdmin(c.get('restAuth'), 'admin.accounts');
+    app.openapi(folderRoute, (c) => run(deps, async () => {
+        const auth = c.get('restAuth');
+        requireAdmin(auth, 'admin.accounts');
         const { accountId } = c.req.valid('param');
         const patch = c.req.valid('json');
         const account = registry(deps).getAccount(accountId);
+        requireAdminAccount(auth, account);
         const current = registry(deps).loadImapCredentials(account.id);
         const nextOverrides = { ...current.folderOverrides };
         for (const role of folderRoles) {
@@ -426,9 +593,7 @@ export function registerAdminRoutes(app, deps) {
         return json({ data: { accountId: account.id, folderOverrides: nextOverrides, warnings } });
     }));
     const listKeysRoute = createRoute({
-        method: 'get',
-        path: '/api/v1/admin/api-keys',
-        operationId: 'listAdministrativeApiKeys',
+        ...adminOperationRoutes.listApiKeys,
         summary: 'List API keys',
         description: 'List API key metadata without returning plaintext secrets. Requires admin.api_keys.',
         ...protectedRoute,
@@ -440,14 +605,12 @@ export function registerAdminRoutes(app, deps) {
             ...errors,
         },
     });
-    app.openapi(listKeysRoute, (c) => run(() => {
+    app.openapi(listKeysRoute, (c) => run(deps, () => {
         requireAdmin(c.get('restAuth'), 'admin.api_keys');
         return json({ data: listApiKeys(deps.db).map(serializeApiKey) });
     }));
     const createKeyRoute = createRoute({
-        method: 'post',
-        path: '/api/v1/admin/api-keys',
-        operationId: 'createAdministrativeApiKey',
+        ...adminOperationRoutes.createApiKey,
         summary: 'Create an API key',
         description: 'Create an API key and return its plaintext secret once. Requires admin.api_keys.',
         ...protectedRoute,
@@ -460,7 +623,7 @@ export function registerAdminRoutes(app, deps) {
             ...errors,
         },
     });
-    app.openapi(createKeyRoute, (c) => run(() => {
+    app.openapi(createKeyRoute, (c) => run(deps, () => {
         requireAdmin(c.get('restAuth'), 'admin.api_keys');
         const input = c.req.valid('json');
         const member = findMember(deps.db, input.member);
@@ -468,9 +631,7 @@ export function registerAdminRoutes(app, deps) {
         return json({ data: { ...serializeApiKey(created.info), key: created.key } }, 201);
     }));
     const patchKeyRoute = createRoute({
-        method: 'patch',
-        path: '/api/v1/admin/api-keys/{keyId}',
-        operationId: 'updateAdministrativeApiKey',
+        ...adminOperationRoutes.updateApiKey,
         summary: 'Update an API key',
         description: 'Update the permissions or mailbox scope of an API key. Requires admin.api_keys.',
         ...protectedRoute,
@@ -486,7 +647,7 @@ export function registerAdminRoutes(app, deps) {
             ...errors,
         },
     });
-    app.openapi(patchKeyRoute, (c) => run(() => {
+    app.openapi(patchKeyRoute, (c) => run(deps, () => {
         requireAdmin(c.get('restAuth'), 'admin.api_keys');
         const { keyId } = c.req.valid('param');
         const input = c.req.valid('json');
@@ -503,12 +664,6 @@ export function registerAdminRoutes(app, deps) {
             }
             nextPermissions = permissionPolicyForProfile(existing.permissionProfile, input.supplementalCapabilities);
         }
-        if (isUsableRootKey(deps.db, keyId) &&
-            nextPermissions &&
-            !nextPermissions.capabilities.includes('admin.api_keys') &&
-            countUsableRootKeys(deps.db, keyId) === 0) {
-            throw new AdminFailure('last_root_key', 'Another usable admin.api_keys credential is required first.', 409);
-        }
         const updated = updateApiKey(deps.db, keyId, {
             ...(nextPermissions ? { permissions: nextPermissions } : {}),
             ...(input.accounts !== undefined ? { accountIds: accountIds(deps, input.accounts) } : {}),
@@ -516,9 +671,7 @@ export function registerAdminRoutes(app, deps) {
         return json({ data: serializeApiKey(updated) });
     }));
     const deleteKeyRoute = createRoute({
-        method: 'delete',
-        path: '/api/v1/admin/api-keys/{keyId}',
-        operationId: 'revokeAdministrativeApiKey',
+        ...adminOperationRoutes.revokeApiKey,
         summary: 'Revoke an API key',
         description: 'Revoke an API key. Requires admin.api_keys.',
         ...protectedRoute,
@@ -528,20 +681,107 @@ export function registerAdminRoutes(app, deps) {
             ...errors,
         },
     });
-    app.openapi(deleteKeyRoute, (c) => run(() => {
+    app.openapi(deleteKeyRoute, (c) => run(deps, () => {
         requireAdmin(c.get('restAuth'), 'admin.api_keys');
         const { keyId } = c.req.valid('param');
-        if (isUsableRootKey(deps.db, keyId) && countUsableRootKeys(deps.db, keyId) === 0) {
-            throw new AdminFailure('last_root_key', 'Another usable admin.api_keys credential is required first.', 409);
-        }
         if (!revokeApiKey(deps.db, keyId))
             throw new EmailError('not_found', `No API key with id "${keyId}".`);
         return json({ data: { id: keyId, revoked: true } });
     }));
+    const getOauthAppsRoute = createRoute({
+        ...adminOperationRoutes.getOauthApps,
+        summary: 'Get OAuth application status',
+        description: 'Get safe OAuth application metadata without returning client secrets. Requires admin.accounts.',
+        ...protectedRoute,
+        responses: {
+            200: { content: { 'application/json': { schema: OAuthAppsResponseSchema } }, description: 'OAuth applications' },
+            ...errors,
+        },
+    });
+    app.openapi(getOauthAppsRoute, (c) => run(deps, () => {
+        requireAdmin(c.get('restAuth'), 'admin.accounts');
+        return json({ data: deps.configuration.oauthStatus() });
+    }));
+    const putOauthAppRoute = createRoute({
+        ...adminOperationRoutes.putOauthApp,
+        summary: 'Configure an OAuth application',
+        description: 'Save an OAuth application in encrypted instance settings. Requires admin.accounts.',
+        ...protectedRoute,
+        request: {
+            params: z.object({ provider: OAuthProviderSchema }).strict(),
+            body: { required: true, content: { 'application/json': { schema: OAuthAppInputSchema } } },
+        },
+        responses: {
+            200: { content: { 'application/json': { schema: OAuthAppsResponseSchema } }, description: 'OAuth applications' },
+            ...errors,
+        },
+    });
+    app.openapi(putOauthAppRoute, (c) => run(deps, () => {
+        requireAdmin(c.get('restAuth'), 'admin.accounts');
+        const { provider } = c.req.valid('param');
+        const input = c.req.valid('json');
+        try {
+            if (provider === 'google') {
+                if (!input.clientSecret) {
+                    throw new AdminFailure('invalid_request', 'Google OAuth requires a client secret.', 400);
+                }
+                if (input.tenantId !== undefined || input.publicClient !== undefined) {
+                    throw new AdminFailure('invalid_request', 'Google OAuth does not accept Microsoft settings.', 400);
+                }
+                deps.configuration.setGoogle({ clientId: input.clientId, clientSecret: input.clientSecret });
+            }
+            else {
+                if (input.publicClient === true && input.clientSecret) {
+                    throw new AdminFailure('invalid_request', 'A public client cannot include a client secret.', 400);
+                }
+                if (input.publicClient !== true && !input.clientSecret) {
+                    throw new AdminFailure('invalid_request', 'Choose a public client or provide a client secret.', 400);
+                }
+                deps.configuration.setMicrosoft({
+                    clientId: input.clientId,
+                    tenantId: input.tenantId ?? 'common',
+                    ...(input.clientSecret ? { clientSecret: input.clientSecret } : {}),
+                });
+            }
+        }
+        catch (error) {
+            if (error instanceof AdminFailure)
+                throw error;
+            if (!(error instanceof EnvironmentControlledSettingError))
+                throw error;
+            throw new AdminFailure('oauth_from_environment', 'Remove the OAuth environment overrides before changing this application.', 409);
+        }
+        return json({ data: deps.configuration.oauthStatus() });
+    }));
+    const deleteOauthAppRoute = createRoute({
+        ...adminOperationRoutes.deleteOauthApp,
+        summary: 'Reset an OAuth application',
+        description: 'Remove a stored OAuth application. Requires admin.accounts.',
+        ...protectedRoute,
+        request: { params: z.object({ provider: OAuthProviderSchema }).strict() },
+        responses: {
+            200: { content: { 'application/json': { schema: OAuthAppsResponseSchema } }, description: 'OAuth applications' },
+            ...errors,
+        },
+    });
+    app.openapi(deleteOauthAppRoute, (c) => run(deps, () => {
+        requireAdmin(c.get('restAuth'), 'admin.accounts');
+        const { provider } = c.req.valid('param');
+        try {
+            if (provider === 'google')
+                deps.configuration.resetGoogle();
+            else
+                deps.configuration.resetMicrosoft();
+        }
+        catch (error) {
+            if (!(error instanceof EnvironmentControlledSettingError))
+                throw error;
+            throw new AdminFailure('oauth_from_environment', 'Remove the OAuth environment overrides before resetting this application.', 409);
+        }
+        return json({ data: deps.configuration.oauthStatus() });
+    }));
     const licenseRoute = createRoute({
-        method: 'get',
-        path: '/api/v1/admin/license',
-        operationId: 'getAdministrativeLicense',
+        ...adminOperationRoutes.getLicense,
         summary: 'Get license status',
         description: 'Get license status and usage without returning the configured license key. Requires admin.license.',
         ...protectedRoute,
@@ -553,7 +793,7 @@ export function registerAdminRoutes(app, deps) {
             ...errors,
         },
     });
-    app.openapi(licenseRoute, (c) => run(() => {
+    app.openapi(licenseRoute, (c) => run(deps, () => {
         requireAdmin(c.get('restAuth'), 'admin.license');
         const state = checkLicenseState(deps.db);
         const row = readLeaseRow(deps.db);
@@ -561,7 +801,7 @@ export function registerAdminRoutes(app, deps) {
         return json({
             data: {
                 configured,
-                source: configured ? (deps.config.licenseKeyFromEnvironment ? 'environment' : 'stored') : null,
+                source: configured ? deps.configuration.licenseSource() : null,
                 entitlements: state.entitlements,
                 usage: { accounts: state.accountCount, members: state.memberCount, overQuota: state.overQuota },
                 lastValidatedAt: row ? new Date(row.updatedAt).toISOString() : null,
@@ -570,9 +810,7 @@ export function registerAdminRoutes(app, deps) {
         });
     }));
     const activateRoute = createRoute({
-        method: 'post',
-        path: '/api/v1/admin/license/activate',
-        operationId: 'activateAdministrativeLicense',
+        ...adminOperationRoutes.activateLicense,
         summary: 'Activate a license',
         description: 'Validate and activate a Fluxmail license key. Requires admin.license.',
         ...protectedRoute,
@@ -586,7 +824,7 @@ export function registerAdminRoutes(app, deps) {
             ...errors,
         },
     });
-    app.openapi(activateRoute, (c) => run(async () => {
+    app.openapi(activateRoute, (c) => run(deps, async () => {
         requireAdmin(c.get('restAuth'), 'admin.license');
         const { licenseKey } = c.req.valid('json');
         if (!LICENSE_KEY_PATTERN.test(licenseKey)) {
@@ -595,7 +833,7 @@ export function registerAdminRoutes(app, deps) {
         if (deps.config.licenseKeyFromEnvironment) {
             throw new AdminFailure('license_from_environment', 'REST cannot replace FLUXMAIL_LICENSE_KEY from the environment.', 409);
         }
-        const result = await activateLicense(deps.db, {
+        const result = await activateLicense(deps.db, deps.configuration, {
             licenseKey,
             serverUrl: deps.config.licenseServerUrl,
             dataDir: deps.config.dataDir,
@@ -614,5 +852,35 @@ export function registerAdminRoutes(app, deps) {
         const status = result.outcome === 'in_use' ? 409 : result.outcome === 'inactive' ? 403 : 400;
         throw new AdminFailure(`license_${result.outcome}`, result.message, status);
     }));
+    const deactivateRoute = createRoute({
+        method: 'delete',
+        path: '/api/v1/admin/license',
+        operationId: 'deactivateAdministrativeLicense',
+        summary: 'Deactivate a license',
+        description: 'Release the stored license and return this instance to Personal limits. Requires admin.license.',
+        ...protectedRoute,
+        responses: {
+            200: { content: { 'application/json': { schema: GenericDataSchema } }, description: 'License deactivated' },
+            ...errors,
+        },
+    });
+    app.openapi(deactivateRoute, (c) => run(deps, async () => {
+        requireAdmin(c.get('restAuth'), 'admin.license');
+        if (deps.config.licenseKeyFromEnvironment) {
+            throw new AdminFailure('license_from_environment', 'REST cannot remove FLUXMAIL_LICENSE_KEY from the environment.', 409);
+        }
+        const licenseKey = deps.licenseController?.configuredKey() ?? deps.config.licenseKey;
+        const released = licenseKey
+            ? await releaseLicense({
+                serverUrl: deps.config.licenseServerUrl,
+                licenseKey,
+                instanceId: loadInstanceId(deps.config.dataDir),
+            })
+            : false;
+        const removed = deps.configuration.removeLicenseKey();
+        clearLease(deps.db);
+        deps.licenseController?.wake();
+        return json({ data: { deactivated: true, released, removedStoredKey: removed } });
+    }));
 }
 //# sourceMappingURL=admin.js.map