portal-mojo 0.2.3 → 0.2.5

package/src/client/mock.ts

@@ -1,3 +1,4 @@
+import { fleetMock } from './fleet-mock';
 // In-memory django-mojo mock. Speaks the EXACT wire contract the real client
 // uses — envelope {status, data|rows..., message}, start/size paging, sort
 // with '-' prefix, search, and Django-style lookups (field, field__in,
@@ -4287,6 +4288,11 @@ const db = {
     // The scheduler lock, as `control/force-scheduler-lead` sees it: a Redis
     // string key whose VALUE is the holder. Deleting it is the whole control.
     jobsSchedulerLock: 'runner-mojo-web-01-engine' as string | null,
+    // System Sign-in admin (#5547): the SYSTEM auth_config override (nested,
+    // layered after the deployment file) and OAuth credentials stored in the
+    // Admin. Apple is seeded half-configured; Google has nothing stored.
+    systemAuthConfig: {} as Record<string, unknown>,
+    signinCredentials: { APPLE_TEAM_ID: 'ABCDE12345', APPLE_CLIENT_ID: 'com.example.web' } as Record<string, string>,
     // Per-user login throttle counters (auth/manage/throttle shape). u3 is
     // mid-lockout so the header badge + Clear Rate Limit are demoable.
     throttle: new Map<number, { count: number; limit: number; window: number; retry_after_seconds: number }>([
@@ -4652,16 +4658,20 @@ const LOGIN_METHODS = new Set(['password', 'sms', 'passkey', 'magic', 'google',
 const REGISTRATION_METHODS = new Set(['password', 'google', 'apple', 'github']);
 const DEFAULT_AUTH_CONFIG: Record<string, unknown> = {
     theme: {
-        app_title: 'DJANGO MOJO', logo_url: '', favicon_url: '', hero_image_url: '',
-        hero_headline: 'Welcome back', hero_subheadline: 'Admin Portal',
-        back_to_website_url: '', terms_url: '', layout: 'card', api_base: '',
+        app_title: 'DJANGO MOJO', auth_provider_name: 'DJANGO MOJO', logo_url: '', favicon_url: '', hero_image_url: '',
+        hero_image_url_light: '', hero_image_url_dark: '',
+        hero_headline: 'Welcome back', hero_subheadline: 'Admin Portal', hero_image_position: 'center',
+        back_to_website_url: '', back_to_website_label: 'Back to website', terms_url: '',
+        // Legacy token kept for the group dialog's card/fullscreen editor; the
+        // system Sign-in admin reads it through SIGNIN_LAYOUT_ALIASES.
+        layout: 'card', appearance: 'system', accent_color: '#6384ff', api_base: '',
         success_redirect: '/', custom_css: '', custom_css_url: '',
     },
     registration: {
         enabled: true, fields: null, extra_fields: [], identity_field: '', min_age: null,
         methods: ['password', 'google', 'apple', 'github'], passkey_prompt: 'off',
     },
-    login: { methods: ['password', 'sms', 'passkey', 'magic', 'google', 'apple', 'github'] },
+    login: { methods: ['password', 'sms', 'passkey', 'magic', 'google', 'apple', 'github'], heading: 'Sign In', supporting_copy: '' },
 };
 const DEPLOYMENT_AUTH_CONFIG: Record<string, unknown> = {
     theme: { hero_subheadline: 'NativeMojo identity', terms_url: 'https://example.com/terms' },
@@ -4735,7 +4745,9 @@ function mockGroupChoiceInteger(value: unknown, fallback: number, minimum: numbe
 }
 
 function resolveAuthConfig(group?: MockGroup): Record<string, unknown> {
-    let config = mergeDicts(DEFAULT_AUTH_CONFIG, DEPLOYMENT_AUTH_CONFIG);
+    // The system Sign-in admin (#5547) stores its overrides between the
+    // deployment file and the group chain, so /api/auth/config reflects saves.
+    let config = mergeDicts(mergeDicts(DEFAULT_AUTH_CONFIG, DEPLOYMENT_AUTH_CONFIG), db.systemAuthConfig);
     if (group) {
         const chain: MockGroup[] = [];
         let current: MockGroup | undefined = group;
@@ -4769,10 +4781,194 @@ function publicAuthConfig(config: Record<string, unknown>): Record<string, unkno
             methods: Array.isArray(registration.methods) ? registration.methods : [],
             passkey_prompt: registration.passkey_prompt ?? 'off',
         },
-        login: { methods: Array.isArray(login.methods) ? login.methods : [] },
+        login: {
+            methods: Array.isArray(login.methods) ? login.methods : [],
+            heading: login.heading ?? 'Sign In',
+            supporting_copy: login.supporting_copy ?? '',
+        },
     };
 }
 
+// ══ System Sign-in admin (#5547) — GET/POST /api/account/admin/signin ══
+
+const SIGNIN_EDITABLE = [
+    'login.heading', 'login.methods', 'login.supporting_copy',
+    'registration.enabled', 'registration.methods', 'registration.passkey_prompt',
+    'theme.accent_color', 'theme.app_title', 'theme.appearance', 'theme.auth_provider_name',
+    'theme.back_to_website_label', 'theme.custom_css', 'theme.favicon_url', 'theme.hero_headline',
+    'theme.hero_image_position', 'theme.hero_image_url', 'theme.hero_image_url_dark',
+    'theme.hero_image_url_light', 'theme.hero_subheadline', 'theme.layout', 'theme.logo_url',
+];
+const SIGNIN_OPTIONS = {
+    login_methods: ['password', 'sms', 'passkey', 'magic', 'google', 'apple', 'github'],
+    registration_methods: ['password', 'google', 'apple', 'github'],
+    layouts: ['minimal', 'compact', 'branded-panel', 'editorial'],
+    appearances: ['light', 'dark', 'system'],
+    hero_image_positions: ['center', 'top', 'bottom', 'left', 'right'],
+    passkey_prompts: ['off', 'optional', 'required'],
+};
+const SIGNIN_LAYOUT_ALIASES: Record<string, string> = { card: 'compact', fullscreen: 'branded-panel' };
+const SIGNIN_API_ORIGIN = 'https://api.example.com';
+/** Values from the server config file — GitHub is configured there. */
+const SIGNIN_DEPLOYMENT_CREDENTIALS: Record<string, string> = {
+    GITHUB_CLIENT_ID: 'Iv1.8a61f9b3a7aba766',
+    GITHUB_CLIENT_SECRET: 'deployment-github-secret-9f2c',
+};
+interface SigninFieldSpec { key: string; label: string; secret: boolean; multiline: boolean }
+const SIGNIN_PROVIDERS: Array<{ name: string; label: string; console_url: string; help: string; fields: SigninFieldSpec[] }> = [
+    {
+        name: 'google', label: 'Google',
+        console_url: 'https://console.cloud.google.com/apis/credentials',
+        help: 'Create an OAuth client ID (type "Web application") in Google Cloud and add the callback URL below as an authorized redirect URI.',
+        fields: [
+            { key: 'GOOGLE_CLIENT_ID', label: 'Client ID', secret: false, multiline: false },
+            { key: 'GOOGLE_CLIENT_SECRET', label: 'Client secret', secret: true, multiline: false },
+        ],
+    },
+    {
+        name: 'apple', label: 'Apple',
+        console_url: 'https://developer.apple.com/account/resources/identifiers/list/serviceId',
+        help: 'Create a Services ID with Sign in with Apple enabled, register the callback URL as a return URL, then create a key and paste its .p8 contents.',
+        fields: [
+            { key: 'APPLE_TEAM_ID', label: 'Team ID', secret: false, multiline: false },
+            { key: 'APPLE_CLIENT_ID', label: 'Services ID', secret: false, multiline: false },
+            { key: 'APPLE_KEY_ID', label: 'Key ID', secret: false, multiline: false },
+            { key: 'APPLE_PRIVATE_KEY', label: 'Private key (.p8)', secret: true, multiline: true },
+        ],
+    },
+    {
+        name: 'github', label: 'GitHub',
+        console_url: 'https://github.com/settings/developers',
+        help: 'Register a new OAuth App in GitHub developer settings and use the callback URL below as its authorization callback URL.',
+        fields: [
+            { key: 'GITHUB_CLIENT_ID', label: 'Client ID', secret: false, multiline: false },
+            { key: 'GITHUB_CLIENT_SECRET', label: 'Client secret', secret: true, multiline: false },
+        ],
+    },
+];
+
+function signinPayload(): Record<string, unknown> {
+    const auth = publicAuthConfig(resolveAuthConfig());
+    const theme = auth.theme as Record<string, unknown>;
+    const layout = String(theme.layout ?? '');
+    theme.layout = SIGNIN_LAYOUT_ALIASES[layout] ?? (SIGNIN_OPTIONS.layouts.includes(layout) ? layout : 'minimal');
+    const loginMethods = (auth.login as { methods: string[] }).methods;
+    const providers = SIGNIN_PROVIDERS.map((provider) => {
+        const fields = provider.fields.map((field) => {
+            const stored = db.signinCredentials[field.key];
+            const deployed = SIGNIN_DEPLOYMENT_CREDENTIALS[field.key];
+            const value = stored ?? deployed;
+            const source = stored != null ? 'admin' : deployed != null ? 'deployment' : 'none';
+            return {
+                key: field.key, label: field.label, secret: field.secret, multiline: field.multiline,
+                configured: value != null, source,
+                value: field.secret || value == null ? null : value,
+                hint: field.secret && value != null ? `…${value.replace(/-----[A-Z ]+-----/g, '').replace(/\s+/g, '').slice(-4)}` : null,
+            };
+        });
+        const missing = fields.filter((field) => !field.configured).map((field) => field.label);
+        return {
+            name: provider.name, label: provider.label,
+            enabled: loginMethods.includes(provider.name),
+            ready: missing.length === 0, missing,
+            callback_url: `${SIGNIN_API_ORIGIN}/api/auth/oauth/${provider.name}/callback`,
+            console_url: provider.console_url, help: provider.help, fields,
+        };
+    });
+    return { schema_version: 1, auth, editable: [...SIGNIN_EDITABLE], options: structuredClone(SIGNIN_OPTIONS), providers };
+}
+
+function signinBadRequest(error: string): Record<string, unknown> {
+    return { status: false, error, error_code: 400 };
+}
+
+function validateSigninAuthValue(path: string, value: unknown): string | null {
+    const oneOf = (allowed: string[]) => typeof value === 'string' && allowed.includes(value) ? null : `${path} must be one of: ${allowed.join(', ')}`;
+    const methods = (allowed: string[]) => {
+        if (!Array.isArray(value)) return `${path} must be a list`;
+        const unknown = value.find((method) => typeof method !== 'string' || !allowed.includes(method));
+        return unknown == null ? null : `${path} has an unknown method '${String(unknown)}'`;
+    };
+    switch (path) {
+        case 'theme.layout': return oneOf(SIGNIN_OPTIONS.layouts);
+        case 'theme.appearance': return oneOf(SIGNIN_OPTIONS.appearances);
+        case 'theme.hero_image_position': return oneOf(SIGNIN_OPTIONS.hero_image_positions);
+        case 'registration.passkey_prompt': return oneOf(SIGNIN_OPTIONS.passkey_prompts);
+        case 'registration.enabled': return typeof value === 'boolean' ? null : `${path} must be true or false`;
+        case 'registration.methods': return methods(SIGNIN_OPTIONS.registration_methods);
+        case 'login.methods': {
+            const error = methods(SIGNIN_OPTIONS.login_methods);
+            if (error) return error;
+            return (value as string[]).includes('password') ? null : 'Password sign-in must stay enabled so admins can always log in.';
+        }
+        case 'theme.accent_color': return typeof value === 'string' && /^#[0-9a-fA-F]{6}$/.test(value) ? null : `${path} must be a #rrggbb color`;
+        case 'theme.custom_css':
+            if (typeof value !== 'string') return `${path} must be a string`;
+            return value.includes('<') || value.toLowerCase().includes('@import') || value.includes('://') ? `${path} cannot reference external content` : null;
+        default: return typeof value === 'string' ? null : `${path} must be a string`;
+    }
+}
+
+function setSystemAuthPath(path: string, value: unknown): void {
+    const [section, key] = path.split('.') as [string, string];
+    const current = isPlainObject(db.systemAuthConfig[section]) ? { ...(db.systemAuthConfig[section] as Record<string, unknown>) } : {};
+    current[key] = Array.isArray(value) ? [...value] : value;
+    db.systemAuthConfig = { ...db.systemAuthConfig, [section]: current };
+}
+
+function signinFetch(method: string, body: Record<string, unknown>, headers: Record<string, string> | undefined): unknown {
+    const caller = userFromBearer(headers);
+    if (!caller) return permissionDenied(401);
+    if (!hasGlobalPermission(caller, ['manage_settings', 'admin'])) return permissionDenied();
+    if (method === 'GET') return { status: true, data: signinPayload() };
+    if (method !== 'POST') return { status: false, error: 'Method not allowed', error_code: 405 };
+
+    // Validate everything first so a rejected request changes nothing.
+    const authChanges: Array<[string, unknown]> = [];
+    if (body.auth != null) {
+        if (!isPlainObject(body.auth)) return signinBadRequest('auth must be an object of dotted paths');
+        for (const [path, value] of Object.entries(body.auth)) {
+            if (!SIGNIN_EDITABLE.includes(path)) return signinBadRequest(`${path} is not editable here`);
+            const error = validateSigninAuthValue(path, value);
+            if (error) return signinBadRequest(error);
+            authChanges.push([path, value]);
+        }
+    }
+    let provider: typeof SIGNIN_PROVIDERS[number] | undefined;
+    const credentialChanges: Array<[string, string | null]> = [];
+    if (body.provider != null) {
+        provider = SIGNIN_PROVIDERS.find((candidate) => candidate.name === body.provider);
+        if (!provider) return signinBadRequest(`Unknown provider '${String(body.provider)}'`);
+        if (body.values != null) {
+            if (!isPlainObject(body.values)) return signinBadRequest('values must be an object');
+            for (const [key, value] of Object.entries(body.values)) {
+                if (!provider.fields.some((field) => field.key === key)) return signinBadRequest(`${key} is not a ${provider.label} setting`);
+                if (value === undefined || value === '') continue;
+                if (value !== null && typeof value !== 'string') return signinBadRequest(`${key} must be a string or null`);
+                credentialChanges.push([key, value === null ? null : value.trim()]);
+            }
+        }
+        if (body.enabled != null && typeof body.enabled !== 'boolean') return signinBadRequest('enabled must be true or false');
+    } else if (body.values != null || body.enabled != null) {
+        return signinBadRequest('provider is required with values or enabled');
+    }
+
+    for (const [path, value] of authChanges) setSystemAuthPath(path, value);
+    for (const [key, value] of credentialChanges) {
+        if (value === null) delete db.signinCredentials[key];
+        else db.signinCredentials[key] = value;
+    }
+    if (provider && typeof body.enabled === 'boolean') {
+        const resolved = publicAuthConfig(resolveAuthConfig());
+        const toggle = (list: string[]) => body.enabled
+            ? (list.includes(provider!.name) ? list : [...list, provider!.name])
+            : list.filter((name) => name !== provider!.name);
+        setSystemAuthPath('login.methods', toggle((resolved.login as { methods: string[] }).methods));
+        setSystemAuthPath('registration.methods', toggle((resolved.registration as { methods: string[] }).methods));
+    }
+    return { status: true, data: signinPayload() };
+}
+
 // NO_SAVE_FIELDS parity (account/models/user.py RestMeta): silently dropped,
 // never an error — matching rest.py's strip. NOTE is_dob_verified IS in this
 // set live, which is why the portal ships no DOB force-verify affordance.
@@ -7600,10 +7796,10 @@ const PUSH_CONFIG_GRANTS=['manage_push_config','manage_groups','comms'];
 const PUSH_CONFIG_TEST_GRANTS=['manage_push_config','comms'];
 function mockPushUser(id:number){const row=db.users.find(item=>item.id===id);return row?userBasic(row):null;}
 function mockPushGroup(id:number|null){if(id==null)return null;const row=db.groups.find(item=>item.id===id);return row?{id:row.id,name:row.name}:null;}
-function pushDeviceWire(row:MockPushDevice,graph:string){const basic={id:row.id,device_id:row.device_id,platform:row.platform,device_name:row.device_name,push_enabled:row.push_enabled,last_seen:row.last_seen};if(graph==='basic')return basic;const normal={...basic,app_version:row.app_version,os_version:row.os_version,push_preferences:{...row.push_preferences},user:mockPushUser(row.user)};return graph==='full'?{...normal,created:row.created,modified:row.modified,is_active:row.is_active}:normal;}
+function pushDeviceWire(row:MockPushDevice,graph:string){const basic={id:row.id,device_id:row.device_id,platform:row.platform,device_name:row.device_name,push_enabled:row.push_enabled,is_active:row.is_active,last_seen:row.last_seen};if(graph==='basic')return basic;const normal={...basic,app_version:row.app_version,os_version:row.os_version,push_preferences:{...row.push_preferences},user:mockPushUser(row.user)};return graph==='full'?{...normal,created:row.created,modified:row.modified,is_active:row.is_active}:normal;}
 function pushTemplateWire(row:MockPushTemplate,graph:string){const basic={id:row.id,name:row.name,category:row.category,priority:row.priority,is_active:row.is_active};if(graph==='basic')return basic;const normal={...basic,title_template:row.title_template,body_template:row.body_template,action_url:row.action_url,data_template:{...row.data_template},variables:{...row.variables},group:mockPushGroup(row.group)};return graph==='full'?{...normal,created:row.created,modified:row.modified}:normal;}
-function pushConfigWire(row:MockPushConfig,graph:string){const basic={id:row.id,name:row.name,test_mode:row.test_mode,default_sound:row.default_sound,is_active:row.is_active,fcm_project_id:row.fcm_project_id};if(graph==='basic')return basic;const normal={...basic,created:row.created,modified:row.modified,group:mockPushGroup(row.group)};return normal;}
-function pushDeliveryWire(row:MockPushDelivery,graph:string){const basic={id:row.id,title:row.title,category:row.category,status:row.status,sent_at:row.sent_at,created:row.created};if(graph==='basic')return basic;const device=db.pushDevices.find(item=>item.id===row.device);const normal={...basic,body:row.body,action_url:row.action_url,data_payload:{...row.data_payload},delivered_at:row.delivered_at,error_message:row.error_message,user:mockPushUser(row.user),device:device?pushDeviceWire(device,'basic'):null};return graph==='full'?{...normal,modified:row.modified,platform_data:{...row.platform_data},template:row.template==null?null:pushTemplateWire(db.pushTemplates.find(item=>item.id===row.template)!,'basic')}:normal;}
+function pushConfigWire(row:MockPushConfig,graph:string){const basic={id:row.id,name:row.name,test_mode:row.test_mode,default_sound:row.default_sound,is_active:row.is_active,fcm_project_id:row.fcm_project_id,has_fcm_credentials:db.pushConfigSecrets.has(row.id),fcm_client_email:db.pushConfigSecrets.get(row.id)?.client_email??null};if(graph==='basic')return basic;const normal={...basic,created:row.created,modified:row.modified,group:mockPushGroup(row.group)};return normal;}
+function pushDeliveryWire(row:MockPushDelivery,graph:string){const basic={id:row.id,title:row.title,category:row.category,status:row.status,push_outcome:row.platform_data.test_mode?'simulated':row.status==='delivered'&&row.delivered_at?'delivered':row.platform_data.outcome??row.status,sent_at:row.sent_at,created:row.created};if(graph==='basic')return basic;const device=db.pushDevices.find(item=>item.id===row.device);const normal={...basic,body:row.body,action_url:row.action_url,data_payload:{...row.data_payload},delivered_at:row.delivered_at,error_message:row.error_message,user:mockPushUser(row.user),device:device?pushDeviceWire(device,'basic'):null};return graph==='full'?{...normal,modified:row.modified,platform_data:{...row.platform_data},template:row.template==null?null:pushTemplateWire(db.pushTemplates.find(item=>item.id===row.template)!,'basic')}:normal;}
 function pushOwnRows<T extends {user:number}>(caller:MockUser,rows:T[],grants:string[]):T[]{return hasGlobalPermission(caller,grants)?rows:rows.filter(row=>row.user===caller.id);}
 function applyPushTemplate(row:MockPushTemplate,body:Record<string,unknown>){for(const key of ['name','title_template','body_template','action_url','category'] as const)if(key in body)(row as unknown as Record<string,unknown>)[key]=body[key]==null?null:String(body[key]);if('group'in body)row.group=body.group==null?null:Number(body.group);if('priority'in body&&['low','normal','high'].includes(String(body.priority)))row.priority=String(body.priority) as MockPushTemplate['priority'];if(isPlainObject(body.data_template))row.data_template={...body.data_template};if(isPlainObject(body.variables))row.variables={...body.variables};if('is_active'in body)row.is_active=Boolean(body.is_active);row.modified=Math.floor(Date.now()/1000);}
 function applyPushConfig(row:MockPushConfig,body:Record<string,unknown>){if('name'in body)row.name=String(body.name??'');if('group'in body)row.group=body.group==null?null:Number(body.group);if('default_sound'in body)row.default_sound=String(body.default_sound??'default');if('is_active'in body)row.is_active=Boolean(body.is_active);if('test_mode'in body)row.test_mode=Boolean(body.test_mode);if('fcm_service_account'in body){if(body.fcm_service_account==null){db.pushConfigSecrets.delete(row.id);row.fcm_project_id=null;}else if(isPlainObject(body.fcm_service_account)){db.pushConfigSecrets.set(row.id,{...body.fcm_service_account});row.fcm_project_id=typeof body.fcm_service_account.project_id==='string'?body.fcm_service_account.project_id:null;}}row.modified=Math.floor(Date.now()/1000);}
@@ -7611,7 +7807,34 @@ export function getMockPushConfigCredentialState(id:number):{configured:boolean;
 async function pushFetch(path:string,opts:MockFetchOpts):Promise<unknown|undefined>{
     if(!path.startsWith('/api/account/devices/push'))return undefined;const method=(opts.method??'GET').toUpperCase();const caller=userFromBearer(opts.headers);if(!caller)return permissionDenied(401);
     if(path==='/api/account/devices/push/stats'){if(method!=='GET')return {status:false,error:'Method not allowed',error_code:405};const deliveries=db.pushDeliveries.filter(row=>row.user===caller.id);const devices=db.pushDevices.filter(row=>row.user===caller.id&&row.is_active);return {status:true,data:{total_sent:deliveries.filter(row=>row.status==='sent').length,total_failed:deliveries.filter(row=>row.status==='failed').length,total_pending:deliveries.filter(row=>row.status==='pending').length,registered_devices:devices.length,enabled_devices:devices.filter(row=>row.push_enabled).length}};}
-    const testMatch=path.match(/^\/api\/account\/devices\/push\/config\/(\d+)\/test$/);if(testMatch){if(method!=='POST')return {status:false,error:'Method not allowed',error_code:405};if(!hasGlobalPermission(caller,PUSH_CONFIG_TEST_GRANTS))return permissionDenied();const row=db.pushConfigs.find(item=>item.id===Number(testMatch[1]));if(!row)return {status:false,error:'Push configuration not found',error_code:404};if(row.test_mode)return {status:true,data:{success:true,message:'Config is in test mode - FCM not tested',test_mode:true}};if(!db.pushConfigSecrets.has(row.id))return {status:false,error:'No FCM service account configured',error_code:400,data:{success:false,message:'No FCM service account configured',error:'missing_credentials'}};return {status:true,data:{success:true,message:'FCM v1 credentials valid (dummy token rejected by FCM)',note:'Credentials are valid; the built-in dummy token was rejected as expected.',fcm_version:'v1'}};}
+    if(path==='/api/account/devices/push/test'){
+        if(!['GET','POST'].includes(method))return {status:false,error:'Method not allowed',error_code:405};
+        if(!hasGlobalPermission(caller,['send_notifications','comms']))return permissionDenied();
+        const body=opts.body??{};const deviceId=method==='GET'?opts.params?.device_id:body.device_id;
+        if(typeof deviceId==='boolean'||!/^\d+$/.test(String(deviceId))||!Number.isSafeInteger(Number(deviceId))||Number(deviceId)<=0)return {status:false,error:'A positive registered-device ID is required',error_code:400};
+        const device=pushOwnRows(caller,db.pushDevices,PUSH_DEVICE_VIEW_GRANTS).find(row=>row.id===Number(deviceId));
+        if(!device)return {status:false,error:'Device not found',error_code:404};
+        const user=db.users.find(row=>row.id===device.user);const org=typeof user?.org==='number'?user.org:user?.org?.id;
+        const config=(org?db.pushConfigs.find(row=>row.is_active&&row.group===org):null)??db.pushConfigs.filter(row=>row.is_active&&row.group==null).sort((a,b)=>a.name.localeCompare(b.name))[0];
+        const code=!device.is_active?'inactive_device':!device.push_enabled?'push_disabled':device.push_preferences.test===false?'category_disabled':!device.device_token?'missing_token':!config?'no_config':config.test_mode?'test_mode':!db.pushConfigSecrets.has(config.id)?'missing_credentials':null;
+        const readiness={ready:code===null,device_id:device.id,error_code:code,message:code??'Ready',config:config?{id:config.id,name:config.name,group:mockPushGroup(config.group),is_active:config.is_active,test_mode:config.test_mode,has_fcm_credentials:db.pushConfigSecrets.has(config.id),fcm_project_id:config.fcm_project_id}:null};
+        if(method==='GET')return {status:true,data:readiness};
+        const title=body.title??'Push test';const message=body.message??'This is a test notification.';
+        if(typeof title!=='string'||!title.trim()||title.length>200||typeof message!=='string'||!message.trim()||message.length>1000)return {status:false,error:'Title and message are required and must fit their limits',error_code:400};
+        if(code)return {status:true,data:{...readiness,success:false,outcome:'blocked',delivery_id:null}};
+        const now=Math.floor(Date.now()/1000);const deliveryId=Math.max(0,...db.pushDeliveries.map(row=>row.id))+1;
+        const messageId=`projects/${config.fcm_project_id}/messages/mock-${deliveryId}`;
+        db.pushDeliveries.push({id:deliveryId,created:now,modified:now,user:device.user,device:device.id,template:null,title,body:message,category:'test',action_url:null,data_payload:{},status:'sent',sent_at:now,delivered_at:null,error_message:null,platform_data:{outcome:'accepted',message_id:messageId,config_id:config.id}});
+        return {status:true,data:{...readiness,success:true,outcome:'accepted',message:'FCM accepted the notification. Confirm receipt on the device.',message_id:messageId,delivery_id:deliveryId}};
+    }
+    const testMatch=path.match(/^\/api\/account\/devices\/push\/config\/(\d+)\/test$/);
+    if(testMatch){
+        if(method!=='POST')return {status:false,error:'Method not allowed',error_code:405};
+        if(!hasGlobalPermission(caller,PUSH_CONFIG_TEST_GRANTS))return permissionDenied();
+        const row=db.pushConfigs.find(item=>item.id===Number(testMatch[1]));if(!row)return {status:false,error:'Push configuration not found',error_code:404};
+        if(!db.pushConfigSecrets.has(row.id))return {status:false,error:'No FCM service account configured',error_code:400,data:{success:false,outcome:'blocked',error_code:'missing_credentials',validation_only:true}};
+        return {status:true,data:{success:true,outcome:'validated',message:'FCM authenticated and validated this project. No notification was delivered.',message_id:`projects/${row.fcm_project_id}/messages/mock-check`,test_mode:row.test_mode,validation_only:true,fcm_version:'v1'}};
+    }
     const deliveriesMatch=path.match(/^\/api\/account\/devices\/push\/deliveries(?:\/(\d+))?$/);if(deliveriesMatch){const id=deliveriesMatch[1]?Number(deliveriesMatch[1]):null;if(method==='DELETE')return {status:false,error:'DELETE not allowed: NotificationDelivery',error_code:403};const visible=pushOwnRows(caller,db.pushDeliveries,PUSH_DELIVERY_VIEW_GRANTS);if(id!=null){const row=visible.find(item=>item.id===id);if(!row)return db.pushDeliveries.some(item=>item.id===id)?permissionDenied():{status:false,error:'NotificationDelivery not found',error_code:404};if(method==='POST'){if(!hasGlobalPermission(caller,PUSH_DELIVERY_SAVE_GRANTS))return permissionDenied();for(const key of ['title','body','category','action_url','status','sent_at','delivered_at','error_message'] as const)if(key in(opts.body??{}))(row as unknown as Record<string,unknown>)[key]=opts.body?.[key];row.modified=Math.floor(Date.now()/1000);}else if(method!=='GET')return {status:false,error:'Method not allowed',error_code:405};const graph=String(opts.params?.graph??'default');return {status:true,data:pushDeliveryWire(row,graph),graph};}if(method==='POST')return {status:false,error:'CREATE not supported in Push Admin mock',error_code:403};if(method!=='GET')return {status:false,error:'Method not allowed',error_code:405};const graph=String(opts.params?.graph??'default');const params=messagingParams(opts.params??{},['status','category','user','device'],['created','status','category','sent_at','delivered_at'],graph,'-created',true);return messagingList(visible as unknown as Record<string,unknown>[],params,row=>`${row.title??''} ${row.category}` ,graph,row=>pushDeliveryWire(row as unknown as MockPushDelivery,graph),'-created');}
     const templatesMatch=path.match(/^\/api\/account\/devices\/push\/templates(?:\/(\d+))?$/);if(templatesMatch){if(method==='DELETE')return {status:false,error:'DELETE not allowed: NotificationTemplate',error_code:403};if(!hasGlobalPermission(caller,PUSH_TEMPLATE_VIEW_GRANTS))return permissionDenied();const id=templatesMatch[1]?Number(templatesMatch[1]):null;if(id!=null){const row=db.pushTemplates.find(item=>item.id===id);if(!row)return {status:false,error:'NotificationTemplate not found',error_code:404};if(method==='POST'){if(!hasGlobalPermission(caller,PUSH_TEMPLATE_SAVE_GRANTS))return permissionDenied();applyPushTemplate(row,opts.body??{});}else if(method!=='GET')return {status:false,error:'Method not allowed',error_code:405};const graph=String(opts.params?.graph??'default');return {status:true,data:pushTemplateWire(row,graph),graph};}if(method==='POST'){if(!hasGlobalPermission(caller,PUSH_TEMPLATE_SAVE_GRANTS))return permissionDenied();const body=opts.body??{};const hasContent=Boolean(String(body.title_template??'').trim()||String(body.body_template??'').trim()||(isPlainObject(body.data_template)&&Object.keys(body.data_template).length));if(!hasContent)return {status:false,error:'Template must have at least one of: title_template, body_template, or data_template',error_code:400};const now=Math.floor(Date.now()/1000);const row:MockPushTemplate={id:Math.max(0,...db.pushTemplates.map(item=>item.id))+1,created:now,modified:now,group:null,name:'',title_template:null,body_template:null,action_url:null,data_template:{},category:'general',priority:'normal',variables:{},is_active:true};applyPushTemplate(row,body);db.pushTemplates.push(row);return {status:true,data:pushTemplateWire(row,'default'),graph:'default'};}if(method!=='GET')return {status:false,error:'Method not allowed',error_code:405};const graph=String(opts.params?.graph??'default');const params=messagingParams(opts.params??{},['category','priority','is_active','group'],['name','category','priority','is_active'],graph,'name');return messagingList(db.pushTemplates as unknown as Record<string,unknown>[],params,row=>`${row.name} ${row.category}`,graph,row=>pushTemplateWire(row as unknown as MockPushTemplate,graph),'name');}
     const configsMatch=path.match(/^\/api\/account\/devices\/push\/config(?:\/(\d+))?$/);if(configsMatch){if(method==='DELETE')return {status:false,error:'DELETE not allowed: PushConfig',error_code:403};if(!hasGlobalPermission(caller,PUSH_CONFIG_GRANTS))return permissionDenied();const id=configsMatch[1]?Number(configsMatch[1]):null;if(id!=null){const row=db.pushConfigs.find(item=>item.id===id);if(!row)return {status:false,error:'PushConfig not found',error_code:404};if(method==='POST'){const nextGroup='group'in(opts.body??{})?(opts.body?.group==null?null:Number(opts.body?.group)):row.group;if(nextGroup!=null&&db.pushConfigs.some(item=>item.id!==id&&item.group===nextGroup))return {status:false,error:'A push configuration already exists for this group',error_code:400};applyPushConfig(row,opts.body??{});}else if(method!=='GET')return {status:false,error:'Method not allowed',error_code:405};const graph=String(opts.params?.graph??'default');return {status:true,data:pushConfigWire(row,graph),graph};}if(method==='POST'){const body=opts.body??{};const group=body.group==null?null:Number(body.group);if(group!=null&&db.pushConfigs.some(item=>item.group===group))return {status:false,error:'A push configuration already exists for this group',error_code:400};const now=Math.floor(Date.now()/1000);const row:MockPushConfig={id:Math.max(0,...db.pushConfigs.map(item=>item.id))+1,created:now,modified:now,group,name:String(body.name??''),is_active:body.is_active!==false,test_mode:Boolean(body.test_mode),default_sound:String(body.default_sound??'default'),fcm_project_id:null};db.pushConfigs.push(row);applyPushConfig(row,body);return {status:true,data:pushConfigWire(row,'default'),graph:'default'};}if(method!=='GET')return {status:false,error:'Method not allowed',error_code:405};const graph=String(opts.params?.graph??'default');const params=messagingParams(opts.params??{},['test_mode','is_active','group'],['name','test_mode','is_active','created','modified'],graph,'name');return messagingList(db.pushConfigs as unknown as Record<string,unknown>[],params,row=>String(row.name),graph,row=>pushConfigWire(row as unknown as MockPushConfig,graph),'name');}
@@ -7676,7 +7899,7 @@ async function phoneHubFetch(path:string,opts:MockFetchOpts):Promise<unknown|und
     const smsMatch=path.match(/^\/api\/phonehub\/sms(?:\/(\d+))?$/);
     if(smsMatch){const id=smsMatch[1]?Number(smsMatch[1]):null;if(method==='DELETE'){if(!hasGlobalPermission(caller,SMS_DELETE_GRANTS))return permissionDenied();if(id==null)return {status:false,error:'Method not allowed',error_code:405};db.sms=db.sms.filter(row=>row.id!==id);return {status:'deleted'};}if(method==='POST'&&!hasGlobalPermission(caller,SMS_SAVE_GRANTS))return permissionDenied();if(method==='GET'&&!hasGlobalPermission(caller,SMS_VIEW_GRANTS))return permissionDenied();if(id!=null){const row=db.sms.find(item=>item.id===id);if(!row)return {status:false,error:'SMS not found',error_code:404};if(method==='POST'){for(const key of ['status','error_message','delivered_at'] as const)if(key in (opts.body??{}))(row as unknown as Record<string,unknown>)[key]=opts.body?.[key];row.modified=Math.floor(Date.now()/1000);}return {status:true,data:smsWire(row),graph:'default'};}if(method==='POST'){const body=opts.body??{};const now=Math.floor(Date.now()/1000);const row:MockSms={id:Math.max(0,...db.sms.map(item=>item.id))+1,created:now,modified:now,direction:String(body.direction??'outbound'),from_number:String(body.from_number??''),to_number:String(body.to_number??''),body:String(body.body??''),status:String(body.status??'queued'),provider:body.provider?String(body.provider):null,provider_message_id:null,error_code:null,error_message:null,metadata:{},is_test:Boolean(body.is_test),sent_at:null,delivered_at:null,user:body.user==null?null:Number(body.user),group:body.group==null?null:Number(body.group)};db.sms.unshift(row);return {status:true,data:smsWire(row),graph:'default'};}if(method!=='GET')return {status:false,error:'Method not allowed',error_code:405};const params=messagingParams(opts.params??{},['direction','status','provider','group','user'],['created','direction','status','provider','sent_at','delivered_at'],'default','-created',true);return messagingList(db.sms as unknown as Record<string,unknown>[],params,row=>`${row.from_number} ${row.to_number} ${row.body}`,'default',row=>smsWire(row as unknown as MockSms),'-created');}
     const configMatch=path.match(/^\/api\/phonehub\/config(?:\/(\d+))?$/);
-    if(configMatch){const id=configMatch[1]?Number(configMatch[1]):null;if(method==='DELETE'){if(!hasGlobalPermission(caller,PHONE_CONFIG_DELETE_GRANTS))return permissionDenied();if(id==null)return {status:false,error:'Method not allowed',error_code:405};db.phoneConfigs=db.phoneConfigs.filter(row=>row.id!==id);db.phoneConfigSecrets.delete(id);return {status:'deleted'};}if(!hasGlobalPermission(caller,PHONE_CONFIG_VIEW_GRANTS))return permissionDenied();if(id!=null){const row=db.phoneConfigs.find(item=>item.id===id);if(!row)return {status:false,error:'Phone config not found',error_code:404};if(method==='POST'&&opts.body?.test_connection){if(row.test_mode)return {status:true,message:'Config is in test mode - provider not tested'};const secrets=db.phoneConfigSecrets.get(id)??{};const ready=row.provider==='twilio'?Boolean(secrets.twilio_account_sid&&secrets.twilio_auth_token):row.provider==='aws'?Boolean(secrets.aws_access_key_id&&secrets.aws_secret_access_key):Boolean(secrets.mojo_api_key&&row.mojo_remote_url);return ready?{status:true,message:`${row.provider} connection succeeded`}:{status:false,error:`${row.provider} credentials are incomplete`,error_code:400};}if(method==='POST'){const nextGroup='group'in(opts.body??{})?(opts.body?.group==null?null:Number(opts.body.group)):row.group;if(nextGroup!=null&&db.phoneConfigs.some(item=>item.id!==id&&item.group===nextGroup))return {status:false,error:'A configuration already exists for this group',error_code:400};applyPhoneConfig(row,opts.body??{});saveMockPhoneSecrets(id,opts.body??{});}else if(method!=='GET')return {status:false,error:'Method not allowed',error_code:405};return {status:true,data:phoneConfigWire(row),graph:'default'};}if(method==='POST'){const body=opts.body??{};const group=body.group==null?null:Number(body.group);if(group!=null&&!db.groups.some(item=>item.id===group))return {status:false,error:'Group not found',error_code:404};if(group!=null&&db.phoneConfigs.some(item=>item.group===group))return {status:false,error:'A configuration already exists for this group',error_code:400};const now=Math.floor(Date.now()/1000);const row:MockPhoneConfig={id:Math.max(0,...db.phoneConfigs.map(item=>item.id))+1,created:now,modified:now,group,name:String(body.name??''),is_active:body.is_active!==false,provider:['twilio','aws','mojo'].includes(String(body.provider))?String(body.provider) as MockPhoneConfig['provider']:'twilio',twilio_from_number:null,aws_region:null,aws_sender_id:null,mojo_remote_url:null,lookup_enabled:body.lookup_enabled!==false,lookup_cache_days:Number(body.lookup_cache_days??90),test_mode:Boolean(body.test_mode)};applyPhoneConfig(row,body);db.phoneConfigs.push(row);saveMockPhoneSecrets(row.id,body);return {status:true,data:phoneConfigWire(row),graph:'default'};}if(method!=='GET')return {status:false,error:'Method not allowed',error_code:405};const params=messagingParams(opts.params??{},['provider','is_active','group','test_mode'],['name','provider','is_active','created','modified'],'default','name');return messagingList(db.phoneConfigs as unknown as Record<string,unknown>[],params,row=>String(row.name),'default',row=>phoneConfigWire(row as unknown as MockPhoneConfig),'name');}
+    if(configMatch){const id=configMatch[1]?Number(configMatch[1]):null;if(method==='DELETE'){if(!hasGlobalPermission(caller,PHONE_CONFIG_DELETE_GRANTS))return permissionDenied();if(id==null)return {status:false,error:'Method not allowed',error_code:405};db.phoneConfigs=db.phoneConfigs.filter(row=>row.id!==id);db.phoneConfigSecrets.delete(id);return {status:'deleted'};}if(!hasGlobalPermission(caller,PHONE_CONFIG_VIEW_GRANTS))return permissionDenied();if(id!=null){const row=db.phoneConfigs.find(item=>item.id===id);if(!row)return {status:false,error:'Phone config not found',error_code:404};if(method==='POST'&&opts.body?.test_connection){if(row.test_mode)return {status:true,data:{success:true,test_mode:true,message:'Config is in test mode - provider not tested'}};const secrets=db.phoneConfigSecrets.get(id)??{};const ready=row.provider==='twilio'?Boolean(secrets.twilio_account_sid&&secrets.twilio_auth_token):row.provider==='aws'?Boolean(secrets.aws_access_key_id&&secrets.aws_secret_access_key):Boolean(secrets.mojo_api_key&&row.mojo_remote_url);return {status:true,data:ready?{success:true,message:`${row.provider} connection succeeded`}:{success:false,message:`${row.provider} credentials are incomplete`,error:'missing_credentials'}};}if(method==='POST'){const nextGroup='group'in(opts.body??{})?(opts.body?.group==null?null:Number(opts.body.group)):row.group;if(nextGroup!=null&&db.phoneConfigs.some(item=>item.id!==id&&item.group===nextGroup))return {status:false,error:'A configuration already exists for this group',error_code:400};applyPhoneConfig(row,opts.body??{});saveMockPhoneSecrets(id,opts.body??{});}else if(method!=='GET')return {status:false,error:'Method not allowed',error_code:405};return {status:true,data:phoneConfigWire(row),graph:'default'};}if(method==='POST'){const body=opts.body??{};const group=body.group==null?null:Number(body.group);if(group!=null&&!db.groups.some(item=>item.id===group))return {status:false,error:'Group not found',error_code:404};if(group!=null&&db.phoneConfigs.some(item=>item.group===group))return {status:false,error:'A configuration already exists for this group',error_code:400};const now=Math.floor(Date.now()/1000);const row:MockPhoneConfig={id:Math.max(0,...db.phoneConfigs.map(item=>item.id))+1,created:now,modified:now,group,name:String(body.name??''),is_active:body.is_active!==false,provider:['twilio','aws','mojo'].includes(String(body.provider))?String(body.provider) as MockPhoneConfig['provider']:'twilio',twilio_from_number:null,aws_region:null,aws_sender_id:null,mojo_remote_url:null,lookup_enabled:body.lookup_enabled!==false,lookup_cache_days:Number(body.lookup_cache_days??90),test_mode:Boolean(body.test_mode)};applyPhoneConfig(row,body);db.phoneConfigs.push(row);saveMockPhoneSecrets(row.id,body);return {status:true,data:phoneConfigWire(row),graph:'default'};}if(method!=='GET')return {status:false,error:'Method not allowed',error_code:405};const params=messagingParams(opts.params??{},['provider','is_active','group','test_mode'],['name','provider','is_active','created','modified'],'default','name');return messagingList(db.phoneConfigs as unknown as Record<string,unknown>[],params,row=>String(row.name),'default',row=>phoneConfigWire(row as unknown as MockPhoneConfig),'name');}
     return undefined;
 }
 async function messagingFetch(path:string,opts:MockFetchOpts):Promise<unknown|undefined>{
@@ -7986,6 +8209,7 @@ export async function mockFetch(path: string, opts: MockFetchOpts): Promise<unkn
         const had = db.throttle.delete(uid);
         return { status: true, data: { deleted: had ? 1 : 0 } };
     }
+    if (path === '/api/account/admin/signin') return signinFetch(method, opts.body ?? {}, opts.headers);
     if (path === '/api/login' || path === '/api/token/refresh' || path.startsWith('/api/auth/')) {
         return authFetch(path, opts.body ?? {}, opts.params ?? {});
     }
@@ -8795,6 +9019,11 @@ export async function mockFetch(path: string, opts: MockFetchOpts): Promise<unkn
         return { status: true, data: { name: domain.name, registrant: transientContact, admin: transientContact, tech: transientContact, privacy: domain.privacy, admin_privacy: domain.privacy, registrant_privacy: domain.privacy, tech_privacy: domain.privacy, auto_renew: domain.auto_renew, nameservers: ['ns-1.example.invalid', 'ns-2.example.invalid'], registrar: 'Amazon Registrar, Inc.', registered_on: domain.registered_on, expires: domain.expires, status_list: ['ok'], privacy_supported: true } };
     }
     // ══ end DNSMan wire ═══════════════════════════════════════════════
+    if (path === '/api/account/admin/fleet' || path.startsWith('/api/account/admin/fleet/')) {
+        const caller = userFromBearer(opts.headers);
+        if (!caller) return permissionDenied(401);
+        return fleetMock(path, method, opts.body, caller.is_superuser === true);
+    }
     // ── Settings — plaintext stays private; secrets serialize masked ─────
     const oneSetting = path.match(/^\/api\/settings\/(\d+)$/);
     if (oneSetting || path === '/api/settings') {

package/src/client/realtime.ts

@@ -296,6 +296,18 @@ export class RealtimeClient {
             if (this.lifecycle === 'ready') this.clearPong();
             return;
         }
+        if (frame.type === 'ping') {
+            // Server-initiated heartbeat (django-mojo >= 1.32: every 20 s,
+            // idle cull at 90 s). Answered from this handler, not a timer, so
+            // a throttled background tab still proves the socket alive; it
+            // also counts as proof of life for our own pong deadline. A
+            // framework frame: never dispatched to consumers.
+            if (this.lifecycle === 'ready') {
+                socket.send(JSON.stringify({ type: 'pong' }));
+                this.clearPong();
+            }
+            return;
+        }
         if (frame.type === 'subscribed' || frame.type === 'unsubscribed') {
             if (typeof frame.topic === 'string') this.completeTopic(frame.type, frame.topic);
             return;

package/src/ui/FormView.tsx

@@ -26,6 +26,7 @@ import { toast } from './toast';
 import {
     useFormAutosave,
     type AutosaveBatchInfo,
+    type AutosaveBeforeSave,
     type FieldStatus,
     type FormAutosaveApi,
 } from './form-autosave';
@@ -104,13 +105,34 @@ export interface FormViewProps<T extends { id: number | string }> {
     savedFlashMs?: number;
     onSaved?: (info: AutosaveBatchInfo & { row: T }) => void;
     onSaveError?: (info: AutosaveBatchInfo & { error: Error }) => void;
+    /**
+     * Pre-save gate, once per batch. `false` drops the batch (its fields
+     * revert, no toast); an object replaces the wire body; true/undefined
+     * proceeds. Put a `confirmGuardrail` here for grants/identity fields.
+     */
+    beforeSave?: AutosaveBeforeSave<T>;
     /** True while any FileField transfer is active. Owners can block dismissal. */
     onPendingChange?: (pending: boolean) => void;
     className?: string;
 }
 
+const saveOwnerIds = new WeakMap<object, number>();
+let nextSaveOwnerId = 0;
+
 export function FormView<T extends { id: number | string }>(props: FormViewProps<T>) {
-    const { model, row, fields, tabs, debounceMs, savedFlashMs, onSaved, onSaveError, className } = props;
+    // A TanStack mutation observer updates its mutationFn on rerender.
+    // Keep the observer and reducer with the model/record that created them,
+    // so a confirmation already in flight cannot migrate to another owner.
+    let modelId = saveOwnerIds.get(props.model.useSave);
+    if (modelId === undefined) {
+        modelId = ++nextSaveOwnerId;
+        saveOwnerIds.set(props.model.useSave, modelId);
+    }
+    return <OwnedFormView key={JSON.stringify([modelId, props.row.id])} {...props} />;
+}
+
+function OwnedFormView<T extends { id: number | string }>(props: FormViewProps<T>) {
+    const { model, row, fields, tabs, debounceMs, savedFlashMs, onSaved, onSaveError, beforeSave, className } = props;
     const save = model.useSave();
 
     // Registry-named tabsets re-render on registration; inline defs pass through.
@@ -164,6 +186,7 @@ export function FormView<T extends { id: number | string }>(props: FormViewProps
         save: (changes) => save.mutateAsync({ id: row.id, changes } satisfies SaveVars),
         debounceMs,
         savedFlashMs,
+        beforeSave,
         onSaved: (info) => {
             publishOwnerResult(info.fields, 'success', info.changes, info.row);
             onSaved?.(info);

package/src/ui/ModelTable.tsx

@@ -56,12 +56,18 @@ interface BatchActionBase<T> {
     danger?: boolean;
     /** Row-state eligibility. Ineligible selected rows are never submitted. */
     eligible?: (row: T) => boolean;
-    /** Confirm copy; false skips the prompt. Default: "<label> N item(s)?" */
-    confirm?: string | false;
+    /**
+     * The permission step. A string is the `modal.confirm` copy; false skips
+     * the prompt; a function REPLACES the built-in confirm — resolve false
+     * to cancel (open a `confirmGuardrail` here for batches that take a
+     * tenant dark or can't be undone). Default: "<label> N item(s)?"
+     */
+    confirm?: string | false | ((rows: T[]) => Promise<boolean>);
     /**
      * Optional once-per-batch step (collect a reason, pick a value…) run
      * AFTER the confirm. Resolve null to cancel the batch; the resolved
-     * value is passed to every run() call.
+     * value is passed to every run() call. Ask permission in `confirm`,
+     * not here — a null from prepare means "nothing collected".
      */
     prepare?: (rows: T[]) => Promise<unknown | null>;
 }
@@ -449,7 +455,9 @@ export function ModelTable<T extends { id: RowId }>({
     const runBatch = async (action: BatchAction<T>) => {
         const targets = rows.filter((r) => selected.has(r.id) && (!action.eligible || action.eligible(r)));
         if (targets.length === 0) return;
-        if (action.confirm !== false) {
+        if (typeof action.confirm === 'function') {
+            if (!(await action.confirm(targets))) return;
+        } else if (action.confirm !== false) {
             const ok = await modal.confirm({
                 title: action.label,
                 message: action.confirm ?? `${action.label} ${targets.length} item(s)?`,

package/src/ui/detail/MetadataSection.tsx

@@ -18,9 +18,14 @@
 //   · Controlled on `metadata` (architecture rule 5): the component never
 //     mirrors server state. `onSaved` is REQUIRED — it is how the owner
 //     (TanStack cache, parent state) learns about the write.
+//   · Every save posts the WHOLE blob, so one bad write can wipe a protected
+//     key (auth_config / geofence / redemption_policy) in a single POST.
+//     Removing a top-level key therefore stops on a guardrail that lists
+//     the keys about to vanish; owners add `beforeSave(next, prev)` to diff
+//     their own protected keys on top.
 import { useState } from 'react';
 import { mojoCall } from '../../client/client';
-import { modal } from '../modal';
+import { confirmGuardrail } from '../guardrail';
 import { toast } from '../toast';
 
 type Draft =
@@ -49,13 +54,42 @@ function parseValue(raw: string): unknown {
     }
 }
 
-export function MetadataSection({ endpoint, id, metadata, onSaved, title = 'Metadata' }: {
+/**
+ * Default stop: a top-level key is about to leave the blob. Names every key
+ * so a wipe of `auth_config` reads as exactly that, not "Remove entry?".
+ */
+function confirmRemovedKeys(removed: string[], next: Record<string, unknown>): Promise<boolean> {
+    const one = removed.length === 1;
+    const remaining = Object.keys(next).length;
+    return confirmGuardrail({
+        title: one ? `Remove metadata key ${removed[0]}?` : `Remove ${removed.length} metadata keys?`,
+        effect: <>
+            {removed.map((key, i) => <span key={key}>{i > 0 ? ', ' : ''}<code>{key}</code></span>)}
+            {one ? ' leaves' : ' leave'} the record the moment this saves — the POST carries the whole blob, {remaining === 0 ? 'and it will be empty' : `${remaining} key${remaining === 1 ? '' : 's'} remain`}.
+        </>,
+        why: [
+            <>Anything that reads {one ? 'this key' : 'these keys'} (policy, auth configuration, geofences, redemption rules) sees it missing on its next read, with no error raised here.</>,
+            <>The value is not kept anywhere in this portal — re-adding the key means re-entering it by hand.</>,
+        ],
+        undo: 'There is no undo; re-add the key with its previous value.',
+        confirmText: one ? 'Remove key' : `Remove ${removed.length} keys`,
+        typeToConfirm: removed.length > 1 ? String(removed.length) : undefined,
+    });
+}
+
+export function MetadataSection({ endpoint, id, metadata, onSaved, beforeSave, title = 'Metadata' }: {
     /** Collection endpoint — the save posts to `<endpoint>/<id>`. */
     endpoint: string;
     id: number | string;
     metadata: Record<string, unknown>;
     /** Called with the new blob after the server accepted it. */
     onSaved: (next: Record<string, unknown>) => void;
+    /**
+     * Owner gate, after the built-in removed-key stop: resolve false to
+     * cancel the write (no error, editor state kept). Diff protected keys
+     * between `next` and `prev` here.
+     */
+    beforeSave?: (next: Record<string, unknown>, prev: Record<string, unknown>) => Promise<boolean> | boolean;
     title?: string;
 }) {
     const [draft, setDraft] = useState<Draft>(null);
@@ -65,8 +99,16 @@ export function MetadataSection({ endpoint, id, metadata, onSaved, title = 'Meta
     const keys = Object.keys(metadata).sort();
     const busy = pending !== null;
 
-    /** The one write path. Resolves true only when the server accepted it. */
+    /**
+     * The one write path. Resolves true only when the server accepted it;
+     * false when a gate declined (nothing posted, no error) or the POST
+     * rejected (banner). Gates run BEFORE pending so the dialog is not
+     * stacked over disabled controls.
+     */
     async function commit(next: Record<string, unknown>, token: string, message: string): Promise<boolean> {
+        const removed = Object.keys(metadata).filter((key) => !Object.prototype.hasOwnProperty.call(next, key));
+        if (removed.length > 0 && !(await confirmRemovedKeys(removed, next))) return false;
+        if (beforeSave && !(await beforeSave(next, metadata))) return false;
         setPending(token);
         setError(null);
         try {
@@ -101,13 +143,7 @@ export function MetadataSection({ endpoint, id, metadata, onSaved, title = 'Meta
     }
 
     async function removeKey(key: string) {
-        const confirmed = await modal.confirm({
-            title: 'Remove entry',
-            message: <>Remove metadata key <b>{key}</b>?</>,
-            confirmText: 'Remove',
-            danger: true,
-        });
-        if (!confirmed) return;
+        // The removed-key guardrail inside commit() is the confirm.
         const next = { ...metadata };
         delete next[key];
         await commit(next, `delete:${key}`, 'Metadata entry removed');