portal-mojo 0.2.20 → 0.2.21

package/src/admin/geolocation/GeoLocationPage.tsx

@@ -0,0 +1,171 @@
+import { useCallback, useEffect, useId, useRef, useState, type ReactNode } from 'react';
+import { Link, useLocation, useNavigate } from 'react-router-dom';
+import { requestFreshAuth, useMe } from '../../client/runtime';
+import { modal } from '../../ui';
+import { Popover } from '../../ui/Popover';
+import { OperatorError, usePrivateOperator } from '../fleet-configuration/shared-validation-data';
+import { GeoLocationError, geoDraft, geoFleetRoute, geoProviderLabel, geoProviderOptions, geoTestBlock, geoWriteBlock, readGeoLocation, saveGeoLocation, testGeoLocation, type GeoDraft, type GeoKeyEdit, type GeoLocationState, type GeoVerdict } from './data';
+
+// The hosted MojoVerify service has one fixed origin; only its key is editable.
+const mojoverifyDraft = (value: GeoDraft): GeoDraft => ({ ...geoDraft(value), GEOIP_MOJO_PROVIDER_URL: 'https://api.mojoverify.com' });
+
+function GeoHelp({ label, children }: { label: string; children: ReactNode }) {
+    const anchor = useRef<HTMLButtonElement>(null), id = useId();
+    const [open, setOpen] = useState(false);
+    return <><button ref={anchor} type="button" className="ops-help" aria-label={`About ${label}`} aria-expanded={open} aria-controls={open ? id : undefined} onClick={event => { event.preventDefault(); setOpen(value => !value); }}><svg width="16" height="16" viewBox="0 0 20 20" fill="none" stroke="currentColor" strokeWidth="1.5" aria-hidden="true"><circle cx="10" cy="10" r="8" /><path d="M10 9v5" /><circle cx="10" cy="6" r=".8" fill="currentColor" stroke="none" /></svg></button><Popover anchorRef={anchor} open={open} onClose={() => setOpen(false)} id={id} aria-label={`About ${label}`} className="ops-help-content">{children}</Popover></>;
+}
+
+export function GeoLocationPage({ fleetConfigurationPath }: { fleetConfigurationPath?: string } = {}) {
+    const owner = usePrivateOperator(), { data: me } = useMe();
+    if (me?.is_superuser !== true || !owner.allowed) return <div className="panel panel-pad"><h1>GeoLocation</h1><p>GeoLocation requires a superuser account with an interactive session.</p></div>;
+    return <GeoLocationContent key={owner.key} fleetConfigurationPath={fleetConfigurationPath} />;
+}
+function GeoLocationContent({ fleetConfigurationPath }: { fleetConfigurationPath?: string }) {
+    const owner = usePrivateOperator(), location = useLocation(), navigate = useNavigate();
+    const [state, setState] = useState<GeoLocationState | null>(null), [draft, setDraft] = useState<GeoDraft | null>(null);
+    const [keyMode, setKeyMode] = useState<GeoKeyEdit['mode']>('untouched'), [keyChanged, setKeyChanged] = useState(false);
+    const [verdict, setVerdict] = useState<GeoVerdict | null>(null), [error, setError] = useState(''), [notice, setNotice] = useState('');
+    const [loading, setLoading] = useState(true), [busy, setBusy] = useState(false), [blocked, setBlocked] = useState(true);
+    const input = useRef<HTMLInputElement>(null), flight = useRef(false), generation = useRef(0), draftEpoch = useRef(0);
+    const keyRef = useCallback((node: HTMLInputElement | null) => {
+        if (input.current && input.current !== node) input.current.value = '';
+        input.current = node;
+    }, []);
+    const clearKey = () => { if (input.current) input.current.value = ''; setKeyMode('untouched'); setKeyChanged(false); };
+    const invalidate = () => { draftEpoch.current++; setVerdict(null); setNotice(''); };
+    useEffect(() => () => { generation.current++; draftEpoch.current++; if (input.current) input.current.value = ''; }, [owner.key]);
+    const failure = async (reason: unknown, forceBlock = false) => {
+        const safe = reason instanceof GeoLocationError ? reason : new GeoLocationError(reason instanceof OperatorError && reason.kind === 'denied' ? 'denied' : 'unavailable');
+        setError(safe.message);
+        if (forceBlock || ['invalid', 'unsupported', 'denied', 'fresh', 'conflict', 'uncertain', 'unavailable'].includes(safe.kind)) setBlocked(true);
+        if (safe.kind === 'fresh' || safe.kind === 'denied') { clearKey(); invalidate(); }
+        if (safe.kind === 'fresh') await requestFreshAuth();
+    };
+    const refresh = async () => {
+        if (flight.current || !owner.allowed) return;
+        const fence = owner.fence(), run = ++generation.current;
+        invalidate(); clearKey(); setLoading(true); setBlocked(true); setError('');
+        try {
+            const next = await readGeoLocation(fence); fence.beforeSend();
+            if (run !== generation.current) return;
+            setState(next); setDraft(mojoverifyDraft(next.geoip)); setBlocked(false);
+        } catch (reason) { if (!fence.signal?.aborted && run === generation.current) await failure(reason, true); }
+        finally { if (!fence.signal?.aborted && run === generation.current) setLoading(false); }
+    };
+    useEffect(() => { void refresh(); }, [owner.key]);
+    const dirty = !!state && !!draft && (JSON.stringify(draft) !== JSON.stringify(mojoverifyDraft(state.geoip)) || keyMode === 'clear' || keyChanged);
+    const change = <K extends keyof GeoDraft>(key: K, value: GeoDraft[K]) => { invalidate(); setDraft(old => old ? { ...old, [key]: value } : old); };
+    const discard = () => { invalidate(); clearKey(); if (state) setDraft(mojoverifyDraft(state.geoip)); setError(''); };
+    const confirmDiscard = async (destination: 'refresh' | 'fleet') => {
+        flight.current = true; setBusy(true); const fence = owner.fence();
+        try {
+            const confirmed = await modal.open<boolean>(close => <div className="modal-pad"><h2 className="modal-title">Discard unsaved changes?</h2><p className="modal-message">{destination === 'refresh' ? 'Refreshing replaces this draft and clears any entered API key.' : 'Opening Fleet Configuration discards this draft and clears any entered API key.'}</p><div className="modal-actions"><button className="btn" onClick={() => close(false)}>Keep editing</button><button className="btn btn-danger" onClick={() => close(true)}>{destination === 'refresh' ? 'Discard and refresh' : 'Discard and continue'}</button></div></div>, { size: 'md', signal: fence.signal });
+            fence.beforeSend();
+            return confirmed === true;
+        } catch (reason) { if (!fence.signal?.aborted) await failure(reason); return false; }
+        finally { flight.current = false; if (!fence.signal?.aborted) setBusy(false); }
+    };
+    const requestRefresh = async () => {
+        if (flight.current || loading) return;
+        if (dirty && !await confirmDiscard('refresh')) return;
+        await refresh();
+    };
+    const openFleet = async () => {
+        if (flight.current || loading || !owner.allowed) return;
+        if (dirty && !await confirmDiscard('fleet')) return;
+        discard();
+        navigate(fleetConfigurationPath ?? geoFleetRoute(location.pathname));
+    };
+    const chooseKeyMode = async (mode: GeoKeyEdit['mode']) => {
+        if (flight.current || loading || blocked || !state) return;
+        if (mode === 'clear') {
+            flight.current = true; setBusy(true); const fence = owner.fence();
+            try {
+                const confirmed = await modal.open<boolean>(close => <div className="modal-pad"><h2 className="modal-title">Remove the stored MojoVerify key?</h2><p className="modal-message">Saving will remove the key. MojoVerify lookups and threat-signal sharing may stop. This does not revoke the key at the service.</p><div className="modal-actions"><button className="btn" onClick={() => close(false)}>Cancel</button><button className="btn btn-danger" onClick={() => close(true)}>Confirm key removal</button></div></div>, { size: 'md', signal: fence.signal });
+                fence.beforeSend(); if (confirmed) { invalidate(); clearKey(); setKeyMode('clear'); }
+            } catch (reason) { if (!fence.signal?.aborted) await failure(reason); }
+            finally { flight.current = false; if (!fence.signal?.aborted) setBusy(false); }
+        } else { invalidate(); clearKey(); setKeyMode(mode); }
+    };
+    const run = async (action: 'test' | 'save') => {
+        if (flight.current || !owner.allowed || blocked || loading || !state || !draft || (action === 'save' ? !dirty || geoWriteBlock(state) : geoTestBlock(state) || keyMode === 'clear')) return;
+        flight.current = true; setBusy(true); setError(''); setNotice('');
+        const fence = owner.fence(), epoch = draftEpoch.current, runGeneration = generation.current, base = state;
+        const saving = action === 'save';
+        try {
+            fence.beforeSend();
+            const edit: GeoKeyEdit = keyMode === 'replace' ? { mode: 'replace', value: input.current?.value ?? '' } : keyMode === 'clear' ? { mode: 'clear', confirmed: true } : { mode: 'untouched' };
+            if (action === 'test') {
+                const next = await testGeoLocation(base.configuration_revision, draft, edit, fence); fence.beforeSend();
+                if (epoch !== draftEpoch.current || runGeneration !== generation.current) return;
+                setVerdict(next);
+                try {
+                    const observed = await readGeoLocation(fence); fence.beforeSend();
+                    if (epoch !== draftEpoch.current || runGeneration !== generation.current) return;
+                    // Refresh observations/prerequisites without rebasing a changed revision or the draft.
+                    if (observed.configuration_revision !== base.configuration_revision || geoTestBlock(observed)) {
+                        setBlocked(true); setError('Authoritative configuration changed or became unavailable. Refresh and review before continuing.');
+                    } else setState(observed);
+                } catch (reason) { if (!fence.signal?.aborted) await failure(reason, true); }
+            } else {
+                clearKey();
+                const result = await saveGeoLocation(base.configuration_revision, draft, edit, fence); fence.beforeSend();
+                if (epoch !== draftEpoch.current || runGeneration !== generation.current) return;
+                invalidate(); setBlocked(true);
+                setNotice(result.published ? 'Saved and published. Apply the pending configuration in Fleet Configuration.' : 'Saved. Published provider values were unchanged; the stored credential may have changed.');
+                const authoritative = await readGeoLocation(fence); fence.beforeSend();
+                if (runGeneration !== generation.current) return;
+                setState(authoritative); setDraft(mojoverifyDraft(authoritative.geoip)); setBlocked(false);
+            }
+        } catch (reason) {
+            if (!fence.signal?.aborted && runGeneration === generation.current) {
+                if (saving) clearKey();
+                await failure(reason, saving && !(reason instanceof GeoLocationError && reason.kind === 'validation'));
+            }
+        } finally { flight.current = false; if (!fence.signal?.aborted && runGeneration === generation.current) setBusy(false); }
+    };
+    const block = state ? geoWriteBlock(state) : null, diagnosticBlock = state ? geoTestBlock(state) : null;
+    const disabled = busy || loading || blocked, options = state && draft ? geoProviderOptions(state, draft) : [];
+    const additionalOptions = draft ? options.filter(p => p !== draft.GEOIP_PRIMARY_PROVIDER && p !== draft.GEOIP_FALLBACK_PROVIDER && !draft.GEOIP_ADDITIONAL_PROVIDERS.includes(p)) : [];
+    const meta = (key: keyof GeoDraft) => state?.fleet_fields.find(f => f.key === key);
+    const help = (label: string, content: ReactNode) => <GeoHelp label={label}>{content}</GeoHelp>;
+    const providerSelect = (key: 'GEOIP_PRIMARY_PROVIDER' | 'GEOIP_FALLBACK_PROVIDER', label: string) => <label className="field"><span className="field-label">{label} {help(label, <>{meta(key)?.description} Each provider is queried only once at runtime, even if it appears in more than one position. Other provider credentials are managed in deployment settings.</>)}</span><select className="input" aria-label={label} value={draft?.[key] ?? ''} onChange={e => change(key, e.target.value)}>{options.map(p => <option key={p} value={p}>{geoProviderLabel(p)}{state?.geoip_providers.includes(p) ? '' : ' (configured; unavailable)'}</option>)}</select></label>;
+    const move = (index: number, offset: number) => { if (!draft) return; const next = [...draft.GEOIP_ADDITIONAL_PROVIDERS], target = index + offset; [next[index], next[target]] = [next[target]!, next[index]!]; change('GEOIP_ADDITIONAL_PROVIDERS', next); };
+    const stored = state?.verify_state.geoip, storedDate = stored?.at && Number.isFinite(Date.parse(stored.at)) ? new Date(stored.at) : null;
+    const details = () => {
+        if (!state) return;
+        void modal.open(close => <div className="modal-pad geo-admin-dialog"><h2 className="modal-title">Configuration information</h2><dl>{[['Published revision', state.published_revision ?? 'Not published'], ['This request node loaded', state.loaded_revision ?? 'Not reported'], ['Configuration revision', state.configuration_revision ?? 'Not published'], ['Published version', state.published_version ?? 'Not reported'], ['Remote configuration', state.remote_error ?? 'No read error reported']].map(([label, value]) => <div key={label}><dt>{label}</dt><dd><code>{value}</code></dd></div>)}</dl><p className="dim">A key check does not prove that the provider chain or every Fleet node is healthy. Stored checks are historical observations, separate from this draft.</p>{stored && <p>{stored.message}{stored.code && <> · <code>{stored.code}</code></>}</p>}<div className="modal-actions"><button className="btn" onClick={() => close(undefined)}>Close</button></div></div>, { size: 'md', signal: owner.fence().signal });
+    };
+    return <div className="page geo-admin"><header className="page-header"><div><div className="eyebrow">Operations</div><h1>GeoLocation</h1><p className="dim">Set up your IP location providers.</p></div><button className="btn" disabled={busy || loading} onClick={() => void requestRefresh()}>Refresh</button></header>
+        {loading && <p role="status">Loading GeoLocation configuration…</p>}
+        {error && <p className="form-alert" role="alert">{error}</p>}{notice && <p className="geo-admin-notice" role="status">{notice}</p>}
+        {block && <div className="geo-admin-notice" role="alert"><strong>Publishing unavailable</strong><p>{block}</p><span>You can review a local draft{!diagnosticBlock && ' and test the MojoVerify key'}.</span></div>}
+        {state && draft && <><section className="panel geo-admin-setup" aria-label="GeoLocation provider setup">
+            <div className="geo-admin-form"><fieldset disabled={disabled} className="geo-admin-fields">
+                <div className="geo-admin-provider-fields">
+                    {providerSelect('GEOIP_PRIMARY_PROVIDER', 'Primary provider')}
+                    {providerSelect('GEOIP_FALLBACK_PROVIDER', 'Fallback provider')}
+                </div>
+                <div className="field"><span className="field-label">Additional providers {help('additional providers', <>{meta('GEOIP_ADDITIONAL_PROVIDERS')?.description} Tried in the order shown after the primary and fallback providers. Other provider credentials are managed in deployment settings.</>)}</span>
+                    <ol className="geo-admin-provider-list">{draft.GEOIP_ADDITIONAL_PROVIDERS.map((provider, index) => <li key={provider}><span><span className="dim">{index + 1}.</span> {geoProviderLabel(provider)}{!state.geoip_providers.includes(provider) && <small className="dim"> Configured; unavailable</small>}</span><div className="geo-admin-actions"><button className="btn" aria-label={`Move ${geoProviderLabel(provider)} up`} disabled={disabled || index === 0} onClick={() => move(index, -1)}>↑</button><button className="btn" aria-label={`Move ${geoProviderLabel(provider)} down`} disabled={disabled || index === draft.GEOIP_ADDITIONAL_PROVIDERS.length - 1} onClick={() => move(index, 1)}>↓</button><button className="btn" aria-label={`Remove ${geoProviderLabel(provider)}`} onClick={() => change('GEOIP_ADDITIONAL_PROVIDERS', draft.GEOIP_ADDITIONAL_PROVIDERS.filter(p => p !== provider))}>Remove</button></div></li>)}</ol>
+                    {!draft.GEOIP_ADDITIONAL_PROVIDERS.length && <p className="field-help">No additional providers.</p>}
+                    <select className="input" aria-label="Add provider" value="" disabled={disabled || !additionalOptions.length || draft.GEOIP_ADDITIONAL_PROVIDERS.length >= 16} onChange={e => { if (e.target.value) change('GEOIP_ADDITIONAL_PROVIDERS', [...draft.GEOIP_ADDITIONAL_PROVIDERS, e.target.value]); }}><option value="">{additionalOptions.length ? 'Add provider…' : 'All providers added'}</option>{additionalOptions.map(p => <option value={p} key={p}>{geoProviderLabel(p)}</option>)}</select>
+                </div>
+                <div className="geo-admin-key"><div className="geo-admin-key-heading"><span className="field-label">MojoVerify API key</span>{help('MojoVerify API key', 'Write only. Tests check only MojoVerify. Saving also checks MojoVerify, even when another provider is primary, unless you explicitly remove its key. Other provider credentials are managed in deployment settings.')}</div>
+                    <p className="dim">{state.geoip.GEOIP_API_KEY_MOJO_CONFIGURED ? <>Key set{state.geoip.GEOIP_API_KEY_MOJO_HINT && <> · <span aria-label="Stored key suffix">••••{state.geoip.GEOIP_API_KEY_MOJO_HINT}</span></>}</> : 'No stored key'}</p>
+                    <div className="geo-admin-actions"><button className="btn" aria-pressed={keyMode === 'replace'} onClick={() => void chooseKeyMode('replace')}>{state.geoip.GEOIP_API_KEY_MOJO_CONFIGURED ? 'Replace key' : 'Add key'}</button>{state.geoip.GEOIP_API_KEY_MOJO_CONFIGURED && <button className="btn" onClick={() => void chooseKeyMode('clear')}>Remove key</button>}<button className="btn" disabled={disabled || !!diagnosticBlock || keyMode === 'clear'} onClick={() => void run('test')}>Test key</button>{keyMode !== 'untouched' && <button className="btn" onClick={() => void chooseKeyMode('untouched')}>Cancel key change</button>}</div>
+                    {/* Retained while editing; the raw value lives only in this uncontrolled DOM input. */}
+                    <label className="field" hidden={keyMode !== 'replace'}><span className="field-label">{state.geoip.GEOIP_API_KEY_MOJO_CONFIGURED ? 'Replacement key' : 'New key'}</span><input className="input" ref={keyRef} type="password" aria-label="MojoVerify API key" autoComplete="new-password" spellCheck={false} maxLength={4096} onChange={event => { invalidate(); setKeyChanged(event.currentTarget.value !== ''); }} /><span className="field-help">Leave blank to keep the stored key.</span></label>
+                    {keyMode === 'clear' && <p className="text-warn">Save changes to remove the stored key. Key removal is not a connection test.</p>}
+                    {draft.GEOIP_MOJO_PROVIDER_URL.replace(/\/$/, '') !== state.geoip.GEOIP_MOJO_PROVIDER_URL.replace(/\/$/, '') && <p className="text-warn">Switching to MojoVerify requires a replacement key. The stored key will not be sent to a different service.</p>}
+                </div>
+                <div className="geo-admin-sharing"><label><input type="checkbox" checked={draft.GEOIP_MOJO_SYNC_ENABLED} onChange={e => change('GEOIP_MOJO_SYNC_ENABLED', e.target.checked)} /> Share threat signals with MojoVerify</label>{help('threat-signal sharing', <>{meta('GEOIP_MOJO_SYNC_ENABLED')?.description} The remote key needs the geoip_sync permission. Sharing uses MojoVerify regardless of the primary provider.</>)}</div>
+            </fieldset></div>
+            {options.some(p => !state.geoip_providers.includes(p)) && <p className="geo-admin-context dim">Unavailable provider IDs are retained from your configuration. They cannot be verified against the current registry; review them before saving.</p>}
+            {verdict && <div className={`geo-admin-result ${verdict.success && verdict.code !== 'clear_requested' ? 'text-ok' : 'text-warn'}`} role="status" aria-label="Draft MojoVerify key test"><strong>{verdict.success && verdict.code !== 'clear_requested' ? 'Draft MojoVerify key verified' : 'Draft MojoVerify key not verified'}</strong><p>{verdict.message}</p>{verdict.code && <code>{verdict.code}</code>}{!verdict.success && <p>Supply a replacement key, or apply pending configuration in Fleet Configuration and refresh here.</p>}</div>}
+            {keyMode !== 'clear' && <p className={`geo-admin-context ${draft.GEOIP_PRIMARY_PROVIDER !== 'mojo' && !state.geoip.GEOIP_API_KEY_MOJO_CONFIGURED && !keyChanged ? 'text-warn' : 'dim'}`}>{draft.GEOIP_PRIMARY_PROVIDER !== 'mojo' && !state.geoip.GEOIP_API_KEY_MOJO_CONFIGURED && !keyChanged ? 'Saving also checks MojoVerify. Add its key before saving, or the backend may reject this change.' : 'Saving also checks the MojoVerify key.'}</p>}
+            <footer className="geo-admin-footer"><span className="dim" role="status">{dirty ? 'Unsaved changes' : 'No unsaved changes'}</span><div className="geo-admin-actions"><button className="btn" disabled={busy || loading || !dirty} onClick={discard}>Discard changes</button><button className="btn btn-primary" disabled={disabled || !!block || !dirty} onClick={() => void run('save')}>{busy ? 'Working…' : 'Save changes'}</button></div></footer>
+        </section>
+        <section className="panel geo-admin-status" aria-label="Stored configuration status"><div className="geo-admin-status-heading"><div className="geo-admin-key-heading"><h2>Last stored check</h2>{help('last stored check', 'This historical MojoVerify result is separate from your current draft and Fleet activation. A successful key check does not prove the provider chain or every node is healthy.')}</div><button className="btn" onClick={details}>Configuration information</button></div><p><strong>MojoVerify:</strong> {stored ? stored.ok && stored.code !== 'clear_requested' ? 'Verified' : stored.code === 'clear_requested' ? 'Key removal requested; not tested' : 'Failed' : 'Not checked'}{storedDate && <> · <time dateTime={storedDate.toISOString()}>{storedDate.toLocaleString()}</time></>}</p>{(blocked || loading) && <p className="text-warn">Earlier observations are not current confirmation. Refresh to check the configuration.</p>}<div className="geo-admin-activation">{state.pending_restart ? <span className="text-warn">Activation pending on this request node.</span> : <span className="dim">Review application and node health in Fleet.</span>}<Link to={fleetConfigurationPath ?? geoFleetRoute(location.pathname)} aria-disabled={busy || loading} onClick={event => { if (event.button !== 0 || event.metaKey || event.ctrlKey || event.shiftKey || event.altKey) return; event.preventDefault(); void openFleet(); }}>Open Fleet Configuration</Link></div></section></>}
+    </div>;
+}

package/src/admin/geolocation/data.ts

@@ -0,0 +1,138 @@
+/** Private GeoLocation protocol. Raw credentials never enter Query/Mutation state. */
+import { mojoCall, MojoError } from '../../client/runtime';
+import { OperatorError, operatorOrigin, type PrivateScope } from '../fleet-configuration/shared-validation-data';
+
+export const GEOLOCATION_ENDPOINT = '/api/account/admin/settings';
+export const GEOLOCATION_KEYS = ['GEOIP_PRIMARY_PROVIDER', 'GEOIP_FALLBACK_PROVIDER', 'GEOIP_ADDITIONAL_PROVIDERS', 'GEOIP_MOJO_PROVIDER_URL', 'GEOIP_MOJO_SYNC_ENABLED'] as const;
+export interface GeoDraft {
+    GEOIP_PRIMARY_PROVIDER: string;
+    GEOIP_FALLBACK_PROVIDER: string;
+    GEOIP_ADDITIONAL_PROVIDERS: string[];
+    GEOIP_MOJO_PROVIDER_URL: string;
+    GEOIP_MOJO_SYNC_ENABLED: boolean;
+}
+export interface GeoVerdict { success: boolean; code: string | null; message: string }
+export interface StoredGeoVerification { ok: boolean; code: string | null; message: string; at: string }
+export interface GeoField { key: string; label: string; description: string; value_type: string; constraints: string }
+export interface GeoLocationState {
+    available: boolean; bucket_configured: boolean; restart_configured: boolean; pending_restart: boolean;
+    object_key: string; delegated_keys: string[]; geoip_providers: string[]; fleet_fields: GeoField[];
+    loaded_revision: string | null; published_revision: string | null; configuration_revision: string | null;
+    published_version: string | null; remote_error: string | null;
+    geoip: GeoDraft & { GEOIP_API_KEY_MOJO_CONFIGURED: boolean; GEOIP_API_KEY_MOJO_HINT: string };
+    verify_state: { geoip?: StoredGeoVerification };
+}
+export interface GeoPublication { published: boolean; unchanged: boolean; topic: 'geoip'; revision: string; published_revision: string | null; version_id: string | null; pending_restart: boolean; results: { geoip: GeoVerdict } }
+export type GeoKeyEdit = { mode: 'untouched' } | { mode: 'replace'; value: string } | { mode: 'clear'; confirmed: true };
+export class GeoLocationError extends Error {
+    constructor(public kind: 'invalid' | 'validation' | 'unsupported' | 'denied' | 'fresh' | 'conflict' | 'unavailable' | 'uncertain', message?: string) {
+        super(message ?? ({ invalid: 'GeoLocation returned an incompatible response. Refresh before continuing.', validation: 'Check the provider settings and try again.', unsupported: 'This backend does not support GeoLocation provider setup.', denied: 'GeoLocation requires a current interactive superuser session.', fresh: 'Authenticate again, then Refresh and deliberately retry. The action was not replayed.', conflict: 'Provider configuration changed; reload before publishing. Refresh and review the configuration.', unavailable: 'GeoLocation could not be read. Refresh before continuing.', uncertain: 'The save may have persisted. Refresh authoritative configuration before another attempt.' }[kind]));
+    }
+}
+const invalid = (): never => { throw new GeoLocationError('invalid'); };
+const object = (v: unknown): Record<string, unknown> => v !== null && typeof v === 'object' && !Array.isArray(v) ? v as Record<string, unknown> : invalid();
+const text = (v: unknown, max = 512): string => typeof v === 'string' && v.length <= max && !/[\x00-\x1f\x7f]/.test(v) ? v : invalid();
+const flag = (v: unknown): boolean => typeof v === 'boolean' ? v : invalid();
+const list = (v: unknown, max = 128): unknown[] => Array.isArray(v) && v.length <= max ? v : invalid();
+const nullable = <T>(v: unknown, parse: (v: unknown) => T): T | null => v === null ? null : parse(v);
+export const geoRevision = (v: unknown): string => typeof v === 'string' && /^[a-f0-9]{32,64}$/.test(v) ? v : invalid();
+export const geoProvider = (v: unknown): string => typeof v === 'string' && /^[a-z][a-z0-9_-]{0,31}$/.test(v) ? v : invalid();
+export function geoOrigin(v: unknown): string {
+    const value = text(v);
+    try {
+        const u = new URL(value);
+        if (value.trim() !== value || /[?#]/.test(value) || u.protocol !== 'https:' || !u.hostname || u.username || u.password || u.search || u.hash || !['', '/'].includes(u.pathname) || u.port && u.port !== '443') invalid();
+        // Match backend normalization: retain an explicitly supplied :443, remove only slash.
+        return value.replace(/\/$/, '');
+    } catch { return invalid(); }
+}
+export function geoDraft(value: GeoDraft): GeoDraft {
+    const additional = list(value.GEOIP_ADDITIONAL_PROVIDERS, 16).map(geoProvider);
+    if (new Set(additional).size !== additional.length) invalid();
+    return { GEOIP_PRIMARY_PROVIDER: geoProvider(value.GEOIP_PRIMARY_PROVIDER), GEOIP_FALLBACK_PROVIDER: geoProvider(value.GEOIP_FALLBACK_PROVIDER), GEOIP_ADDITIONAL_PROVIDERS: [...additional], GEOIP_MOJO_PROVIDER_URL: geoOrigin(value.GEOIP_MOJO_PROVIDER_URL), GEOIP_MOJO_SYNC_ENABLED: flag(value.GEOIP_MOJO_SYNC_ENABLED) };
+}
+/** Positive projection discards the catalog, SMS, credentials, and every unknown field. */
+export function parseGeoLocation(value: unknown): GeoLocationState {
+    const root = object(value); if (root.schema_version !== 1 || root.provider_setup == null) throw new GeoLocationError('unsupported');
+    const r = object(root.provider_setup), g = object(r.geoip), verify = object(r.verify_state);
+    const fields = list(r.fleet_fields).map(value => { const f = object(value); return { key: text(f.key, 80), label: text(f.label, 200), description: text(f.description, 2000), value_type: text(f.value_type, 32), constraints: text(f.constraints, 500) }; });
+    if (new Set(fields.map(f => f.key)).size !== fields.length) invalid();
+    const hint = text(g.GEOIP_API_KEY_MOJO_HINT, 4); if (hint !== '' && hint.length !== 4) invalid();
+    const stored = verify.geoip == null ? undefined : object(verify.geoip);
+    return { available: flag(r.available), bucket_configured: flag(r.bucket_configured), restart_configured: flag(r.restart_configured), pending_restart: flag(r.pending_restart),
+        object_key: text(r.object_key, 1024), delegated_keys: list(r.delegated_keys, 1024).map(v => text(v, 100)), geoip_providers: list(r.geoip_providers).map(geoProvider), fleet_fields: fields,
+        loaded_revision: nullable(r.loaded_revision, geoRevision), published_revision: nullable(r.published_revision, geoRevision), configuration_revision: nullable(r.configuration_revision, geoRevision),
+        published_version: nullable(r.published_version, v => text(v, 1024)), remote_error: nullable(r.remote_error, v => text(v, 200)),
+        geoip: { ...geoDraft(g as unknown as GeoDraft), GEOIP_API_KEY_MOJO_CONFIGURED: flag(g.GEOIP_API_KEY_MOJO_CONFIGURED), GEOIP_API_KEY_MOJO_HINT: hint },
+        verify_state: stored ? { geoip: { ok: flag(stored.ok), code: nullable(stored.code, v => text(v, 64)), message: text(stored.message, 200), at: text(stored.at, 40) } } : {},
+    };
+}
+/** Credential diagnostics need the provider schema, independently of Fleet publishing. */
+export function geoTestBlock(state: GeoLocationState): string | null {
+    const types = ['string', 'string', 'list', 'origin', 'boolean'];
+    if (!GEOLOCATION_KEYS.every((key, i) => state.delegated_keys.includes(key) && state.fleet_fields.some(f => f.key === key && f.value_type === types[i]))) return 'All five GeoIP fields must be registered and delegated before provider setup can change.';
+    return null;
+}
+export function geoWriteBlock(state: GeoLocationState): string | null {
+    if (state.remote_error) return 'The published configuration could not be read. Resolve the remote read failure and Refresh.';
+    const schema = geoTestBlock(state); if (schema) return schema;
+    if (!state.available || !state.bucket_configured || !state.restart_configured || !state.object_key) return 'Fleet publishing is unavailable. Configure its exact bucket and object, all provider delegations, KMS encryption and config-sync restart in deployment settings.';
+    return null;
+}
+const providerLabels: Record<string, string> = { mojo: 'MojoVerify', ipinfo: 'IPinfo', ipstack: 'IPstack', 'ip-api': 'IP-API', maxmind: 'MaxMind' };
+export const geoProviderLabel = (provider: string): string => providerLabels[provider] ?? provider;
+export function geoProviderOptions(state: GeoLocationState, draft: GeoDraft): string[] {
+    return [...new Set([...state.geoip_providers, draft.GEOIP_PRIMARY_PROVIDER, draft.GEOIP_FALLBACK_PROVIDER, ...draft.GEOIP_ADDITIONAL_PROVIDERS])];
+}
+export function buildGeoPayload(action: 'test_providers' | 'configure_providers', revision: string | null, draft: GeoDraft, edit: GeoKeyEdit = { mode: 'untouched' }): Record<string, unknown> {
+    nullable(revision, geoRevision);
+    let geoip: GeoDraft & { GEOIP_API_KEY_MOJO?: string; clear_api_key?: true };
+    try { geoip = geoDraft(draft); } catch { throw new GeoLocationError('validation', 'Use valid provider identifiers, up to 16 unique additional providers, and one HTTPS origin without a path, query, fragment or alternate port.'); }
+    if (edit.mode === 'replace') {
+        if (typeof edit.value !== 'string' || edit.value.length > 4096) throw new GeoLocationError('validation', 'The replacement key must be at most 4096 characters.');
+        if (edit.value !== '') geoip.GEOIP_API_KEY_MOJO = edit.value;
+    } else if (edit.mode === 'clear') {
+        if (edit.confirmed !== true) throw new GeoLocationError('validation', 'Confirm key removal first.');
+        geoip.clear_api_key = true;
+    }
+    return { action, topic: 'geoip', providers: { expected_revision: revision, geoip } };
+}
+export function parseGeoVerdict(value: unknown): GeoVerdict { const r = object(value); return { success: flag(r.success), code: nullable(r.code, v => text(v, 64)), message: text(r.message, 200) }; }
+export function parseGeoTest(value: unknown): GeoVerdict {
+    const r = object(value); if (r.tested !== true || r.topic !== 'geoip') invalid();
+    const result = parseGeoVerdict(object(r.results).geoip); if (flag(r.success) !== result.success) invalid(); return result;
+}
+export function parseGeoPublication(value: unknown): GeoPublication {
+    const r = object(value); if (r.topic !== 'geoip') invalid();
+    const out: GeoPublication = { published: flag(r.published), unchanged: flag(r.unchanged), topic: 'geoip', revision: geoRevision(r.revision), published_revision: nullable(r.published_revision, geoRevision), version_id: nullable(r.version_id, v => text(v, 1024)), pending_restart: flag(r.pending_restart), results: { geoip: parseGeoVerdict(object(r.results).geoip) } };
+    if (out.published === out.unchanged || !out.results.geoip.success || out.published && (!out.pending_restart || out.published_revision !== out.revision)) invalid();
+    return out;
+}
+async function geoCall(body: Record<string, unknown> | null, scope: PrivateScope = {}): Promise<unknown> {
+    try {
+        if (body) operatorOrigin();
+        const reply = await mojoCall(GEOLOCATION_ENDPOINT, { ...(body ? { method: 'POST', body, refusal: 'return' } as const : {}), signal: scope.signal, beforeSend: () => { if (body) operatorOrigin(); scope.beforeSend?.(); } });
+        scope.beforeSend?.();
+        return reply.data ?? reply;
+    } catch (reason) {
+        if (reason instanceof GeoLocationError) throw reason;
+        if (reason instanceof OperatorError && reason.kind === 'denied') throw new GeoLocationError('denied');
+        if (scope.signal?.aborted) throw new GeoLocationError('denied');
+        if (reason instanceof MojoError) {
+            if (reason.status === 440) throw new GeoLocationError('fresh');
+            if ([401, 403].includes(reason.status)) throw new GeoLocationError('denied');
+            if ([404, 405].includes(reason.status)) throw new GeoLocationError('unsupported');
+            if (reason.status === 409 || reason.status === 400 && /changed; reload before publishing/i.test(reason.message)) throw new GeoLocationError('conflict');
+            if (reason.status === 400) throw new GeoLocationError('validation', 'The server rejected the provider settings or credential. Check the MojoVerify key. Pending service configuration may need Fleet Configuration applied first, or a replacement key.');
+        }
+        throw new GeoLocationError(body?.action === 'configure_providers' ? 'uncertain' : 'unavailable');
+    } finally {
+        // The only raw-bearing object has a deliberately short lifetime, including rejected calls.
+        if (body) delete ((body.providers as { geoip: Record<string, unknown> }).geoip).GEOIP_API_KEY_MOJO;
+    }
+}
+export const readGeoLocation = async (scope?: PrivateScope): Promise<GeoLocationState> => parseGeoLocation(await geoCall(null, scope));
+export const testGeoLocation = async (revision: string | null, draft: GeoDraft, edit?: GeoKeyEdit, scope?: PrivateScope): Promise<GeoVerdict> => parseGeoTest(await geoCall(buildGeoPayload('test_providers', revision, draft, edit), scope));
+export const saveGeoLocation = async (revision: string | null, draft: GeoDraft, edit?: GeoKeyEdit, scope?: PrivateScope): Promise<GeoPublication> => parseGeoPublication(await geoCall(buildGeoPayload('configure_providers', revision, draft, edit), scope));
+/** Mount-relative sibling destination, including an embedded Admin prefix. */
+export const geoFleetRoute = (pathname: string): string => pathname.replace(/\/geolocation\/?$/, '/fleet-configuration');

package/src/admin/geolocation/index.ts

@@ -0,0 +1,3 @@
+export { GeoLocationPage } from './GeoLocationPage';
+export { GEOLOCATION_ENDPOINT, GEOLOCATION_KEYS, GeoLocationError, parseGeoLocation, geoDraft, geoProviderOptions, geoWriteBlock, geoFleetRoute, buildGeoPayload, parseGeoTest, parseGeoPublication, readGeoLocation, testGeoLocation, saveGeoLocation } from './data';
+export type { GeoDraft, GeoField, GeoKeyEdit, GeoLocationState, GeoVerdict, GeoPublication, StoredGeoVerification } from './data';

package/src/admin/identity/members/GroupMembersPanel.tsx

@@ -1,3 +1,4 @@
+import { ComboBox } from '../../../ui/ComboBox';
 import { useEffect, useState } from 'react';
 import { useQueryClient } from '@tanstack/react-query';
 import { useCan, type Params } from '../../../client/runtime';
@@ -135,14 +136,7 @@ export function GroupMembersPanel({
                     className="input" type="search" placeholder="Search members…"
                     value={search} onChange={(event) => setSearch(event.target.value)}
                 />
-                <select
-                    className="input input-compact" value={status} aria-label="Status filter"
-                    onChange={(event) => setStatus(event.target.value as StatusFilter)}
-                >
-                    <option value="active">Active</option>
-                    <option value="inactive">Inactive</option>
-                    <option value="all">All</option>
-                </select>
+                <ComboBox allowCustom={false} maxSuggestions={Number.MAX_SAFE_INTEGER} value={String(status)} aria-label="Status filter" onChange={(selectedValue) => setStatus(String(selectedValue) as StatusFilter)} options={[({ value: "active", label: "Active" }), ({ value: "inactive", label: "Inactive" }), ({ value: "all", label: "All" })]} />
             </div>
             {query.isPending && <div className="skel skel-block" />}
             {query.error && <p className="text-bad">{query.error.message}</p>}

package/src/admin/index.ts

@@ -26,3 +26,11 @@ export * from './assistant';
 export { ADMIN_SECTIONS } from './registry';
 export { FleetConfigurationPage, FleetNodeStatus } from './fleet-configuration/FleetConfigurationPage';
 export { FLEET_CONFIGURATION_ADMIN_SECTION } from './domains/operations';
+export * from './fleet';
+export * from './geolocation';
+export { FLEET_ADMIN_SECTION } from './domains/infrastructure';
+export { GEOLOCATION_ADMIN_SECTION } from './domains/operations';
+export * from './maintenance';
+export { MAINTENANCE_ADMIN_SECTION } from './domains/operations';
+export * from './deployments';
+export { DEPLOYMENTS_ADMIN_SECTION } from './domains/operations';

package/src/admin/maintenance/MaintenanceDialogs.tsx

@@ -0,0 +1,161 @@
+import { useEffect, useRef, useState } from 'react';
+import { frameworkActionLabel, type Finding, type Framework } from './data';
+import { datetime } from '../../ui/format';
+import { FleetHelp as MaintenanceHelp } from '../fleet/FleetHelp';
+import type { MaintenanceAttempt } from './operations';
+export function MaintenanceDialog({
+    finding,
+    framework,
+    busy,
+    onConfirm,
+    onClose,
+}: {
+    finding?: Finding;
+    framework?: Framework;
+    busy: boolean;
+    onConfirm: (immediate: boolean) => void;
+    onClose: () => void;
+}) {
+    const dialog = useRef<HTMLDialogElement>(null);
+    const [typed, setTyped] = useState(''),
+        [windowChoice, setWindowChoice] = useState<'now' | 'window' | ''>('');
+    const expected = finding?.resource_id ?? framework?.latest ?? '';
+    useEffect(() => {
+        const d = dialog.current;
+        d?.showModal();
+        return () => d?.close();
+    }, []);
+    return (
+        <dialog
+            ref={dialog}
+            className="maintenance-dialog"
+            aria-labelledby="maintenance-confirm-title"
+            onCancel={(e) => {
+                e.preventDefault();
+                if (!busy) onClose();
+            }}
+        >
+            <div className="maintenance-dialog-body">
+                <h2 id="maintenance-confirm-title">
+                    {finding
+                        ? `Upgrade ${finding.resource_id}?`
+                        : framework
+                          ? frameworkActionLabel(framework)
+                          : 'Review update'}
+                </h2>
+                <div className="maintenance-dialog-scroll">
+                <p>
+                    {finding
+                        ? `${finding.engine}: ${finding.current_version} → ${finding.available_major}`
+                        : `Installed ${framework?.installed ?? 'unknown'} → ${framework?.latest ?? 'unknown'}`}
+                </p>
+                <p className="maintenance-warning">
+                    {finding
+                        ? finding.kind === 'elasticache'
+                            ? 'This restarts cache nodes. Clients reconnect and cached data may be lost. A major upgrade cannot be undone; recovery means restoring a snapshot.'
+                            : 'The database goes offline during the engine upgrade. Multi-AZ may fail over; a single instance is unavailable. A major upgrade cannot be undone; recovery means restoring a snapshot.'
+                        : 'This clears the current pin, restores automatic latest-version updates, and redeploys the last converged application SHA. Services restart as the canary migrates and the fleet rolls. Acceptance does not prove fleet completion.'}
+                </p>
+                {finding && (
+                    <fieldset disabled={busy}>
+                        <legend>Choose the outage window</legend>
+                        <label>
+                            <input
+                                type="radio"
+                                name="maintenance-window"
+                                checked={windowChoice === 'window'}
+                                onChange={() => setWindowChoice('window')}
+                            />{' '}
+                            Next maintenance window
+                        </label>
+                        <label>
+                            <input
+                                type="radio"
+                                name="maintenance-window"
+                                checked={windowChoice === 'now'}
+                                onChange={() => setWindowChoice('now')}
+                            />{' '}
+                            Immediately
+                        </label>
+                    </fieldset>
+                )}
+                <label className="maintenance-confirm-label">
+                    Type {expected} to confirm
+                    <input
+                        autoFocus
+                        autoComplete="off"
+                        value={typed}
+                        disabled={busy}
+                        onChange={(e) => setTyped(e.target.value)}
+                    />
+                </label>
+                </div>
+                <div className="maintenance-actions">
+                    <button className="btn" disabled={busy} onClick={onClose}>
+                        Cancel
+                    </button>
+                    <button
+                        className="btn btn-danger"
+                        disabled={busy || typed !== expected || !expected || (!!finding && !windowChoice)}
+                        onClick={() => onConfirm(windowChoice === 'now')}
+                    >
+                        {busy ? 'Requesting…' : finding ? 'Apply upgrade' : 'Confirm framework update'}
+                    </button>
+                </div>
+            </div>
+        </dialog>
+    );
+}
+
+export function MaintenancePolicyDialog({ framework, busy, error, onSave, onClose }: {
+    framework: Framework; busy: boolean; error: string; onSave: (value: string) => void; onClose: () => void;
+}) {
+    const dialog = useRef<HTMLDialogElement>(null);
+    const [mode, setMode] = useState(framework.pin.mode);
+    const [version, setVersion] = useState(framework.pin.mode === 'pinned' ? framework.pin.value ?? '' : framework.installed ?? '');
+    const value = mode === 'latest' ? '' : mode === 'hold' ? 'hold' : version.trim().toLowerCase();
+    const valid = mode !== 'pinned' || /^[0-9][a-z0-9._!+-]{0,63}$/.test(value);
+    const unchanged = mode === framework.pin.mode && (mode !== 'pinned' || value === framework.pin.value);
+    useEffect(() => { const d = dialog.current; d?.showModal(); return () => d?.close(); }, []);
+    return <dialog ref={dialog} className="maintenance-dialog" aria-labelledby="maintenance-policy-title" onCancel={e => { e.preventDefault(); if (!busy) onClose(); }}>
+        <div className="maintenance-dialog-body"><h2 id="maintenance-policy-title">Framework update policy</h2>
+            <div className="maintenance-dialog-scroll">
+                <p>This saves policy only. Nodes change on a later deployment.</p>
+                <fieldset disabled={busy}><legend>Version policy</legend>
+                    <label><input type="radio" name="framework-policy" checked={mode === 'latest'} onChange={() => setMode('latest')} /> Automatic</label>
+                    <label><input type="radio" name="framework-policy" checked={mode === 'hold'} onChange={() => setMode('hold')} /> Hold</label>
+                    <label><input type="radio" name="framework-policy" checked={mode === 'pinned'} onChange={() => setMode('pinned')} /> Exact version</label>
+                </fieldset>
+                {mode === 'pinned' && <label className="field"><span className="field-label">Version</span><input className="input" disabled={busy} value={version} onChange={e => setVersion(e.target.value)} autoComplete="off" placeholder="1.39.6" /></label>}
+                <p className="dim">{mode === 'latest' ? 'Each deployment installs the newest published release.' : mode === 'hold' ? 'Keep the framework version from the last converged deployment.' : 'Each deployment installs this exact version.'} <MaintenanceHelp label="framework policy"><p>Hold requires a last converged framework version. Exact version checks syntax here; release availability is checked during deployment.</p><p>The separate framework Update action clears Hold or Exact and deploys the latest published version.</p></MaintenanceHelp></p>
+                {error && <p role="alert" className="form-alert">{error}</p>}
+            </div>
+            <div className="maintenance-actions"><button className="btn" disabled={busy} onClick={onClose}>Cancel</button><button className="btn btn-primary" disabled={busy || !valid || unchanged} onClick={() => onSave(value)}>{busy ? 'Saving…' : 'Save policy'}</button></div>
+        </div>
+    </dialog>;
+}
+export function MaintenanceProgressDialog({ attempt, busy, onObserve, onClose, deploymentsHref }: {
+    attempt: MaintenanceAttempt; busy: boolean; onObserve: () => void; onClose: () => void; deploymentsHref?: string;
+}) {
+    const dialog = useRef<HTMLDialogElement>(null);
+    useEffect(() => { const d = dialog.current; d?.showModal(); return () => d?.close(); }, []);
+    const resource = 'kind' in attempt.input ? attempt.input : null;
+    const target = resource?.target_version ?? ('version' in attempt.input ? attempt.input.version : 'policy' in attempt.input ? attempt.input.policy || 'Automatic' : '');
+    const observation = attempt.observation;
+    return <dialog ref={dialog} className="maintenance-dialog" aria-labelledby="maintenance-progress-title" onCancel={e => { e.preventDefault(); if (!busy) onClose(); }}>
+        <div className="maintenance-dialog-body"><h2 id="maintenance-progress-title">Update progress</h2>
+            <div className="maintenance-dialog-scroll">
+                <strong>{resource?.resource ?? ('policy' in attempt.input ? 'Framework policy' : 'Django-MOJO')}</strong>
+                <p role="status">{attempt.message}</p>
+                <dl className="maintenance-progress-facts"><dt>Target</dt><dd>{target}</dd>{resource && <><dt>When</dt><dd>{resource.apply_immediately ? 'Immediately' : 'Next configured AWS window'}</dd></>}<dt>Last observation</dt><dd>{attempt.observedAt ? datetime(attempt.observedAt) : 'Not observed yet'}</dd></dl>
+                {observation && <><p>{observation.found ? `${observation.status ?? 'Status unknown'} · ${observation.engine_version ?? 'Version unknown'}` : 'Resource not found — outcome remains unconfirmed.'}</p>{observation.pending_version && <p>Pending version: {observation.pending_version}</p>}<p className="dim">Observed versions: {observation.engine_versions.join(', ') || 'Unknown'} · {observation.settled ? 'Provider settled' : 'Still changing'}</p></>}
+                {attempt.deployment && <p className="dim">Deployment {attempt.deployment.id}</p>}
+                {attempt.frameworkObservation?.nodes.map(node => <p key={node.runner}>{node.runner} · {node.state} · {node.version ?? 'Version unreported'}</p>)}
+                {'version' in attempt.input && !attempt.deployment && <p className="maintenance-warning">Deployment acceptance is unknown. Reconcile server deployment logs; a matching version or latest deployment cannot identify this request.</p>}
+                <p className="dim">Closing this dialog does not cancel submitted work. <MaintenanceHelp label="update recovery"><p>Unknown outcomes stay guarded. Refresh only reads evidence and never resends a write. Receipts survive navigation in this document, but a full browser reload loses them.</p>{resource?.kind === 'rds-cluster' && <p>Aurora reports cluster-level settlement; individual database member proof is unavailable here.</p>}</MaintenanceHelp></p>
+                {deploymentsHref && 'version' in attempt.input && <a href={deploymentsHref}>Open Deployments</a>}
+            </div>
+            <div className="maintenance-actions"><button className="btn" disabled={busy} onClick={onClose}>Close</button>{attempt.state !== 'complete' && attempt.state !== 'refused' && (!('version' in attempt.input) || !!attempt.deployment) && <button className="btn btn-primary" disabled={busy || attempt.state === 'sending'} onClick={onObserve}>{busy ? 'Observing…' : 'Refresh status'}</button>}</div>
+        </div>
+    </dialog>;
+}