portal-mojo 0.2.19 → 0.2.21

package/src/client/mock.ts

@@ -1,5 +1,7 @@
 import type { AssistantSetupState, SetupCheck } from '../admin/assistant/setup';
-import { fleetMock } from './fleet-mock';
+import { fleetMock, configureMockHubRecipient, consumeMockConnectionFault, getMockConnectionScenario, registerMockConsumerKey, setMockConnectionScenario, connectionFail } from './fleet-mock';
+export { setMockConnectionScenario };
+export type { MockConnectionScenario } from './fleet-mock';
 import { describeRenditions, validateRenditionSetting } from './renditions-mock';
 // In-memory django-mojo mock. Speaks the EXACT wire contract the real client
 // uses — envelope {status, data|rows..., message}, start/size paging, sort
@@ -210,6 +212,8 @@ function buildGroups(): MockGroup[] {
     ORG_NAMES.forEach((orgName, oi) => {
         const org = mk({
             name: orgName, kind: 'org',
+            // The guided protected-purpose fixture needs one original active hub identity.
+            ...(oi === 0 ? { uuid: '11111111111111111111111111111111' } : {}),
             created: Math.floor((now - (420 - oi * 40) * 864e5) / 1000),
             metadata: oi % 2 === 0
                 ? { timezone: 'America/Los_Angeles', short_name: orgName.split(' ')[0]!.toLowerCase() }
@@ -683,6 +687,7 @@ function buildSettings(): MockSetting[] {
         { id: 404, created: now - 5 * 86400, modified: now - 5 * 86400, key: 'SITE_NAME', value: 'NativeMojo fallback', is_secret: false, group: null, secretValue: null },
         // #7729: one rendition override so Media rendering shows a changed field beside greyed defaults on first load.
         { id: 405, created: now - 3 * 86400, modified: now - 3 * 86400, key: 'FILEMAN_RENDITIONS_VIDEO', value: JSON.stringify({ video_hevc: { crf: 24 } }), is_secret: false, group: null, secretValue: null },
+        { id: 406, created: now - 3 * 86400, modified: now - 3 * 86400, key: 'EDGE_FRAMEWORK_VERSION', value: '', is_secret: false, group: null, secretValue: null },
     ];
 }
 
@@ -2890,6 +2895,12 @@ function decorateUsers(users: MockUser[], groups: MockGroup[]): void {
     dnsPlatform.email = 'dns.platform@nativemojo.com';
     dnsPlatform.display_name = 'DNS Platform Operator';
     dnsPlatform.permissions = {};
+    for (const [offset, role, grants] of [
+        [53, 'viewer', { view_platform: true, view_dns: true }],
+        [54, 'platform', { view_admin: true, manage_platform: true }],
+        [55, 'webapp', { view_admin: true, manage_webapp: true, manage_dns: true, manage_groups: true }],
+        [56, 'group', {}], [57, 'denied', {}],
+    ] as const) Object.assign(at(offset), { is_active: true, is_superuser: false, username: `deployments.${role}`, email: `deployments.${role}@nativemojo.com`, display_name: `Deployments ${role}`, permissions: { ...grants } });
     const dnsTenant = at(23);
     dnsTenant.is_active = true;
     dnsTenant.is_superuser = false;
@@ -4105,6 +4116,7 @@ const deviceRows = buildDevices();
 const geoIpRows = buildGeoIps();
 const loginEventRows = linkLoginDevices(buildLoginEvents(users), deviceRows);
 const members = buildMembers(users, groups);
+members.push({ id: 192, created: groups[0]!.created, modified: groups[0]!.modified, is_active: true, permissions: { manage_webapp: true, manage_dns: true }, metadata: {}, user: 56, group: 1 });
 members.push({
     id: 190, created: groups[0]!.created, modified: groups[0]!.modified,
     is_active: true, permissions: { view_dns: true }, metadata: {},
@@ -5425,17 +5437,29 @@ function saveUser(user: MockUser, body: Record<string, unknown>, caller?: MockUs
 // django-mojo account/models/group.py RestMeta: POST_SAVE_ACTIONS include
 // disable/reactivate (reason REQUIRED ∈ GROUP_REST_REASONS = admin | abuse |
 // archived — one more than users get); NO_SAVE_FIELDS id/pk/created.
-const GROUP_ACTIONS = new Set(['disable', 'reactivate']);
+// allow_member_subgroups (#9126) switches metadata.protected's sub-group
+// policy (#9107): a boolean only, off removes the key, and the reply is the
+// handler's flat {status, allow_member_subgroups}, not the row.
+const GROUP_ACTIONS = new Set(['disable', 'reactivate', 'allow_member_subgroups']);
+const GROUP_SUBGROUP_POLICY_KEY = 'allow_member_subgroups';
 const GROUP_DISABLE_REASONS = new Set(['abuse', 'admin', 'archived']);
 // NO_SAVE_FIELDS parity (id/pk/created); member_count additionally blocked
 // here because it is a graph EXTRA, not a column (uuid IS savable live).
 const GROUP_NO_SAVE = new Set(['id', 'pk', 'created', 'member_count']);
 
+// A controlled legacy wire fixture; the stored Group identity is never rewritten.
+function acmeProjectIdentity(group: MockGroup) {
+    return getMockConnectionScenario() === 'legacy-project-identity' && group.id === 1 ? '74a3c6699bed4ddf' : group.uuid;
+}
 function serializeGroup(g: MockGroup): Record<string, unknown> {
-    return { ...g };
+    return { ...g, uuid: acmeProjectIdentity(g) };
 }
 
 function saveGroup(group: MockGroup, body: Record<string, unknown>): unknown {
+    // Group.on_rest_save judges the switch before anything is written.
+    if (GROUP_SUBGROUP_POLICY_KEY in body && typeof body[GROUP_SUBGROUP_POLICY_KEY] !== 'boolean') {
+        return { status: false, error: `${GROUP_SUBGROUP_POLICY_KEY} must be true or false`, error_code: 400 };
+    }
     const fields: Record<string, unknown> = {};
     const actionEntries: [string, unknown][] = [];
     for (const [key, value] of Object.entries(body)) {
@@ -5469,9 +5493,17 @@ function saveGroup(group: MockGroup, body: Record<string, unknown>): unknown {
             target[key] = isPlainObject(value) && isPlainObject(existing) ? mergeDicts(existing, value) : value;
         }
     }
+    let actionReply: Record<string, unknown> | null = null;
     for (const [action, value] of actionEntries) {
         const dict = (value && typeof value === 'object' ? value : {}) as Record<string, unknown>;
-        if (action === 'disable') {
+        if (action === GROUP_SUBGROUP_POLICY_KEY) {
+            const metadata = isPlainObject(group.metadata) ? group.metadata : {};
+            const protectedMeta = isPlainObject(metadata.protected) ? { ...metadata.protected } : {};
+            if (value === true) protectedMeta[GROUP_SUBGROUP_POLICY_KEY] = true;
+            else delete protectedMeta[GROUP_SUBGROUP_POLICY_KEY];
+            group.metadata = { ...metadata, protected: protectedMeta };
+            actionReply = { status: true, [GROUP_SUBGROUP_POLICY_KEY]: value };
+        } else if (action === 'disable') {
             const reason = String(dict.reason ?? '');
             if (!GROUP_DISABLE_REASONS.has(reason)) {
                 return { status: false, error: `reason must be one of: ${[...GROUP_DISABLE_REASONS].sort().join(', ')}`, error_code: 400 };
@@ -5482,6 +5514,7 @@ function saveGroup(group: MockGroup, body: Record<string, unknown>): unknown {
         }
     }
     group.modified = Math.floor(Date.now() / 1000);
+    if (actionReply) return actionReply;
     return { status: true, data: serializeGroup(group), graph: 'default' };
 }
 
@@ -6563,10 +6596,186 @@ function accountSelfFetch(path: string, method: string, opts: MockFetchOpts): un
     return { status: false, error: `Method not allowed: ${method} ${path}`, error_code: 405 };
 }
 
+export type MockSharedValidationScenario = 'ready' | 'missing-trust' | 'revoked' | 'pending-dns' | 'changed-alias' | 'chained-alias' | 'unavailable' | 'unconfigured' | 'old-api' | 'renewal-error' | 'malformed' | 'disabled' | 'controller-maintenance';
+let sharedScenario: MockSharedValidationScenario = 'ready';
+let sharedFault: 'ambiguous' | 'reconcile' | 'reauth' | 'revoke-cleanup' | null = null;
+let sharedReadFails = false;
+let sharedReadFailure: { path: 'allocation/list' | 'trust/list' | 'capabilities'; status: 401 | 403 | 440 | 404 | 405 | 503 } | null = null;
+let sharedCounter = 1;
+const SHARED_CONSUMER_UUID = '11111111-1111-4111-8111-111111111111';
+const SHARED_OWNER_UUID = '22222222-2222-4222-8222-222222222222';
+interface MockSharedConnection { id: number; domain: string; domainId: number | null; group: number; allocation: string; client: string; participant: string | null; state: string; verified: string | null; reads: number }
+interface MockSharedParticipant { allocation_ref: string; participant_ref: string; client_ref: string; domain: string; source: string; target: string; role: string; trust_state: string; scope: string[]; can_publish: boolean; can_withdraw: boolean; revoked_at: string | null; consumer_project_uuid: string; consumer_label: string }
+const sharedConnections = new Map<string, MockSharedConnection>();
+const sharedParticipants: MockSharedParticipant[] = [];
+const sharedAllocations = [
+    { allocation_ref: 'shared-acme.acme-hub.example', domain: 'acme.example' },
+    { allocation_ref: 'shared-customer.acme-hub.example', domain: 'customer.example' },
+].map((v) => ({ ...v, source: `_acme-challenge.${v.domain}`, target: v.allocation_ref, owner_project_uuid: SHARED_OWNER_UUID, can_manage_trust: true }));
+const sharedUuid = () => `33333333-3333-4333-8333-${String(sharedCounter++).padStart(12, '0')}`;
+function sharedDescriptor(row: MockSharedConnection) { return { version: 1, consumer_project_uuid: SHARED_CONSUMER_UUID, client_ref: row.client, domain: row.domain, allocation_ref: row.allocation }; }
+function sharedParticipant(request: Record<string, unknown>): MockSharedParticipant { const domain = String(request.domain); return { allocation_ref: String(request.allocation_ref), participant_ref: sharedUuid(), client_ref: String(request.client_ref), domain, source: `_acme-challenge.${domain}`, target: String(request.allocation_ref), role: 'trusted', trust_state: 'active', scope: [domain, `*.${domain}`], can_publish: false, can_withdraw: false, revoked_at: null, consumer_project_uuid: String(request.consumer_project_uuid), consumer_label: 'Customer project · independent wildcard issuer' }; }
+/** Bounded mock-only controls. No setup draft or protected credential is observed. */
+export function setMockSharedValidationScenario(scenario: MockSharedValidationScenario): void {
+    const allowed: MockSharedValidationScenario[] = ['ready', 'missing-trust', 'revoked', 'pending-dns', 'changed-alias', 'chained-alias', 'unavailable', 'unconfigured', 'old-api', 'renewal-error', 'malformed', 'disabled', 'controller-maintenance'];
+    if (!allowed.includes(scenario)) throw new Error('Unknown shared validation mock scenario');
+    sharedScenario = scenario; sharedReadFailure = null; sharedFault = null; sharedReadFails = false; sharedConnections.clear(); sharedParticipants.splice(0);
+    sharedAllocations.splice(2);
+    if (scenario === 'controller-maintenance') {
+        for (let i = 1; i <= 21; i++) {
+            const target = `maintenance-${String(i).padStart(2, '0')}.acme-hub.example`;
+            sharedAllocations.push({ allocation_ref: target, domain: 'maintenance.example', source: '_acme-challenge.maintenance.example', target, owner_project_uuid: SHARED_OWNER_UUID, can_manage_trust: true });
+        }
+        for (let i = 0; i < 22; i++) {
+            const participant = sharedParticipant({ domain: 'maintenance.example', allocation_ref: 'maintenance-21.acme-hub.example', client_ref: sharedUuid(), consumer_project_uuid: i === 21 ? SHARED_CONSUMER_UUID : sharedUuid() });
+            participant.consumer_label = i === 21 ? 'Inactive consumer · cleanup remains available' : i === 0 ? 'Allocation owner' : `Trusted project ${i}`;
+            if (i === 0) { participant.role = 'owner'; participant.consumer_project_uuid = SHARED_OWNER_UUID; }
+            sharedParticipants.push(participant);
+        }
+    }
+    db.dnsDomains = db.dnsDomains.filter((d) => d.id < 8900);
+    db.dnsCertificates = db.dnsCertificates.filter((c) => c.id < 8900);
+    if (['missing-trust', 'revoked', 'pending-dns', 'changed-alias', 'chained-alias', 'renewal-error'].includes(scenario)) {
+        const row: MockSharedConnection = { id: 8901, domain: 'acme.example', domainId: 8201, group: 1, allocation: 'shared-acme.acme-hub.example', client: sharedUuid(), participant: null, state: 'pending', verified: null, reads: 0 };
+        if (scenario !== 'missing-trust') { const participant = sharedParticipant(sharedDescriptor(row)); if (scenario === 'revoked') { participant.trust_state = 'revoked'; participant.revoked_at = new Date().toISOString(); } sharedParticipants.push(participant); row.participant = participant.participant_ref; row.state = 'verified'; row.verified = new Date().toISOString(); }
+        sharedConnections.set(row.domain, row);
+    }
+}
+export function armMockSharedValidationFault(fault: typeof sharedFault): void { sharedFault = fault; if (fault === null) sharedReadFails = false; }
+export function armMockSharedValidationReadFailure(path: NonNullable<typeof sharedReadFailure>['path'], status: NonNullable<typeof sharedReadFailure>['status']): void { sharedReadFailure = { path, status }; }
+function mockSharedValidation(path: string, opts: MockFetchOpts, method: string): unknown {
+    const caller = userFromBearer(opts.headers); if (!caller) return permissionDenied(401);
+    if (sharedScenario === 'old-api') return { status: false, error: 'Route unavailable', error_code: 404 };
+    const body = opts.body ?? {}, params = opts.params ?? {};
+    const failure = (code: string, status = 409, data?: unknown) => ({ status: false, code: status, error: code, error_code: code, ...(data ? { data } : {}) });
+    const manage = hasGlobalPermission(caller, DNS_MANAGE_GRANTS);
+    const controller = caller.is_superuser === true;
+    const iso = (value: number | null) => value == null ? null : new Date(value * 1000).toISOString();
+    const at = new Date().toISOString();
+    if (path === '/api/dnsman/delegation/group-choice') {
+        if (method !== 'GET' || !manage) return permissionDenied();
+        const rows = db.groups.filter((g) => g.is_active && dnsMemberCan(caller, g.id, true) && (params.id == null || g.id === Number(params.id)) && (!params.search || g.name.toLowerCase().includes(String(params.search).toLowerCase())));
+        const start = Math.max(0, Number(params.start ?? 0)); const size = Math.min(50, Math.max(1, Number(params.size ?? 25)));
+        return { status: true, data: rows.slice(start, start + size).map((g) => ({ id: g.id, name: g.name })), count: rows.length, start, size };
+    }
+    if (path.startsWith('/api/dnsman/acme/')) {
+        if (method !== 'POST' || !controller) return permissionDenied();
+        if (sharedReadFailure && path.endsWith(`/${sharedReadFailure.path}`)) { const status = sharedReadFailure.status; sharedReadFailure = null; return failure('mock_controller_read_refused', status); }
+        if (path.endsWith('/capabilities')) return { status: true, data: { version: 2, shared_validation: sharedScenario !== 'disabled', consumer_project_uuid: null, can_consume: false, can_manage_trust: sharedScenario !== 'disabled', trust_scope: 'apex_and_wildcard' } };
+        if (sharedScenario === 'disabled') return failure('acme_not_authorized', 403);
+        const page = <T,>(rows: T[]) => { const start = body.cursor == null ? 0 : Number(body.cursor); if (!Number.isSafeInteger(start) || start < 0 || (body.cursor != null && !/^[1-9]\d*$/.test(String(body.cursor)))) return failure('acme_invalid_request', 400); return { status: true, data: { items: rows.slice(start, start + 20), next_cursor: start + 20 < rows.length ? String(start + 20) : null } }; };
+        if (path.endsWith('/allocation/list')) return page(sharedAllocations.filter((v) => v.domain === body.domain));
+        const allocation = sharedAllocations.find((v) => v.allocation_ref === body.allocation_ref || v.allocation_ref === (body.connection_request as Record<string, unknown> | undefined)?.allocation_ref);
+        if (!allocation) return permissionDenied();
+        if (path.endsWith('/trust/list')) return sharedReadFails ? failure('acme_hub_unavailable', 503) : page(sharedParticipants.filter((p) => p.allocation_ref === allocation.allocation_ref));
+        if (path.endsWith('/trust/recipient')) return sharedScenario !== 'controller-maintenance' && body.consumer_project_uuid === SHARED_CONSUMER_UUID ? { status: true, data: { consumer_project_uuid: SHARED_CONSUMER_UUID, label: 'Customer project · independent wildcard issuer', active: true } } : permissionDenied();
+        if (path.endsWith('/trust/grant')) {
+            const request = body.connection_request as Record<string, unknown>;
+            if (sharedScenario === 'controller-maintenance') return permissionDenied();
+            if (!request || Object.keys(request).sort().join(',') !== 'allocation_ref,client_ref,consumer_project_uuid,domain,version' || request.version !== 1 || request.domain !== allocation.domain || request.consumer_project_uuid !== SHARED_CONSUMER_UUID || !/^[a-f0-9-]{36}$/.test(String(request.client_ref))) return failure('acme_reference_conflict');
+            let participant = sharedParticipants.find((p) => p.client_ref === request.client_ref && p.consumer_project_uuid === request.consumer_project_uuid);
+            if (participant && (participant.allocation_ref !== allocation.allocation_ref || participant.trust_state === 'revoked')) return failure('acme_reference_conflict');
+            if (['changed-alias', 'chained-alias', 'pending-dns'].includes(sharedScenario)) return failure('acme_dns_mismatch');
+            if (!participant) { participant = sharedParticipant(request); sharedParticipants.push(participant); }
+            if (sharedFault === 'ambiguous') { sharedFault = null; return failure('acme_hub_unavailable', 503); }
+            return { status: true, data: { ...participant } };
+        }
+        if (path.endsWith('/trust/revoke')) {
+            const participant = sharedParticipants.find((p) => p.allocation_ref === allocation.allocation_ref && p.participant_ref === body.participant_ref);
+            if (!participant || participant.role === 'owner') return permissionDenied();
+            participant.trust_state = 'revoked'; participant.revoked_at ??= at;
+            if (sharedFault === 'revoke-cleanup' || sharedFault === 'ambiguous') { sharedFault = null; return failure('acme_hub_unavailable', 503); }
+            return { status: true, data: { ...participant } };
+        }
+        return failure('acme_invalid_request', 400);
+    }
+    const write = method === 'POST';
+    if (sharedFault === 'reauth' && write) { sharedFault = null; return { status: false, code: 440, error: 'reauth_required', error_code: 440 }; }
+    let row = body.delegation == null ? null : [...sharedConnections.values()].find((v) => v.id === Number(body.delegation)) ?? null;
+    const requested = write ? body : params;
+    let domain = db.dnsDomains.find((d) => requested.domain != null ? d.id === Number(requested.domain) : d.name === (row?.domain ?? requested.name));
+    const name = row?.domain ?? domain?.name ?? String(requested.name ?? '');
+    const groupId = row?.group ?? domain?.group ?? Number(requested.group ?? 0);
+    if (!name || !/^[a-z0-9.-]+\.[a-z]{2,}$/.test(name) || (!domain && !db.groups.some((g) => g.id === groupId && g.is_active))) return failure('invalid_target', 400);
+    if (domain && requested.group != null && domain.group !== Number(requested.group)) return permissionDenied();
+    if (!hasGlobalPermission(caller, DNS_VIEW_GRANTS) || (groupId && !dnsMemberCan(caller, groupId, write))) return permissionDenied();
+    if (write && (!manage || !groupId)) return permissionDenied();
+    row ??= sharedConnections.get(name) ?? null;
+    const allocation = row?.allocation ?? (typeof requested.allocation_ref === 'string' ? requested.allocation_ref : null);
+    const plan = () => {
+        if (sharedReadFails) return failure('hub_unavailable', 503);
+        const participant = row ? sharedParticipants.find((p) => p.client_ref === row!.client) : null;
+        const trust = !row ? 'not_requested' : participant?.trust_state ?? 'missing';
+        const hub = sharedScenario === 'unconfigured' ? 'unconfigured' : sharedScenario === 'unavailable' ? 'unavailable' : sharedScenario === 'disabled' ? 'unsupported' : 'ready';
+        const aliasState = ['changed-alias', 'chained-alias'].includes(sharedScenario) ? 'mismatch' : sharedScenario === 'pending-dns' ? 'lookup_failed' : row?.participant ? 'match' : 'unknown';
+        let cert = db.dnsCertificates.find((c) => c.domain === domain?.id && c.sans.length === 2 && c.sans.includes(name) && c.sans.includes(`*.${name}`));
+        if (cert?.id && cert.id >= 8900 && cert.status === 'pending' && row && ++row.reads >= 3) { cert.status = 'active'; cert.not_after = Math.floor(Date.now() / 1000) + 90 * 86400; cert.renew_after = Math.floor(Date.now() / 1000) + 60 * 86400; cert.material_present = true; cert.attempts = 1; }
+        const valid = !!cert && cert.status === 'active' && (cert.not_after ?? 0) > Date.now() / 1000;
+        const renewal = sharedScenario === 'renewal-error' ? 'failed' : cert?.status === 'pending' ? 'queued' : valid ? (trust === 'active' && aliasState === 'match' ? 'scheduled' : row ? 'blocked' : 'scheduled') : cert ? 'failed' : 'not_requested';
+        let next = 'none', actor = 'project_operator';
+        if (!groupId) { next = 'unsupported_domain_scope'; actor = 'deployment_operator'; }
+        else if (hub !== 'ready') { next = hub === 'unconfigured' ? 'configure_hub' : hub === 'unsupported' ? 'upgrade_hub' : 'retry_hub'; actor = 'deployment_operator'; }
+        else if (!row) next = allocation ? 'prepare_connection' : 'choose_allocation';
+        else if (trust === 'revoked') next = 'restart_connection';
+        else if (trust === 'missing') { next = 'grant_trust'; actor = 'allocation_controller'; }
+        else if (!row.participant) next = 'connect';
+        else if (aliasState !== 'match') { next = 'repair_alias'; actor = 'domain_owner'; }
+        else if (row.state !== 'verified') next = 'check';
+        else if (renewal === 'queued') next = 'wait_for_job';
+        else if (renewal === 'failed') next = 'inspect_failure';
+        else if (!cert) next = 'request';
+        else actor = 'none';
+        const allowed = manage && !!groupId;
+        return { status: true, data: {
+            version: sharedScenario === 'malformed' ? 99 : 1, checked_at: at,
+            domain: { id: domain?.id ?? null, name, provider: domain?.provider ?? null, group: groupId ? { id: groupId, name: db.groups.find((g) => g.id === groupId)?.name ?? 'Customer' } : null },
+            profile: { name: 'apex_wildcard', names: [name, `*.${name}`] }, hub: { state: hub, protocol_version: hub === 'ready' ? 2 : null, consumer_project_uuid: hub === 'ready' ? SHARED_CONSUMER_UUID : null },
+            connection: row ? { id: row.id, mode: 'shared', state: row.state, client_ref: row.client, allocation_ref: row.allocation, participant_ref: row.participant, verified_at: row.verified } : null,
+            trust: { state: trust, can_publish: trust === 'active', can_withdraw: !!participant },
+            alias: { state: aliasState, source: `_acme-challenge.${name}`, target: allocation, observed_target: aliasState === 'unknown' || aliasState === 'lookup_failed' ? null : sharedScenario === 'changed-alias' ? 'changed.acme-hub.example' : allocation, one_hop: aliasState === 'unknown' || aliasState === 'lookup_failed' ? null : sharedScenario !== 'chained-alias', checked_at: aliasState === 'unknown' ? null : at },
+            certificate: cert ? { id: cert.id, state: cert.status, names: cert.sans, not_after: iso(cert.not_after), renew_after: iso(cert.renew_after), serving_valid: valid, material_state: cert.material_present ? 'available' : 'missing' } : null,
+            renewal: { state: renewal, next_attempt_at: cert ? iso(cert.renew_after) : null, attempts: cert?.attempts ?? 0, error_code: renewal === 'failed' ? 'trust_missing' : null, cleanup_pending: false, job: renewal === 'queued' ? { id: 'mock-shared-job', state: 'pending' } : null, worker_version: null },
+            capabilities: { group_choices: allowed, can_connect: allowed && hub === 'ready' && !!allocation && trust !== 'revoked', can_restart: allowed && !!row && (trust === 'revoked' || (!row.participant && row.state === 'pending')), can_check: allowed && !!row?.participant && trust === 'active', can_request: allowed && row?.state === 'verified' && trust === 'active' && aliasState === 'match' && sharedScenario !== 'chained-alias' },
+            next_action: { code: next, actor }, connection_request: row && allowed ? sharedDescriptor(row) : null, operation: { action: 'plan', outcome: 'observed', changed: false },
+        } };
+    };
+    if (!write) return plan();
+    if (sharedScenario === 'unconfigured' || sharedScenario === 'unavailable' || sharedScenario === 'disabled') return failure('hub_unavailable', 503);
+    let sharedOutcome = 'queued';
+    if (path.endsWith('/connect')) {
+        if (!allocation || !/^[a-z0-9.-]+\.[a-z]{2,}$/.test(allocation)) return failure('allocation_conflict');
+        if (row && row.allocation !== allocation) return failure('allocation_conflict');
+        const existing = row ? sharedParticipants.find((p) => p.client_ref === row!.client) : null;
+        if (existing?.trust_state === 'revoked' && body.restart !== true) return failure('trust_revoked', 409, (plan() as { data: unknown }).data);
+        if (body.restart === true && row && existing?.trust_state === 'active') return failure('stale_connection');
+        if (!row || body.restart === true) { row = { id: 8900 + sharedCounter, domain: name, domainId: domain?.id ?? null, group: groupId, allocation, client: sharedUuid(), participant: null, state: 'pending', verified: null, reads: 0 }; sharedConnections.set(name, row); }
+        const participant = sharedParticipants.find((p) => p.client_ref === row!.client && p.trust_state === 'active');
+        if (participant) row.participant = participant.participant_ref;
+    } else if (path.endsWith('/check')) {
+        if (!row || !row.participant) return failure('connection_not_verified');
+        const participant = sharedParticipants.find((p) => p.participant_ref === row!.participant);
+        if (participant?.trust_state !== 'active') return failure('trust_revoked');
+        if (['pending-dns', 'changed-alias', 'chained-alias'].includes(sharedScenario)) { row.state = 'broken'; return failure('alias_mismatch', 409, (plan() as { data: unknown }).data); }
+        if (!domain) { domain = { ...buildDnsDomains()[0]!, id: 8900 + sharedCounter++, name, group: groupId, provider: 'mojo', credential: null, hosted_zone_id: null }; db.dnsDomains.push(domain); row.domainId = domain.id; }
+        row.state = 'verified'; row.verified = at;
+    } else if (path.endsWith('/request')) {
+        const current = plan() as { data: { capabilities: { can_request: boolean } } };
+        if (!row || !domain || !current.data?.capabilities.can_request) return failure('connection_not_verified');
+        let cert = db.dnsCertificates.find((c) => c.domain === domain!.id && c.sans.length === 2 && c.sans.includes(name) && c.status !== 'revoked');
+        sharedOutcome = cert?.status === 'active' ? 'already_current' : cert ? 'already_queued' : 'queued';
+        if (!cert) { const now = Math.floor(Date.now() / 1000); cert = { id: 8900 + sharedCounter++, created: now, modified: now, domain: domain.id, common_name: name, sans: [name, `*.${name}`], status: 'pending', issuer: null, serial: null, not_before: null, not_after: null, renew_after: null, last_error: null, attempts: 0, material_present: false }; db.dnsCertificates.push(cert); }
+    } else return failure('invalid_action', 400);
+    const result = plan() as { data: { operation: unknown } };
+    result.data.operation = { action: path.split('/').pop(), outcome: path.endsWith('/connect') ? row?.participant ? 'connected' : 'awaiting_trust' : path.endsWith('/check') ? 'verified' : sharedOutcome, changed: path.endsWith('/request') ? sharedOutcome === 'queued' : true };
+    if (sharedFault === 'ambiguous' || sharedFault === 'reconcile') { sharedReadFails = sharedFault === 'reconcile'; sharedFault = null; return failure('hub_unavailable', 503); }
+    return result;
+}
+
 let dnsConfigMalformed = false;
 let dnsAcmeMode: 'production' | 'staging' | 'unconfigured' = 'staging';
 let dnsRegistrarMode: 'ready' | 'disabled' | 'contact-missing' = 'ready';
 let dnsRegistrarFault: 'failed' | 'ambiguous' | null = null;
+let domainRegistrarSaveFault: 'warning' | 'ambiguous' | null = null;
 let dnsWriteFault: 'reject' | 'ambiguous' | 'reconcile' | null = null;
 let dnsFailNextRead = false;
 const mockRegistrantScopeState = new Map<string, 'saved' | 'cleared'>();
@@ -6695,6 +6904,7 @@ export function setMockDnsRegistrarMode(value: 'ready' | 'disabled' | 'contact-m
 
 /** Verifier-only one-shot result after a confirmation token is consumed. */
 export function armMockRegistrarPurchaseFault(value: 'failed' | 'ambiguous'): void { dnsRegistrarFault = value; }
+export function armMockDomainRegistrarSaveFault(value: 'warning' | 'ambiguous'): void { domainRegistrarSaveFault = value; }
 
 /** Verifier-only one-shot DNS transport outcomes; all state still lives in db.dnsRecords. */
 export function armMockDnsWriteFault(mode: 'reject' | 'ambiguous' | 'reconcile'): void {
@@ -9716,6 +9926,15 @@ async function mockFetchInner(path: string, opts: MockFetchOpts): Promise<unknow
         armedReauth = null;
         return { status: false, error: 'reauth_required', error_code: 440 };
     }
+    if (path === '/api/account/admin/bootstrap' || path === '/api/account/admin/settings' || path === '/api/account/admin/advanced/settings' && Object.hasOwn(opts.body ?? {}, 'framework_pin')
+        || path === '/api/account/admin/dashboard' || path.startsWith('/api/aws/capacity')
+        || path.startsWith('/api/aws/maintenance/') || path.startsWith('/api/account/admin/platform') || path === '/api/account/admin/setup/readiness'
+        || path.startsWith('/api/edge/webapp') || path.startsWith('/api/edge/release') || path === '/api/edge/deployment') {
+        const { operationsMock } = await import('./operations-mock');
+        const claims = decodeMockJwt((opts.headers?.Authorization ?? '').replace(/^Bearer /, ''));
+        const operationsResult = await operationsMock(path, opts, { user: userFromBearer(opts.headers), credentialKind: claims?.credential_kind ?? claims?.token_type, authTime: authTimeFromBearer(opts.headers), origin: opts.headers?.Origin });
+        if (operationsResult !== undefined) return operationsResult;
+    }
     const pushResult = await pushFetch(path, opts);
     if (pushResult !== undefined) return pushResult;
     const phoneHubResult = await phoneHubFetch(path, opts);
@@ -10106,6 +10325,7 @@ async function mockFetchInner(path: string, opts: MockFetchOpts): Promise<unknow
     }
     // ══ end network security wire ════════════════════════════════════
     // ══ DNSMan — capabilities, safe models and custom operations ════════
+    if (path.startsWith('/api/dnsman/delegation/') || path.startsWith('/api/dnsman/acme/')) return mockSharedValidation(path, opts, method);
     if (path === '/api/dnsman/config') {
         const caller = userFromBearer(opts.headers);
         if (!caller) return permissionDenied(401);
@@ -10227,6 +10447,8 @@ async function mockFetchInner(path: string, opts: MockFetchOpts): Promise<unknow
 
     const credentialMatch = path.match(/^\/api\/dnsman\/credential(?:\/(\d+))?$/);
     if (credentialMatch) {
+        const { prepareMockDomainCredentials } = await import('./domain-operations-mock');
+        prepareMockDomainCredentials(db.dnsCredentials);
         const caller = userFromBearer(opts.headers);
         if (!caller) return permissionDenied(401);
         const id = credentialMatch[1] ? Number(credentialMatch[1]) : null;
@@ -10276,6 +10498,11 @@ async function mockFetchInner(path: string, opts: MockFetchOpts): Promise<unknow
                 if ('privacy' in opts.body) row.privacy = Boolean(opts.body.privacy);
                 if ('credential' in opts.body) row.credential = opts.body.credential == null ? null : Number(opts.body.credential);
                 row.modified = Math.floor(Date.now() / 1000);
+                if (row.provider === 'route53' && domainRegistrarSaveFault) {
+                    const fault = domainRegistrarSaveFault; domainRegistrarSaveFault = null;
+                    row.last_error = 'Registrar update was not confirmed. Inspect the registrar before changing this setting again.';
+                    if (fault === 'ambiguous') return { status: false, error: 'Registrar update acknowledgement unavailable', error_code: 503 };
+                }
             }
             return { status: true, data: serializeDnsDomain(row), graph: 'default' };
         }
@@ -10428,6 +10655,7 @@ async function mockFetchInner(path: string, opts: MockFetchOpts): Promise<unknow
             const domain = db.dnsDomains.find((candidate) => candidate.id === Number(body.domain));
             if (!domain) return { status: false, error: 'Domain not found', error_code: 404 };
             if (domain.group == null ? !hasGlobalPermission(caller, DNS_MANAGE_GRANTS) : !dnsMemberCan(caller, domain.group, true)) return permissionDenied();
+            if (sharedConnections.has(domain.name)) return { status: false, error: 'Shared validation forbids direct fallback', error_code: 409 };
             if (dnsAcmeMode === 'unconfigured') return { status: false, error: 'ACME is not configured', error_code: 400 };
             if (domain.status !== 'active') return { status: false, error: 'Certificates require an active domain', error_code: 400 };
             const sticky = db.acmeDelegations.find((candidate) => candidate.domain === domain.id && candidate.verified_at != null && candidate.state !== 'retired');
@@ -10470,7 +10698,13 @@ async function mockFetchInner(path: string, opts: MockFetchOpts): Promise<unknow
         const action = path.slice('/api/dnsman/registrar/'.length);
         const body = opts.body ?? {};
         const houseAction = ['discover', 'adopt', 'assign-group'].includes(action);
-        if (houseAction && !caller.is_superuser) return permissionDenied();
+        if (houseAction && caller.is_superuser !== true) return permissionDenied();
+        if (houseAction || action === 'purchase') {
+            const { mockRegistrarSession } = await import('./domain-operations-mock');
+            const refusal = mockRegistrarSession(decodeMockJwt((opts.headers?.Authorization ?? '').replace(/^Bearer /, '')), action === 'purchase');
+            if (caller.is_active !== true || refusal === 'denied') return permissionDenied();
+            if (refusal === 'stale') return { status: false, error: 'reauth_required', error_code: 440 };
+        }
         if (!houseAction) {
             const groupId = Number(body.group ?? opts.params?.group ?? 0);
             if (groupId > 0 ? !dnsMemberCan(caller, groupId, action !== 'search' && action !== 'suggest')
@@ -10514,14 +10748,16 @@ async function mockFetchInner(path: string, opts: MockFetchOpts): Promise<unknow
             const now = Math.floor(Date.now() / 1000);
             const id = Math.max(8300, ...db.domainPurchases.map((candidate) => candidate.id)) + 1;
             const token = `mock-once-${id}-${Math.random().toString(36).slice(2)}`;
-            const purchase: MockDomainPurchase = { id, created: now, modified: now, group: groupId, user: caller.id, domain_name: String(body.domain).toLowerCase(), kind: 'register', status: 'quoted', price: '12.00', cost: '12.00', currency: 'USD', years, quote_expires: now + 900, operation_id: null, error: null, metadata: { confirm_digest: mockTokenDigest(token) } };
+            const purchase: MockDomainPurchase = { id, created: now, modified: now, group: groupId, user: caller.id, domain_name: answer.name, kind: 'register', status: 'quoted', price: '12.00', cost: '12.00', currency: 'USD', years, quote_expires: now + 900, operation_id: null, error: null, metadata: { confirm_digest: mockTokenDigest(token) } };
             db.domainPurchases.unshift(purchase);
             return { status: true, data: { purchase: id, name: purchase.domain_name, price: purchase.price, currency: purchase.currency, years: purchase.years, token, expires: purchase.quote_expires, privacy_supported: true } };
         }
         if (action === 'purchase') {
+            if (method !== 'POST') return { status: false, error: 'Method not allowed', error_code: 405 };
+            const { validMockPurchaseTuple } = await import('./domain-operations-mock');
             const purchase = db.domainPurchases.find((candidate) => candidate.id === Number(body.purchase));
             const digest = typeof purchase?.metadata.confirm_digest === 'string' ? purchase.metadata.confirm_digest : '';
-            if (!purchase || mockTokenDigest(String(body.confirm_token ?? '')) !== digest || purchase.status !== 'quoted' || (purchase.quote_expires ?? 0) <= Date.now() / 1000) return { status: false, error: 'That purchase confirmation is not valid. Request a new quote and try again.', error_code: 400 };
+            if (!purchase || !validMockPurchaseTuple(purchase, body, caller.id) || mockTokenDigest(String(body.confirm_token ?? '')) !== digest || purchase.status !== 'quoted' || (purchase.quote_expires ?? 0) <= Date.now() / 1000) return { status: false, error: 'That purchase confirmation is not valid. Request a new quote and try again.', error_code: 400 };
             delete purchase.metadata.confirm_digest;
             purchase.status = dnsRegistrarFault === 'failed' ? 'failed' : 'submitted'; purchase.error = dnsRegistrarFault === 'failed' ? 'Registrar rejected the operation after durable intent' : null; purchase.lifecycle_reads = dnsRegistrarFault === 'failed' ? undefined : 0; purchase.modified = Math.floor(Date.now() / 1000);
             const now = purchase.modified;
@@ -10533,10 +10769,15 @@ async function mockFetchInner(path: string, opts: MockFetchOpts): Promise<unknow
             return { status: true, data: { purchase: purchase.id, domain: domain.id, name: domain.name, status: domain.status, operation_id: null, privacy: true, privacy_downgraded: false } };
         }
         if (action === 'register-existing') {
+            const { mockDomainRegistrationName, prepareMockDomainCredentials } = await import('./domain-operations-mock');
+            prepareMockDomainCredentials(db.dnsCredentials);
+            const name = mockDomainRegistrationName(body.domain);
             const credential = db.dnsCredentials.find((candidate) => candidate.id === Number(body.credential));
-            if (!credential || !credential.is_active || !credential.verified || credential.group !== Number(body.group)) return { status: false, error: 'A verified credential is required', error_code: 400 };
+            if (method !== 'POST' || !name || !credential || credential.provider !== 'godaddy' || !credential.is_active || !credential.verified || credential.group !== Number(body.group)) return { status: false, error: 'A same-group verified GoDaddy credential and exact domain are required', error_code: 400 };
+            if (db.dnsDomains.some(row => row.name === name)) return { status: false, error: 'Domain is already registered', error_code: 400 };
+            if (name.includes('provider-failure')) return { status: false, error: 'Provider ownership could not be verified', error_code: 400 };
             const now = Math.floor(Date.now() / 1000);
-            const domain: MockDnsDomain = { id: Math.max(8200, ...db.dnsDomains.map((candidate) => candidate.id)) + 1, created: now, modified: now, group: credential.group, user: caller.id, name: String(body.domain).toLowerCase(), provider: credential.provider, credential: credential.id, status: 'active', hosted_zone_id: null, auto_renew: false, privacy: false, verified: true, registered_on: null, expires: null, last_error: null, metadata: {} };
+            const domain: MockDnsDomain = { id: Math.max(8200, ...db.dnsDomains.map((candidate) => candidate.id)) + 1, created: now, modified: now, group: credential.group, user: caller.id, name, provider: credential.provider, credential: credential.id, status: 'active', hosted_zone_id: null, auto_renew: false, privacy: false, verified: true, registered_on: null, expires: null, last_error: null, metadata: {} };
             db.dnsDomains.push(domain); db.dnsRecords.set(domain.id, []);
             return { status: true, data: serializeDnsDomain(domain) };
         }
@@ -10620,9 +10861,29 @@ async function mockFetchInner(path: string, opts: MockFetchOpts): Promise<unknow
         return { status: true, data: { name: domain.name, registrant: transientContact, admin: transientContact, tech: transientContact, privacy: domain.privacy, admin_privacy: domain.privacy, registrant_privacy: domain.privacy, tech_privacy: domain.privacy, auto_renew: domain.auto_renew, nameservers: ['ns-1.example.invalid', 'ns-2.example.invalid'], registrar: 'Amazon Registrar, Inc.', registered_on: domain.registered_on, expires: domain.expires, status_list: ['ok'], privacy_supported: true } };
     }
     // ══ end DNSMan wire ═══════════════════════════════════════════════
+    if (path === '/api/account/admin/fleet/shared-validation/recipient') {
+        const caller = userFromBearer(opts.headers); if (!caller) return permissionDenied(401);
+        if (caller.is_superuser !== true) return permissionDenied();
+        const input = method === 'GET' ? opts.params ?? {} : opts.body ?? {};
+        if (method === 'GET' ? Object.keys(input).some((k) => k !== 'consumer_project_uuid') : method !== 'POST' || Object.keys(input).sort().join(',') !== 'consumer_project_uuid,expected_consumer_label,label,purpose' || input.purpose !== 'acme_validation_consumer') return connectionFail('invalid_request', 400);
+        const group = db.groups.find((g) => acmeProjectIdentity(g) === input.consumer_project_uuid && isEffectivelyActive(g));
+        if (!group) return connectionFail('recipient_unavailable', 404);
+        const scenario = getMockConnectionScenario();
+        if (method === 'GET') return { status: true, data: { purpose: 'acme_validation_consumer', consumer_project_uuid: acmeProjectIdentity(group), consumer_label: group.name, permission: 'dnsman_acme_federation', can_issue: scenario !== 'recipient-denied', grant_explanation: 'Protected platform grant required; issuance does not grant allocation trust.' } };
+        if (consumeMockConnectionFault('reauth')) return connectionFail('fresh_auth_required', 440);
+        if (scenario === 'recipient-denied') return permissionDenied();
+        if (scenario === 'recipient-renamed' || input.expected_consumer_label !== group.name) return connectionFail('recipient_changed', 409);
+        if (typeof input.label !== 'string' || !input.label.trim() || input.label.length > 200 || /[\x00-\x1f]/.test(input.label)) return connectionFail('invalid_request', 400);
+        const id = Math.max(0, ...db.groupApiKeys.map((k) => k.id)) + 1, now = Math.floor(Date.now() / 1000), secret = `mock_acme_${mockHex32(mulberry32(id))}`;
+        const row: MockGroupApiKey = { id, group: group.id, user: null, created: now, modified: now, name: input.label.trim(), is_active: true, permissions: { dnsman_acme_federation: true }, limits: {}, last_used: null, expires_at: null, metadata: {}, override_user: false, token: secret };
+        db.groupApiKeys.unshift(row); registerMockConsumerKey(secret, acmeProjectIdentity(group)!);
+        if (consumeMockConnectionFault('issue-uncertain')) return connectionFail('publication_uncertain', 503);
+        return { status: true, data: { purpose: 'acme_validation_consumer', consumer_project_uuid: acmeProjectIdentity(group), consumer_label: group.name, api_key: { id, name: row.name, is_active: true, permission: 'dnsman_acme_federation' }, token: secret } };
+    }
     if (path === '/api/account/admin/fleet' || path.startsWith('/api/account/admin/fleet/')) {
         const caller = userFromBearer(opts.headers);
         if (!caller) return permissionDenied(401);
+        const original = db.groups.find((group) => group.id === 1); if (original?.uuid) configureMockHubRecipient(acmeProjectIdentity(original)!, original.name);
         return fleetMock(path, method, opts.body, caller.is_superuser === true);
     }
     // ── Settings — plaintext stays private; secrets serialize masked ─────
@@ -10631,11 +10892,18 @@ async function mockFetchInner(path: string, opts: MockFetchOpts): Promise<unknow
         const caller = userFromBearer(opts.headers);
         if (!caller) return permissionDenied(401);
         if (!hasGlobalPermission(caller, ['manage_settings', 'groups'])) return permissionDenied();
+        if (method === 'GET') {
+            const { maintenanceMockFramework } = await import('./maintenance-mock');
+            const pin = maintenanceMockFramework(caller).pin;
+            const row = db.settings.find(row => row.key === 'EDGE_FRAMEWORK_VERSION');
+            if (row) row.value = pin.mode === 'latest' ? '' : pin.mode === 'hold' ? 'hold' : pin.value ?? '';
+        }
         if (oneSetting) {
             const row = db.settings.find((candidate) => candidate.id === Number(oneSetting[1]));
             if (!row) return { status: false, error: 'Setting not found', error_code: 404 };
             if (opts.method === 'DELETE') return { status: false, error: 'DELETE not allowed: Setting', error_code: 403 };
             if (opts.method === 'POST' && opts.body) {
+                if (row.key === 'EDGE_FRAMEWORK_VERSION' || opts.body.key === 'EDGE_FRAMEWORK_VERSION') return {status:false,error:'Framework policy is protected; use its dedicated owner writer.',error_code:400};
                 if ('value' in opts.body && !row.is_secret) {
                     // Registered validators run before the row mutates (Setting.on_rest_pre_save → config.validate).
                     const refusal = validateRenditionSetting(typeof opts.body.key === 'string' ? opts.body.key : row.key, opts.body.value);
@@ -10654,6 +10922,7 @@ async function mockFetchInner(path: string, opts: MockFetchOpts): Promise<unknow
             return { status: true, data: serializeSetting(row), graph: 'default' };
         }
         if (opts.method === 'POST' && opts.body) {
+            if (opts.body.key === 'EDGE_FRAMEWORK_VERSION') return {status:false,error:'Framework policy is protected; use its dedicated owner writer.',error_code:400};
             const now = Math.floor(Date.now() / 1000);
             const row: MockSetting = { id: Math.max(0, ...db.settings.map((candidate) => candidate.id)) + 1, created: now, modified: now, key: '', value: '', is_secret: false, group: null, secretValue: null };
             for (const [field, value] of Object.entries(opts.body)) {
@@ -11753,7 +12022,7 @@ async function mockFetchInner(path: string, opts: MockFetchOpts): Promise<unknow
         }
         if (opts.method === 'POST' && opts.body) {
             if (!groupCanManage(caller, group.id)) return permissionDenied();
-            if (('disable' in opts.body || 'reactivate' in opts.body)
+            if (('disable' in opts.body || 'reactivate' in opts.body || GROUP_SUBGROUP_POLICY_KEY in opts.body)
                 && !hasGlobalPermission(caller, ['manage_groups', 'groups'])) return permissionDenied();
             return saveGroup(group, opts.body);
         }
@@ -11796,7 +12065,7 @@ async function mockFetchInner(path: string, opts: MockFetchOpts): Promise<unknow
             db.groups.push(group);
             return { status: true, data: serializeGroup(group), graph: 'default' };
         }
-        return listRows(visibleGroups as unknown as Record<string, unknown>[], opts.params ?? {}, (g) => String(g.name), 'name');
+        return listRows(visibleGroups.map(serializeGroup), opts.params ?? {}, (g) => String(g.name), 'name');
     }
     // User API keys — /api/account/api_keys (account/rest/user_api_key.py).
     // No DELETE (CAN_DELETE defaults false); the kill switch is the `revoke`