portal-mojo 0.2.2 → 0.2.4

package/src/client/auth.ts

@@ -306,6 +306,12 @@ function adoptGrant(data: TokenGrant, remember = true): AuthUser {
 
 /** Password login. `username` may be a username, email, or (if enabled) phone. */
 export async function login(username: string, password: string, opts: LoginOptions = {}): Promise<LoginResult> {
+    // A malformed/expired session must not prevent the user from replacing it.
+    // The transport gate deliberately blocks authenticated requests when both
+    // tokens are unusable, but /api/login is itself the recovery path. Clear
+    // only that dead session; a valid session (including fresh-auth re-login)
+    // remains intact until the new grant is adopted.
+    if (checkTokenStatus().action === 'logout') clearTokens({ silent: true });
     const body = await mojoCall('/api/login', { method: 'POST', body: { username, password, ...opts.extra } });
     const data = body.data as TokenGrant;
     if (data.mfa_required) {
@@ -599,6 +605,9 @@ export function exchangeAuthCode(code: string): Promise<AuthUser | null> {
 
 async function doExchange(code: string): Promise<AuthUser | null> {
     try {
+        // Hosted sign-in is also a recovery path: stale credentials must not
+        // block exchanging the fresh one-time login code.
+        if (checkTokenStatus().action === 'logout') clearTokens({ silent: true });
         const body = await mojoCall('/api/auth/exchange', { method: 'POST', body: { code } });
         return adoptGrant(body.data as TokenGrant);
     } catch (error) {
@@ -721,7 +730,7 @@ export function initAuth(): void {
             // Recursion guard: never gate the refresh call itself.
             if (path === REFRESH_PATH) return;
             // No stored token → pre-login / public flow, pass through.
-            if (!getAccessToken()) return;
+            if (!getAccessToken() && !getRefreshToken()) return;
             await ensureValidToken();
             // NOTE: web-mojo had to re-stamp Authorization here because its
             // Rest snapshotted headers before the gate ran. Our transport

package/src/client/client.ts

@@ -23,20 +23,25 @@ import type { MojoList, Params } from './types';
 export { MojoError, AuthRequiredError } from './errors';
 
 const API_BASE: string = import.meta.env.VITE_MOJO_API ?? '';
+/** Reserved for the controlled Django artifact producer; ordinary dev stays mock-backed. */
+export function isPackagedAdmin(): boolean {
+    return import.meta.env.VITE_MOJO_PACKAGED_ADMIN === '1';
+}
 let mockModule: Promise<typeof import('./mock')> | null = null;
 
 function loadMockModule(): Promise<typeof import('./mock')> {
+    if (import.meta.env.VITE_MOJO_PACKAGED_ADMIN === '1') throw new Error('Mock transport is unavailable in packaged Admin');
     return mockModule ??= import('./mock');
 }
 
 /** True when the in-memory mock transport is active (VITE_MOJO_API unset). */
 export function usingMockTransport(): boolean {
-    return !API_BASE;
+    return !isPackagedAdmin() && !API_BASE;
 }
 
 /** The configured django-mojo origin ('' under the mock transport). */
 export function apiOrigin(): string {
-    return API_BASE;
+    return isPackagedAdmin() ? window.location.origin : API_BASE;
 }
 
 /**
@@ -81,6 +86,8 @@ export interface FetchOpts {
     body?: Record<string, unknown>;
     /** Cancels the selected transport request. */
     signal?: AbortSignal;
+    /** Optional final validity check after auth refresh and immediately before sending. */
+    beforeSend?: () => void;
     /** Explicit opt-out from a registered endpoint scope (scoped.ts) — for
      *  genuinely global calls inside a scoped family. Greppable, never silent. */
     unscoped?: boolean;
@@ -117,6 +124,7 @@ async function transport(path: string, opts: FetchOpts): Promise<Envelope> {
     // Authorization value is picked up below by construction (web-mojo had to
     // re-stamp a snapshotted header here).
     if (authHooks) await authHooks.preRequest(path);
+    opts.beforeSend?.();
 
     const headers: Record<string, string> = {
         'Content-Type': 'application/json',
@@ -125,11 +133,11 @@ async function transport(path: string, opts: FetchOpts): Promise<Envelope> {
     const bearer = authHooks?.authHeader();
     if (bearer) headers['Authorization'] = bearer;
 
-    if (!API_BASE) {
+    if (usingMockTransport()) {
         const { mockFetch } = await loadMockModule();
         return (await mockFetch(path, { ...opts, headers })) as Envelope;
     }
-    const res = await fetch(`${API_BASE}${path}${buildQuery(opts.params ?? {})}`, {
+    const res = await fetch(`${apiOrigin()}${path}${buildQuery(opts.params ?? {})}`, {
         method: opts.method ?? 'GET',
         headers,
         body: opts.body ? JSON.stringify(opts.body) : undefined,
@@ -265,7 +273,7 @@ export async function mojoDownload(endpoint: string, params: Params, format: 'cs
     const bearer = authHooks?.authHeader();
     if (bearer) headers['Authorization'] = bearer;
 
-    if (!API_BASE) {
+    if (usingMockTransport()) {
         const { mockFetch } = await loadMockModule();
         const body = (await mockFetch(endpoint, { params: withFormat, headers })) as Envelope;
         if (body.status === false) {
@@ -276,7 +284,7 @@ export async function mojoDownload(endpoint: string, params: Params, format: 'cs
         downloadBlob(new Blob([file.content], { type: file.mime }), file.filename);
         return;
     }
-    const res = await fetch(`${API_BASE}${endpoint}${buildQuery(withFormat)}`, { headers });
+    const res = await fetch(`${apiOrigin()}${endpoint}${buildQuery(withFormat)}`, { headers });
     if (!res.ok) throw new MojoError(`Export failed (HTTP ${res.status})`, res.status);
     downloadBlob(await res.blob(), filename);
 }

package/src/client/mock.ts

@@ -13,9 +13,9 @@
 //     field so they are drivable end-to-end in dev (a real server never does)
 // Data endpoints stay open (no auth required) until the portal grows login
 // pages (Chunk C3) — then they 401 without a bearer, like the real backend.
+import { getDnsAdminIntegration, type ManagedDnsRecordInput } from '../admin/dns/dns-integration';
 import { markdownToHtml } from './markdown-parse';
 import type { Params, User } from './types';
-import { getDnsAdminIntegration, type ManagedDnsRecordInput } from '../admin/dns/dns-integration';
 
 // Deterministic dataset — same 57 users on every load so the demo is stable.
 function mulberry32(seed: number) {
@@ -1540,6 +1540,10 @@ interface MockGeoIp {
     is_whitelisted: boolean;
     whitelisted_reason: string | null;
     whitelisted_until: number | null;
+    firewall_generation: number;
+    firewall_pending: boolean;
+    firewall_sync_error: string;
+    firewall_observed_at: number | null;
     expires_at: number | null;
     /** Excluded from the `default` graph — the raw provider blob. */
     provider: string | null;
@@ -1616,6 +1620,9 @@ const GEOIP_SEEDS: GeoIpSeed[] = [
     // ── A datacenter VPN, blocked with a live TTL ──
     { ip: '45.33.32.156', cc: 'US', country: 'United States', region: 'California', rc: 'US-CA', city: 'Fremont', lat: 37.5483, lng: -121.9886, tz: 'America/Los_Angeles', asn: 'AS63949', asnOrg: 'Akamai Connected Cloud', isp: 'Linode', connection: 'hosting', vpn: true, cloud: true, datacenter: true, threat: 'high', blockedReason: 'Credential stuffing from a VPN exit', blockedInDays: 6, blockCount: 2, lastSeenHours: 4 },
 
+    // ── The bouncer incident source used by Incident #603 ──
+    { ip: '198.51.100.66', cc: 'CN', country: 'China', region: 'Beijing', rc: 'CN-BJ', city: 'Beijing', postal: '100000', lat: 39.9042, lng: 116.4074, tz: 'Asia/Shanghai', asn: 'AS45090', asnOrg: 'Shenzhen Tencent Computer Systems', isp: 'Tencent Cloud', connection: 'hosting', vpn: true, proxy: true, cloud: true, datacenter: true, attacker: true, abuser: true, threat: 'critical', blockedReason: 'Bouncer blocked automated credential attack', blockedInDays: null, blockCount: 18, lastSeenHours: 2 },
+
     // ── An EXPIRED block: is_blocked is still true, blocked_until is past.
     //    web-mojo rendered this as "Blocked". block_active() says otherwise.
     { ip: '104.28.14.33', cc: 'BR', country: 'Brazil', region: 'São Paulo', rc: 'BR-SP', city: 'São Paulo', lat: -23.5505, lng: -46.6333, tz: 'America/Sao_Paulo', asn: 'AS13335', asnOrg: 'Cloudflare', isp: 'Cloudflare', connection: 'hosting', proxy: true, cloud: true, threat: 'medium', blockedReason: 'Scraper burst', blockedInDays: -3, blockCount: 1, lastSeenHours: 9 },
@@ -1690,6 +1697,10 @@ function buildGeoIps(): MockGeoIp[] {
             is_whitelisted: whitelisted,
             whitelisted_reason: seed.whitelistReason ?? null,
             whitelisted_until: whitelisted && seed.whitelistInDays != null ? nowSec + seed.whitelistInDays * DAY : null,
+            firewall_generation: blocked || whitelisted ? 1 : 0,
+            firewall_pending: false,
+            firewall_sync_error: '',
+            firewall_observed_at: blocked || whitelisted ? lastSeen : null,
             // `is_expired`: internal records never expire.
             expires_at: provider === 'internal' ? null : nowSec + 60 * DAY,
             provider,
@@ -1806,7 +1817,8 @@ const GEOIP_BASIC_FIELDS = [
     'is_tor', 'is_vpn', 'is_proxy', 'is_known_attacker', 'is_known_abuser',
     'threat_level', 'is_blocked', 'blocked_at', 'blocked_until', 'provider',
     'blocked_reason', 'block_count', 'is_whitelisted', 'whitelisted_reason',
-    'whitelisted_until',
+    'whitelisted_until', 'firewall_generation', 'firewall_pending',
+    'firewall_sync_error', 'firewall_observed_at',
 ];
 
 /** The `federation` graph: NO enforcement state and NO raw provider blob. */
@@ -1997,6 +2009,8 @@ function geolocateMock(ip: string, autoRefresh: boolean): MockGeoIp {
             is_blocked: false, blocked_at: null, blocked_until: null,
             blocked_reason: null, block_count: 0,
             is_whitelisted: false, whitelisted_reason: null, whitelisted_until: null,
+            firewall_generation: 0, firewall_pending: false,
+            firewall_sync_error: '', firewall_observed_at: null,
             expires_at: null, provider: null, data: {},
         };
         db.geoIps.unshift(row);
@@ -2279,6 +2293,41 @@ function buildIncidentEvents(): MockIncidentEvent[] {
             model_name: 'account.BouncerDevice', model_id: 902,
             metadata: { muid: 'muid-monitor-002', risk_score: 51, decision: 'monitor', server: 'auth-1' }, group_id: null, incident: 603,
         },
+        {
+            id: 8985, created: nowSec - 600, level: 8, scope: 'mojosec',
+            category: 'mojosec.auth.sudo_command', source_ip: '88.184.56.101',
+            hostname: null, uid: null, country_code: null,
+            title: 'MojoSec detected auth.sudo_command',
+            details: 'MojoSec sensor prod-web-i-04aab759def924cdd reported 1 occurrence(s) of auth.sudo_command. Host recommendation: review (advisory only).',
+            model_name: 'mojosec_sensor', model_id: null,
+            geo_ip: '88.184.56.101 (Saint-Julien-du-Sault, FR)',
+            metadata: {
+                mojosec: {
+                    kind: 'auth.sudo_command', count: 1,
+                    event_id: 'd4dc2901fd65f59196244a9a8e200bfaff9e5a10b1a9f6f1936a79237f39481c',
+                    evidence: {
+                        cwd: '/opt/api', actor: 'ec2-user',
+                        cgroup: '/user.slice/user-1000.slice/session-95740.scope',
+                        boot_id: '194f44c3dcf945c08a0c3e076a784ff9',
+                        command: '/usr/local/sbin/mojo-firewall-broker',
+                        selinux: 'unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023',
+                        monotonic: 2767741178039, attribution: 'audit_session', target_user: 'root',
+                        command_path: '/usr/local/sbin/mojo-firewall-broker', producer_exe: '/usr/bin/sudo',
+                        producer_pid: 2552251, producer_uid: 1000, proof_status: 'partial',
+                        systemd_unit: 'session-95740.scope', audit_session: 95740,
+                        producer_comm: 'sudo', audit_loginuid: 1000, command_family: 'unknown',
+                        receipt_semantics: ['normalize exact IPv4 DROP rules'],
+                    },
+                    last_seen: '2026-09-09T22:53:46.490459Z',
+                    sensor_id: 'prod-web-i-04aab759def924cdd',
+                    first_seen: '2026-09-09T22:53:46.490459Z', recommendation: 'review',
+                    effective_level: 8, sensor_severity: 'high', protocol_version: 1,
+                    installation_key_id: 36,
+                    sensor_policy_revision_sha256: 'a071e28caf7e5b8a4657c2c80b2a020495507609bdd869cbcce0bce37109ee15',
+                },
+            },
+            group_id: null, incident: null,
+        },
         {
             id: 8986, created: nowSec - 5 * 3600, level: 9, scope: 'ossec', category: 'ossec',
             source_ip: '203.0.113.90', hostname: 'edge-1', uid: null, country_code: 'US',
@@ -7592,6 +7641,33 @@ async function phoneHubFetch(path:string,opts:MockFetchOpts):Promise<unknown|und
     const method=(opts.method??'GET').toUpperCase();
     if(path==='/api/phonehub/number/normalize'){if(method!=='POST')return {status:false,error:'Method not allowed',error_code:405};const normalized=normalizePhone(String(opts.body?.phone_number??''));return normalized?{status:true,data:{phone_number:normalized}}:{status:false,error:'Invalid phone number',error_code:400};}
     const caller=userFromBearer(opts.headers);if(!caller)return permissionDenied(401);
+    if (path === '/api/phonehub/sms/send') {
+        if (method !== 'POST') return { status: false, error: 'Method not allowed', error_code: 405 };
+        if (!hasGlobalPermission(caller, ['send_sms', 'comms'])) return permissionDenied();
+        const body = opts.body ?? {};
+        const toNumber = normalizePhone(String(body.to_number ?? ''));
+        if (!toNumber || typeof body.body !== 'string' || !body.body.trim()) return { status: false, error: 'A valid to_number and body are required', error_code: 400 };
+        const group = body.group == null ? null : Number(body.group);
+        const configId = getMockEffectivePhoneConfigId(group);
+        const config = db.phoneConfigs.find(row => row.id === configId);
+        const now = Math.floor(Date.now() / 1000);
+        // Deterministic provider refusal for the demo, with the live envelope:
+        // a persisted failed SMS still has outer status:true.
+        const failed = toNumber.endsWith('0000');
+        const row: MockSms = {
+            id: Math.max(0, ...db.sms.map(item => item.id)) + 1,
+            created: now, modified: now, direction: 'outbound',
+            from_number: typeof body.from_number === 'string' ? body.from_number : '+14155550100',
+            to_number: toNumber, body: body.body, status: failed ? 'failed' : 'sent',
+            provider: config?.provider ?? 'twilio', provider_message_id: failed ? null : `mock-sms-${now}`,
+            error_code: failed ? 'mock_recipient_refused' : null,
+            error_message: failed ? 'Demo provider refused this recipient.' : null,
+            metadata: {}, is_test: toNumber.startsWith('+1555'),
+            sent_at: failed ? null : now, delivered_at: null, user: caller.id, group,
+        };
+        db.sms.unshift(row);
+        return { status: true, data: smsWire(row), graph: 'default' };
+    }
     if(path==='/api/phonehub/number/lookup'){
         if(method!=='POST')return {status:false,error:'Method not allowed',error_code:405};const normalized=normalizePhone(String(opts.body?.phone_number??''));if(!normalized)return {status:false,error:'Invalid phone number',error_code:400};const now=Math.floor(Date.now()/1000);let row=db.phoneNumbers.find(item=>item.phone_number===normalized);if(!row){row={id:Math.max(0,...db.phoneNumbers.map(item=>item.id))+1,created:now,modified:now,phone_number:normalized,country_code:normalized.startsWith('+1')?'US':null,region:null,state:null,carrier:null,line_type:null,is_mobile:false,is_voip:false,is_valid:false,registered_owner:null,owner_type:null,address_line1:null,address_city:null,address_state:null,address_zip:null,address_country:null,lookup_provider:null,lookup_data:{},lookup_expires_at:null,lookup_count:0,last_lookup_at:null};db.phoneNumbers.push(row);}if(row.lookup_expires_at==null||row.lookup_expires_at<=now)refreshMockPhone(row);if(opts.body?.force_refresh)refreshMockPhone(row);return {status:true,data:{...row},graph:'default'};
     }
@@ -7600,7 +7676,7 @@ async function phoneHubFetch(path:string,opts:MockFetchOpts):Promise<unknown|und
     const smsMatch=path.match(/^\/api\/phonehub\/sms(?:\/(\d+))?$/);
     if(smsMatch){const id=smsMatch[1]?Number(smsMatch[1]):null;if(method==='DELETE'){if(!hasGlobalPermission(caller,SMS_DELETE_GRANTS))return permissionDenied();if(id==null)return {status:false,error:'Method not allowed',error_code:405};db.sms=db.sms.filter(row=>row.id!==id);return {status:'deleted'};}if(method==='POST'&&!hasGlobalPermission(caller,SMS_SAVE_GRANTS))return permissionDenied();if(method==='GET'&&!hasGlobalPermission(caller,SMS_VIEW_GRANTS))return permissionDenied();if(id!=null){const row=db.sms.find(item=>item.id===id);if(!row)return {status:false,error:'SMS not found',error_code:404};if(method==='POST'){for(const key of ['status','error_message','delivered_at'] as const)if(key in (opts.body??{}))(row as unknown as Record<string,unknown>)[key]=opts.body?.[key];row.modified=Math.floor(Date.now()/1000);}return {status:true,data:smsWire(row),graph:'default'};}if(method==='POST'){const body=opts.body??{};const now=Math.floor(Date.now()/1000);const row:MockSms={id:Math.max(0,...db.sms.map(item=>item.id))+1,created:now,modified:now,direction:String(body.direction??'outbound'),from_number:String(body.from_number??''),to_number:String(body.to_number??''),body:String(body.body??''),status:String(body.status??'queued'),provider:body.provider?String(body.provider):null,provider_message_id:null,error_code:null,error_message:null,metadata:{},is_test:Boolean(body.is_test),sent_at:null,delivered_at:null,user:body.user==null?null:Number(body.user),group:body.group==null?null:Number(body.group)};db.sms.unshift(row);return {status:true,data:smsWire(row),graph:'default'};}if(method!=='GET')return {status:false,error:'Method not allowed',error_code:405};const params=messagingParams(opts.params??{},['direction','status','provider','group','user'],['created','direction','status','provider','sent_at','delivered_at'],'default','-created',true);return messagingList(db.sms as unknown as Record<string,unknown>[],params,row=>`${row.from_number} ${row.to_number} ${row.body}`,'default',row=>smsWire(row as unknown as MockSms),'-created');}
     const configMatch=path.match(/^\/api\/phonehub\/config(?:\/(\d+))?$/);
-    if(configMatch){const id=configMatch[1]?Number(configMatch[1]):null;if(method==='DELETE'){if(!hasGlobalPermission(caller,PHONE_CONFIG_DELETE_GRANTS))return permissionDenied();if(id==null)return {status:false,error:'Method not allowed',error_code:405};db.phoneConfigs=db.phoneConfigs.filter(row=>row.id!==id);db.phoneConfigSecrets.delete(id);return {status:'deleted'};}if(!hasGlobalPermission(caller,PHONE_CONFIG_VIEW_GRANTS))return permissionDenied();if(id!=null){const row=db.phoneConfigs.find(item=>item.id===id);if(!row)return {status:false,error:'Phone config not found',error_code:404};if(method==='POST'&&opts.body?.test_connection){if(row.test_mode)return {status:true,message:'Config is in test mode - provider not tested'};const secrets=db.phoneConfigSecrets.get(id)??{};const ready=row.provider==='twilio'?Boolean(secrets.twilio_account_sid&&secrets.twilio_auth_token):row.provider==='aws'?Boolean(secrets.aws_access_key_id&&secrets.aws_secret_access_key):Boolean(secrets.mojo_api_key&&row.mojo_remote_url);return ready?{status:true,message:`${row.provider} connection succeeded`}:{status:false,error:`${row.provider} credentials are incomplete`,error_code:400};}if(method==='POST'){const nextGroup='group'in(opts.body??{})?(opts.body?.group==null?null:Number(opts.body.group)):row.group;if(nextGroup!=null&&db.phoneConfigs.some(item=>item.id!==id&&item.group===nextGroup))return {status:false,error:'A configuration already exists for this group',error_code:400};applyPhoneConfig(row,opts.body??{});saveMockPhoneSecrets(id,opts.body??{});}else if(method!=='GET')return {status:false,error:'Method not allowed',error_code:405};return {status:true,data:phoneConfigWire(row),graph:'default'};}if(method==='POST'){const body=opts.body??{};const group=body.group==null?null:Number(body.group);if(group!=null&&!db.groups.some(item=>item.id===group))return {status:false,error:'Group not found',error_code:404};if(group!=null&&db.phoneConfigs.some(item=>item.group===group))return {status:false,error:'A configuration already exists for this group',error_code:400};const now=Math.floor(Date.now()/1000);const row:MockPhoneConfig={id:Math.max(0,...db.phoneConfigs.map(item=>item.id))+1,created:now,modified:now,group,name:String(body.name??''),is_active:body.is_active!==false,provider:['twilio','aws','mojo'].includes(String(body.provider))?String(body.provider) as MockPhoneConfig['provider']:'twilio',twilio_from_number:null,aws_region:null,aws_sender_id:null,mojo_remote_url:null,lookup_enabled:body.lookup_enabled!==false,lookup_cache_days:Number(body.lookup_cache_days??90),test_mode:Boolean(body.test_mode)};applyPhoneConfig(row,body);db.phoneConfigs.push(row);saveMockPhoneSecrets(row.id,body);return {status:true,data:phoneConfigWire(row),graph:'default'};}if(method!=='GET')return {status:false,error:'Method not allowed',error_code:405};const params=messagingParams(opts.params??{},['provider','is_active','group','test_mode'],['name','provider','is_active','created','modified'],'default','name');return messagingList(db.phoneConfigs as unknown as Record<string,unknown>[],params,row=>String(row.name),'default',row=>phoneConfigWire(row as unknown as MockPhoneConfig),'name');}
+    if(configMatch){const id=configMatch[1]?Number(configMatch[1]):null;if(method==='DELETE'){if(!hasGlobalPermission(caller,PHONE_CONFIG_DELETE_GRANTS))return permissionDenied();if(id==null)return {status:false,error:'Method not allowed',error_code:405};db.phoneConfigs=db.phoneConfigs.filter(row=>row.id!==id);db.phoneConfigSecrets.delete(id);return {status:'deleted'};}if(!hasGlobalPermission(caller,PHONE_CONFIG_VIEW_GRANTS))return permissionDenied();if(id!=null){const row=db.phoneConfigs.find(item=>item.id===id);if(!row)return {status:false,error:'Phone config not found',error_code:404};if(method==='POST'&&opts.body?.test_connection){if(row.test_mode)return {status:true,data:{success:true,test_mode:true,message:'Config is in test mode - provider not tested'}};const secrets=db.phoneConfigSecrets.get(id)??{};const ready=row.provider==='twilio'?Boolean(secrets.twilio_account_sid&&secrets.twilio_auth_token):row.provider==='aws'?Boolean(secrets.aws_access_key_id&&secrets.aws_secret_access_key):Boolean(secrets.mojo_api_key&&row.mojo_remote_url);return {status:true,data:ready?{success:true,message:`${row.provider} connection succeeded`}:{success:false,message:`${row.provider} credentials are incomplete`,error:'missing_credentials'}};}if(method==='POST'){const nextGroup='group'in(opts.body??{})?(opts.body?.group==null?null:Number(opts.body.group)):row.group;if(nextGroup!=null&&db.phoneConfigs.some(item=>item.id!==id&&item.group===nextGroup))return {status:false,error:'A configuration already exists for this group',error_code:400};applyPhoneConfig(row,opts.body??{});saveMockPhoneSecrets(id,opts.body??{});}else if(method!=='GET')return {status:false,error:'Method not allowed',error_code:405};return {status:true,data:phoneConfigWire(row),graph:'default'};}if(method==='POST'){const body=opts.body??{};const group=body.group==null?null:Number(body.group);if(group!=null&&!db.groups.some(item=>item.id===group))return {status:false,error:'Group not found',error_code:404};if(group!=null&&db.phoneConfigs.some(item=>item.group===group))return {status:false,error:'A configuration already exists for this group',error_code:400};const now=Math.floor(Date.now()/1000);const row:MockPhoneConfig={id:Math.max(0,...db.phoneConfigs.map(item=>item.id))+1,created:now,modified:now,group,name:String(body.name??''),is_active:body.is_active!==false,provider:['twilio','aws','mojo'].includes(String(body.provider))?String(body.provider) as MockPhoneConfig['provider']:'twilio',twilio_from_number:null,aws_region:null,aws_sender_id:null,mojo_remote_url:null,lookup_enabled:body.lookup_enabled!==false,lookup_cache_days:Number(body.lookup_cache_days??90),test_mode:Boolean(body.test_mode)};applyPhoneConfig(row,body);db.phoneConfigs.push(row);saveMockPhoneSecrets(row.id,body);return {status:true,data:phoneConfigWire(row),graph:'default'};}if(method!=='GET')return {status:false,error:'Method not allowed',error_code:405};const params=messagingParams(opts.params??{},['provider','is_active','group','test_mode'],['name','provider','is_active','created','modified'],'default','name');return messagingList(db.phoneConfigs as unknown as Record<string,unknown>[],params,row=>String(row.name),'default',row=>phoneConfigWire(row as unknown as MockPhoneConfig),'name');}
     return undefined;
 }
 async function messagingFetch(path:string,opts:MockFetchOpts):Promise<unknown|undefined>{
@@ -7749,14 +7825,18 @@ export async function mockFetch(path: string, opts: MockFetchOpts): Promise<unkn
         if (skillMatch) {
             if (!assistantGate) return permissionDenied(); const id = skillMatch[1] ? Number(skillMatch[1]) : null;
             const skillWire = (row: MockAssistantSkill, detail = false) => ({ id: row.id, tier: row.tier, name: row.name, description: row.description, auto_execute: row.auto_execute, is_active: row.is_active, created: row.created, modified: row.modified, user: row.user == null ? null : assistantUser(row.user), ...(detail ? { triggers: [...row.triggers], steps: structuredClone(row.steps), metadata: { ...row.metadata } } : {}) });
-            if (id != null) { const row = db.assistantSkills.find((candidate) => candidate.id === id); if (!row) return { status: false, error: 'Skill not found', error_code: 404 }; if (method === 'DELETE') { db.assistantSkills = db.assistantSkills.filter((candidate) => candidate.id !== id); return { status: 'deleted' }; } if (method !== 'GET') return { status: false, error: 'Method not allowed', error_code: 405 }; return { status: true, data: skillWire(row, opts.params?.graph === 'detail'), graph: String(opts.params?.graph ?? 'default') }; }
+            if (id != null) { const row = db.assistantSkills.find((candidate) => candidate.id === id); if (!row) return { status: false, error: 'Skill not found', error_code: 404 }; if (method === 'DELETE') { db.assistantSkills = db.assistantSkills.filter((candidate) => candidate.id !== id); return { status: 'deleted' }; } if (method === 'POST') { if (!hasGlobalPermission(caller, ['view_admin'])) return permissionDenied(); if (typeof opts.body?.is_active !== 'boolean') return { status: false, error: 'is_active is required', error_code: 400 }; row.is_active = opts.body.is_active; row.modified = Math.floor(Date.now() / 1000); } else if (method !== 'GET') return { status: false, error: 'Method not allowed', error_code: 405 }; return { status: true, data: skillWire(row, opts.params?.graph === 'detail'), graph: String(opts.params?.graph ?? 'default') }; }
             if (method !== 'GET') return { status: false, error: 'Method not allowed', error_code: 405 }; const rows = [...db.assistantSkills].sort((a, b) => a.name.localeCompare(b.name)); return { status: true, data: rows.map((row) => skillWire(row)), count: rows.length, start: 0, size: rows.length, graph: 'default' };
         }
         const memoryMatch = path.match(/^\/api\/assistant\/memory\/(global|user|group)(?:\/([^/]+))?$/);
         if (memoryMatch) {
             if (!hasGlobalPermission(caller, ['assistant'])) return permissionDenied(); const tier = memoryMatch[1] as 'global' | 'user' | 'group'; const entryKey = memoryMatch[2] ? decodeURIComponent(memoryMatch[2]) : null; const groupId = tier === 'group' ? Number(opts.params?.group) : null;
             if ('group' in (opts.body ?? {})) return { status: false, error: 'group belongs in request context, not the body', error_code: 400 };
-            if (tier === 'group') { const membership = db.members.find((member) => member.user === caller.id && member.group === groupId && member.is_active); if (!membership) return permissionDenied(); }
+            if (tier === 'group' && !caller.is_superuser) {
+                let currentGroup: number | null = groupId; const visited = new Set<number>(); let membership: MockMember | undefined;
+                while (currentGroup != null && !visited.has(currentGroup)) { visited.add(currentGroup); membership = db.members.find(member => member.user === caller.id && member.group === currentGroup && member.is_active); if (membership) break; const parent = db.groups.find(row => row.id === currentGroup)?.parent; currentGroup = typeof parent === 'number' ? parent : typeof parent?.id === 'number' ? parent.id : null; }
+                if (!membership || method !== 'GET' && !['assistant', 'admin'].some(permission => Boolean(membership!.permissions[permission]))) return permissionDenied();
+            }
             const store: Record<string, unknown> = tier === 'global' ? db.assistantMemory.global : tier === 'user' ? (db.assistantMemory.users.get(caller.id) ?? {}) : (db.assistantMemory.groups.get(groupId!) ?? {});
             if (method === 'GET' && entryKey == null) return { status: true, data: { ...store } };
             if (method === 'POST' && entryKey == null) { const key = typeof opts.body?.key === 'string' ? opts.body.key : ''; const value = typeof opts.body?.value === 'string' ? opts.body.value : ''; if (!/^[a-z0-9:_-]{1,64}$/.test(key) || value.length < 1 || value.length > 500) return { status: false, error: 'Invalid memory key or value', error_code: 400 }; store[key] = value; if (tier === 'user') db.assistantMemory.users.set(caller.id, store); if (tier === 'group') db.assistantMemory.groups.set(groupId!, store); return { status: true, data: { key, value } }; }
@@ -9058,7 +9138,11 @@ export async function mockFetch(path: string, opts: MockFetchOpts): Promise<unkn
                 return { status: true, data: { ...row }, graph: String(opts.params?.graph ?? 'default') };
             }
             const graph = String(opts.params?.graph ?? 'default');
-            return { status: true, data: { ...row, ...(graph === 'detailed' ? { ip_info: { ip_address: row.source_ip, country_code: row.country_code } } : {}) }, graph };
+            const geo = row.source_ip ? db.geoIps.find((candidate) => candidate.ip_address === row.source_ip) : null;
+            const ipInfo = geo
+                ? serializeGeoIp(geo, 'default')
+                : { ip_address: row.source_ip, country_code: row.country_code };
+            return { status: true, data: { ...row, ...(graph === 'detailed' ? { ip_info: ipInfo } : {}) }, graph };
         }
         if (method === 'POST') return { status: false, error: 'Incident creation is not available', error_code: 403 };
         const result = listRows(

package/src/client/upload.ts

@@ -368,6 +368,7 @@ class UploadTask implements FileUploadTask {
             onProgress: (loaded: number, total: number) => this.#publish({ loadedBytes: loaded, totalBytes: total > 0 ? total : null }, generation),
         };
         if (usingMockTransport()) {
+            if (import.meta.env.VITE_MOJO_PACKAGED_ADMIN === '1') throw new Error('Mock upload is unavailable in packaged Admin');
             const { mockUploadBytes } = await import('./mock');
             await mockUploadBytes(request);
         } else await xhrUpload(request);

package/src/ui/DetailView.tsx

@@ -76,6 +76,8 @@ export interface DetailMenuItem<TCtx = unknown> {
     onSelect: () => void;
     /** Destructive styling (`--bad`), the source's `danger` flag. */
     danger?: boolean;
+    /** Keep an action visible while preventing repeat submission. */
+    disabled?: boolean;
 }
 
 export type DetailMenuEntry<TCtx = unknown> = DetailMenuItem<TCtx> | { divider: true };
@@ -86,7 +88,7 @@ export interface DetailViewProps<TCtx = unknown> {
     title: string;
     subtitle?: string;
     chips?: Chip[];
-    active?: { value: boolean; onChange: (next: boolean) => void };
+    active?: { value: boolean; onChange: (next: boolean) => void; disabled?: boolean };
     sections: RailEntry[];
     initialSection?: string;
     /** Controlled rail badges keyed by section key — numbers, dots, text,
@@ -229,6 +231,8 @@ export function DetailView<TCtx = unknown>({
     avatarName, icon, title, subtitle, chips = [], active,
     sections, initialSection, badges, contextMenu, menuContext, onClose,
 }: DetailViewProps<TCtx>) {
+    const [sectionsExpanded, setSectionsExpanded] = useState(false);
+    const sectionToggleRef = useRef<HTMLButtonElement>(null);
     const can = useCanChecker();
     const warnOnce = useWarnOnce();
 
@@ -299,7 +303,7 @@ export function DetailView<TCtx = unknown>({
     if (menuOpen && menuEntries.length === 0) setMenuOpen(false);
 
     return (
-        <div className="detail">
+        <div className={`detail${onClose ? ' detail-modal-body' : ''}`}>
             <header className="detail-header">
                 <div className="detail-avatar">
                     {avatarName ? initials(avatarName) : <i className={`bi ${icon ?? 'bi-file-earmark'}`} />}
@@ -323,6 +327,8 @@ export function DetailView<TCtx = unknown>({
                                 role="switch"
                                 className="switch"
                                 checked={active.value}
+                                disabled={active.disabled}
+                                aria-label="Active"
                                 onChange={(e) => active.onChange(e.target.checked)}
                             />
                         </label>
@@ -356,8 +362,9 @@ export function DetailView<TCtx = unknown>({
                                             key={`${entry.label}${i}`}
                                             className={`dv-menu-item${entry.danger ? ' dv-danger' : ''}`}
                                             role="menuitem"
+                                            disabled={entry.disabled}
                                             // Source order: run the handler, then close.
-                                            onClick={() => { entry.onSelect(); setMenuOpen(false); }}
+                                            onClick={() => { if (!entry.disabled) { kebabRef.current?.focus(); entry.onSelect(); setMenuOpen(false); } }}
                                         >
                                             {entry.icon && <i className={`bi ${entry.icon}`} />}
                                             <span>{entry.label}</span>
@@ -375,14 +382,24 @@ export function DetailView<TCtx = unknown>({
                 </div>
             </header>
             <div className="detail-body">
-                <nav className="detail-rail" aria-label={`${title} sections`}>
+                <button ref={sectionToggleRef} type="button" className="detail-section-toggle" aria-expanded={sectionsExpanded} onClick={() => setSectionsExpanded(value => !value)}>
+                    <span>{visibleSections.find(section => section.key === effectiveKey)?.label ?? 'Sections'}</span>
+                    {railBadge(safeNode(badges?.[effectiveKey ?? ''], 'DetailView active badge'))}
+                    <i className={`bi bi-chevron-${sectionsExpanded ? 'up' : 'down'}`} />
+                </button>
+                <nav className={`detail-rail${sectionsExpanded ? ' detail-rail-expanded' : ''}`} aria-label={`${title} sections`}>
                     {visibleEntries.map((entry, i) => 'divider' in entry ? (
                         <div key={`d${i}`} className="rail-divider">{entry.divider}</div>
                     ) : (
                         <button
                             key={entry.key}
                             className={`rail-item${entry.key === effectiveKey ? ' rail-active' : ''}`}
-                            onClick={() => setActiveKey(entry.key)}
+                            aria-current={entry.key === effectiveKey ? 'page' : undefined}
+                            onClick={() => {
+                                if (sectionsExpanded) sectionToggleRef.current?.focus();
+                                setActiveKey(entry.key);
+                                setSectionsExpanded(false);
+                            }}
                         >
                             <i className={`bi ${entry.icon}`} /> {entry.label}
                             {railBadge(safeNode(badges?.[entry.key], `DetailView badge "${entry.key}"`))}

package/src/ui/FormView.tsx

@@ -26,6 +26,7 @@ import { toast } from './toast';
 import {
     useFormAutosave,
     type AutosaveBatchInfo,
+    type AutosaveBeforeSave,
     type FieldStatus,
     type FormAutosaveApi,
 } from './form-autosave';
@@ -104,13 +105,34 @@ export interface FormViewProps<T extends { id: number | string }> {
     savedFlashMs?: number;
     onSaved?: (info: AutosaveBatchInfo & { row: T }) => void;
     onSaveError?: (info: AutosaveBatchInfo & { error: Error }) => void;
+    /**
+     * Pre-save gate, once per batch. `false` drops the batch (its fields
+     * revert, no toast); an object replaces the wire body; true/undefined
+     * proceeds. Put a `confirmGuardrail` here for grants/identity fields.
+     */
+    beforeSave?: AutosaveBeforeSave<T>;
     /** True while any FileField transfer is active. Owners can block dismissal. */
     onPendingChange?: (pending: boolean) => void;
     className?: string;
 }
 
+const saveOwnerIds = new WeakMap<object, number>();
+let nextSaveOwnerId = 0;
+
 export function FormView<T extends { id: number | string }>(props: FormViewProps<T>) {
-    const { model, row, fields, tabs, debounceMs, savedFlashMs, onSaved, onSaveError, className } = props;
+    // A TanStack mutation observer updates its mutationFn on rerender.
+    // Keep the observer and reducer with the model/record that created them,
+    // so a confirmation already in flight cannot migrate to another owner.
+    let modelId = saveOwnerIds.get(props.model.useSave);
+    if (modelId === undefined) {
+        modelId = ++nextSaveOwnerId;
+        saveOwnerIds.set(props.model.useSave, modelId);
+    }
+    return <OwnedFormView key={JSON.stringify([modelId, props.row.id])} {...props} />;
+}
+
+function OwnedFormView<T extends { id: number | string }>(props: FormViewProps<T>) {
+    const { model, row, fields, tabs, debounceMs, savedFlashMs, onSaved, onSaveError, beforeSave, className } = props;
     const save = model.useSave();
 
     // Registry-named tabsets re-render on registration; inline defs pass through.
@@ -164,6 +186,7 @@ export function FormView<T extends { id: number | string }>(props: FormViewProps
         save: (changes) => save.mutateAsync({ id: row.id, changes } satisfies SaveVars),
         debounceMs,
         savedFlashMs,
+        beforeSave,
         onSaved: (info) => {
             publishOwnerResult(info.fields, 'success', info.changes, info.row);
             onSaved?.(info);

package/src/ui/ModelTable.tsx

@@ -56,12 +56,18 @@ interface BatchActionBase<T> {
     danger?: boolean;
     /** Row-state eligibility. Ineligible selected rows are never submitted. */
     eligible?: (row: T) => boolean;
-    /** Confirm copy; false skips the prompt. Default: "<label> N item(s)?" */
-    confirm?: string | false;
+    /**
+     * The permission step. A string is the `modal.confirm` copy; false skips
+     * the prompt; a function REPLACES the built-in confirm — resolve false
+     * to cancel (open a `confirmGuardrail` here for batches that take a
+     * tenant dark or can't be undone). Default: "<label> N item(s)?"
+     */
+    confirm?: string | false | ((rows: T[]) => Promise<boolean>);
     /**
      * Optional once-per-batch step (collect a reason, pick a value…) run
      * AFTER the confirm. Resolve null to cancel the batch; the resolved
-     * value is passed to every run() call.
+     * value is passed to every run() call. Ask permission in `confirm`,
+     * not here — a null from prepare means "nothing collected".
      */
     prepare?: (rows: T[]) => Promise<unknown | null>;
 }
@@ -449,7 +455,9 @@ export function ModelTable<T extends { id: RowId }>({
     const runBatch = async (action: BatchAction<T>) => {
         const targets = rows.filter((r) => selected.has(r.id) && (!action.eligible || action.eligible(r)));
         if (targets.length === 0) return;
-        if (action.confirm !== false) {
+        if (typeof action.confirm === 'function') {
+            if (!(await action.confirm(targets))) return;
+        } else if (action.confirm !== false) {
             const ok = await modal.confirm({
                 title: action.label,
                 message: action.confirm ?? `${action.label} ${targets.length} item(s)?`,

package/src/ui/Popover.tsx

@@ -11,10 +11,10 @@
 // `showPopover()`): top-layer members paint in promotion order, so a popover
 // opened from inside a modal stacks above it. `manual` (not `auto`) opts out
 // of UA light-dismiss — close behavior stays ours, matching the source.
-// Browsers without the API fall back to a plain portaled div; when the
-// anchor sits inside an open <dialog> the portal target becomes that dialog
-// (a descendant paints with its top-layer host, and position:fixed children
-// are not clipped by ancestor overflow), so pickers-in-modals keep working.
+// A popover anchored inside a modal remains a DOM descendant of that dialog
+// in both paths. Top-layer painting alone does not escape the document's
+// modal inertness: a body portal can be visible yet reject pointer/focus input.
+// Browsers without the API paint the fixed descendant with its dialog host.
 //
 // Coordinates: the element is position:fixed in BOTH paths, so all math is
 // viewport-relative (a deliberate translation from the source's
@@ -118,6 +118,10 @@ export function Popover({
                 top = rect.top - popRect.height - gap;
             }
 
+            // Keep a tall menu reachable even when it cannot fit wholly on
+            // either side. Individual menu content owns scrolling; do not clip
+            // this host, which may contain nested calendar/picker popovers.
+            top = Math.max(VIEWPORT_INSET, Math.min(top, vh - popRect.height - VIEWPORT_INSET));
             el.style.top = `${top}px`;
             el.style.left = `${left}px`;
         };
@@ -162,6 +166,7 @@ export function Popover({
             // request. The next Escape then reaches the dialog.
             event.preventDefault();
             event.stopPropagation();
+            anchorRef.current?.focus();
             onCloseRef.current('escape');
         };
 
@@ -180,14 +185,10 @@ export function Popover({
 
     if (!open) return null;
 
-    // Portal target is decided at render. With the Popover API the top layer
-    // makes document.body universal; without it, an anchor inside an open
-    // modal portals into that <dialog> so the popover paints with its
-    // top-layer host. (Ref read during render is idempotent here — the
-    // anchor mounts before any user-driven open.)
-    const host = SUPPORTS_POPOVER
-        ? document.body
-        : anchorRef.current?.closest('dialog') ?? document.body;
+    // Keep modal descendants outside the inert document subtree, including
+    // when showPopover() promotes them to the native top layer. Ref reads are
+    // idempotent here: the anchor mounts before any user-driven opening.
+    const host = anchorRef.current?.closest('dialog') ?? document.body;
 
     return createPortal(
         <div