tapimo 0.5.2 → 0.6.0

package/src/admin/apps/verified-tokens.ts

@@ -5,8 +5,11 @@ import * as OpenApi from '../../internal/OpenApi.js'
 import * as Response from '../../internal/Response.js'
 import * as Schema from '../../internal/Schema.js'
 import * as Db from '../../db/Db.js'
+import * as Organizations from '../../db/tables/organizations.js'
+import * as VerifiedTokenRequests from '../../db/tables/verifiedTokenRequests.js'
 import * as VerifiedTokens from '../../internal/VerifiedTokens.js'
 import { schema as readSchema } from '../../apps/data/routes/verified-tokens.js'
+import { schema as requestSchema } from '../../apps/management/routes/verified-token-requests.js'
 import type * as App from '../App.js'
 
 /** Required `chainId` query: admin mutations always address a chain explicitly. */
@@ -123,6 +126,74 @@ export namespace schema {
       .check(z.describe('Query parameters for a logo read.'))
   }
 
+  /**
+   * A verification request with reviewer context: the management wire shape
+   * plus the requesting org's name and the reviewing admin's email.
+   */
+  export const Request = Schema.describe(
+    z.extend(requestSchema.VerifiedTokenRequest, {
+      orgName: z
+        .nullable(z.string())
+        .check(z.describe("Requesting organization's current name, or null when deleted.")),
+      reviewedBy: z
+        .nullable(z.string())
+        .check(z.describe('Reviewing admin email, or null while pending.')),
+    }),
+    'A verified-token request with requester organization context.',
+  )
+
+  /** Path parameters addressing one verification request. */
+  export const RequestParams = z
+    .object({
+      requestId: z
+        .string()
+        .check(z.regex(/^vtr_[A-Za-z0-9_-]+$/), z.describe('Request resource id (`vtr_…`).')),
+    })
+    .check(z.describe('Path parameters for one verification request.'))
+
+  /** Schemas for the listVerifiedTokenRequests operation. */
+  export namespace listVerifiedTokenRequests {
+    /** Query parameters for the request queue. */
+    export const Query = z
+      .strictObject({
+        status: z
+          ._default(z.enum(['approved', 'denied', 'pending']), 'pending')
+          .check(z.describe('Review status to filter by.')),
+      })
+      .check(z.describe('Query parameters for the verification-request queue.'))
+
+    /** Response: requests in the selected status, oldest first. */
+    export const Response = Schema.describe(
+      z.object({
+        data: z.array(Request).check(z.describe('Requests in the selected status, oldest first.')),
+      }),
+      'Verified-token requests in review-queue order.',
+    )
+  }
+
+  /** Schemas for the denyVerifiedTokenRequest operation. */
+  export namespace denyVerifiedTokenRequest {
+    /** Request body for a denial. */
+    export const Body = z
+      .object({
+        reviewNote: z.optional(
+          z
+            .string()
+            .check(z.trim(), z.maxLength(500), z.describe('Reason shown to the requester.')),
+        ),
+      })
+      .check(z.describe('Request body for denying a verification request.'))
+  }
+
+  /** Response shared by the approve and deny operations. */
+  export namespace reviewVerifiedTokenRequest {
+    /** The reviewed request. */
+    export const Response = Schema.describe(
+      z.object({ data: Request }),
+      'The reviewed verified-token request.',
+    )
+  }
+
   /** Schemas for the replaceVerifiedTokens operation. */
   export namespace replaceVerifiedTokens {
     /** Query parameters for a bulk replace. */
@@ -158,311 +229,486 @@ export namespace schema {
  * - `PATCH /:address` partially updates a token (`404` if absent).
  * - `DELETE /:address` removes a token (`404` if absent).
  * - `PUT /:address/logo` uploads a curated logo SVG (gated on `assets`).
+ * - `GET /requests` lists organization verification requests.
+ * - `POST /requests/:requestId/approve|deny` reviews a request.
  */
 export function verifiedTokens() {
-  return new Hono<App.Environment>()
-    .get(
-      '/',
-      OpenApi.validate('query', schema.listVerifiedTokens.Query, {
-        code: 'query_invalid',
-        message: 'Invalid query parameters',
-      }),
-      OpenApi.describeRoute({
-        operationId: 'listVerifiedTokens',
-        responses: OpenApi.responses({
-          success: {
-            description: 'Curated verified tokens.',
-            schema: schema.listVerifiedTokens.Response,
-          },
+  return (
+    new Hono<App.Environment>()
+      .get(
+        '/',
+        OpenApi.validate('query', schema.listVerifiedTokens.Query, {
+          code: 'query_invalid',
+          message: 'Invalid query parameters',
         }),
-        summary: 'List verified tokens',
-        tags: ['Verified Tokens'],
-      }),
-      async (c) => {
-        const db = Db.get(c.get('db'))
-        const { chainId } = c.req.valid('query')
-        const snapshot = await VerifiedTokens.read(db, chainId)
-        return c.json(
-          Response.validated(schema.listVerifiedTokens.Response, {
-            data: snapshot?.list ?? [],
-            version: snapshot?.version ?? null,
+        OpenApi.describeRoute({
+          operationId: 'listVerifiedTokens',
+          responses: OpenApi.responses({
+            success: {
+              description: 'Curated verified tokens.',
+              schema: schema.listVerifiedTokens.Response,
+            },
           }),
-        )
-      },
-    )
-    .post(
-      '/',
-      OpenApi.validate('json', schema.createVerifiedToken.Body, {
-        code: 'body_invalid',
-        message: 'Invalid request body',
-      }),
-      OpenApi.describeRoute({
-        operationId: 'createVerifiedToken',
-        responses: OpenApi.responses({
-          errors: {
-            409: 'Duplicate address or symbol.',
-            413: 'Logo exceeds the size limit.',
-            415: 'Logo is not valid SVG.',
-          },
-          success: {
-            description: 'Created verified token.',
-            schema: schema.createVerifiedToken.Response,
-          },
+          summary: 'List verified tokens',
+          tags: ['Verified Tokens'],
         }),
-        summary: 'Create verified token',
-        tags: ['Verified Tokens'],
-      }),
-      async (c) => {
-        const db = Db.get(c.get('db'))
-        const { logo, ...body } = c.req.valid('json')
-        try {
-          if (logo !== undefined) {
-            const assets = c.get('assets')
-            if (!assets?.put) return assetsNotEnabled(c)
-            const svg = encodeLogo(logo)
-            const duplicate = await findDuplicate(db, body)
-            if (duplicate) throw duplicate
-            await assets.put(logoKey(body.chainId, body.address), {
-              body: svg,
-              contentType: 'image/svg+xml',
-            })
-          }
-          const { snapshot, token } = await VerifiedTokens.create(db, body)
+        async (c) => {
+          const db = Db.get(c.get('db'))
+          const { chainId } = c.req.valid('query')
+          const snapshot = await VerifiedTokens.read(db, chainId)
           return c.json(
-            Response.validated(schema.createVerifiedToken.Response, {
-              data: token,
-              version: snapshot.version,
+            Response.validated(schema.listVerifiedTokens.Response, {
+              data: snapshot?.list ?? [],
+              version: snapshot?.version ?? null,
             }),
           )
-        } catch (cause) {
-          return mutationError(c, cause)
-        }
-      },
-    )
-    .put(
-      '/',
-      OpenApi.validate('query', schema.replaceVerifiedTokens.Query, {
-        code: 'query_invalid',
-        message: 'Invalid query parameters',
-      }),
-      OpenApi.validate('json', schema.replaceVerifiedTokens.Body, {
-        code: 'body_invalid',
-        message: 'Invalid request body',
-      }),
-      OpenApi.describeRoute({
-        operationId: 'replaceVerifiedTokens',
-        responses: OpenApi.responses({
-          errors: {
-            409: 'Duplicate address or symbol.',
-            412: 'Version precondition failed.',
-          },
-          success: {
-            description: 'Published verified list.',
-            schema: schema.replaceVerifiedTokens.Response,
-          },
+        },
+      )
+      .post(
+        '/',
+        OpenApi.validate('json', schema.createVerifiedToken.Body, {
+          code: 'body_invalid',
+          message: 'Invalid request body',
         }),
-        summary: 'Replace verified tokens',
-        tags: ['Verified Tokens'],
-      }),
-      async (c) => {
-        const db = Db.get(c.get('db'))
-        const { chainId } = c.req.valid('query')
-        const { tokens } = c.req.valid('json')
-        try {
-          const { snapshot } = await VerifiedTokens.replace(db, chainId, tokens, {
-            ...ifMatch(c),
-          })
-          return c.json(
-            Response.validated(schema.replaceVerifiedTokens.Response, {
-              data: snapshot.list,
-              version: snapshot.version,
-            }),
-          )
-        } catch (cause) {
-          return mutationError(c, cause)
-        }
-      },
-    )
-    .patch(
-      '/:address',
-      OpenApi.validate('param', schema.Params, {
-        code: 'address_invalid',
-        message: 'Invalid token address',
-      }),
-      OpenApi.validate('query', schema.patchVerifiedToken.Query, {
-        code: 'query_invalid',
-        message: 'Invalid query parameters',
-      }),
-      OpenApi.validate('json', schema.patchVerifiedToken.Body, {
-        code: 'body_invalid',
-        message: 'Invalid request body',
-      }),
-      OpenApi.describeRoute({
-        operationId: 'patchVerifiedToken',
-        responses: OpenApi.responses({
-          errors: {
-            404: 'Verified token not found (or feature disabled).',
-            409: 'Duplicate symbol.',
-            412: 'Version precondition failed.',
-          },
-          success: {
-            description: 'Updated verified token.',
-            schema: schema.patchVerifiedToken.Response,
-          },
+        OpenApi.describeRoute({
+          operationId: 'createVerifiedToken',
+          responses: OpenApi.responses({
+            errors: {
+              409: 'Duplicate address or symbol.',
+              413: 'Logo exceeds the size limit.',
+              415: 'Logo is not valid SVG.',
+            },
+            success: {
+              description: 'Created verified token.',
+              schema: schema.createVerifiedToken.Response,
+            },
+          }),
+          summary: 'Create verified token',
+          tags: ['Verified Tokens'],
         }),
-        summary: 'Update verified token',
-        tags: ['Verified Tokens'],
-      }),
-      async (c) => {
-        const db = Db.get(c.get('db'))
-        const { address } = c.req.valid('param')
-        const { chainId } = c.req.valid('query')
-        const body = c.req.valid('json')
-        try {
-          const { snapshot, token } = await VerifiedTokens.patch(db, chainId, address, body, {
-            ...ifMatch(c),
-          })
+        async (c) => {
+          const db = Db.get(c.get('db'))
+          const { logo, ...body } = c.req.valid('json')
+          try {
+            if (logo !== undefined) {
+              const assets = c.get('assets')
+              if (!assets?.put) return assetsNotEnabled(c)
+              const svg = encodeLogo(logo)
+              const duplicate = await findDuplicate(db, body)
+              if (duplicate) throw duplicate
+              await assets.put(logoKey(body.chainId, body.address), {
+                body: svg,
+                contentType: 'image/svg+xml',
+              })
+            }
+            const { snapshot, token } = await VerifiedTokens.create(db, body)
+            return c.json(
+              Response.validated(schema.createVerifiedToken.Response, {
+                data: token,
+                version: snapshot.version,
+              }),
+            )
+          } catch (cause) {
+            return mutationError(c, cause)
+          }
+        },
+      )
+      .put(
+        '/',
+        OpenApi.validate('query', schema.replaceVerifiedTokens.Query, {
+          code: 'query_invalid',
+          message: 'Invalid query parameters',
+        }),
+        OpenApi.validate('json', schema.replaceVerifiedTokens.Body, {
+          code: 'body_invalid',
+          message: 'Invalid request body',
+        }),
+        OpenApi.describeRoute({
+          operationId: 'replaceVerifiedTokens',
+          responses: OpenApi.responses({
+            errors: {
+              409: 'Duplicate address or symbol.',
+              412: 'Version precondition failed.',
+            },
+            success: {
+              description: 'Published verified list.',
+              schema: schema.replaceVerifiedTokens.Response,
+            },
+          }),
+          summary: 'Replace verified tokens',
+          tags: ['Verified Tokens'],
+        }),
+        async (c) => {
+          const db = Db.get(c.get('db'))
+          const { chainId } = c.req.valid('query')
+          const { tokens } = c.req.valid('json')
+          try {
+            const { snapshot } = await VerifiedTokens.replace(db, chainId, tokens, {
+              ...ifMatch(c),
+            })
+            return c.json(
+              Response.validated(schema.replaceVerifiedTokens.Response, {
+                data: snapshot.list,
+                version: snapshot.version,
+              }),
+            )
+          } catch (cause) {
+            return mutationError(c, cause)
+          }
+        },
+      )
+      .patch(
+        '/:address',
+        OpenApi.validate('param', schema.Params, {
+          code: 'address_invalid',
+          message: 'Invalid token address',
+        }),
+        OpenApi.validate('query', schema.patchVerifiedToken.Query, {
+          code: 'query_invalid',
+          message: 'Invalid query parameters',
+        }),
+        OpenApi.validate('json', schema.patchVerifiedToken.Body, {
+          code: 'body_invalid',
+          message: 'Invalid request body',
+        }),
+        OpenApi.describeRoute({
+          operationId: 'patchVerifiedToken',
+          responses: OpenApi.responses({
+            errors: {
+              404: 'Verified token not found (or feature disabled).',
+              409: 'Duplicate symbol.',
+              412: 'Version precondition failed.',
+            },
+            success: {
+              description: 'Updated verified token.',
+              schema: schema.patchVerifiedToken.Response,
+            },
+          }),
+          summary: 'Update verified token',
+          tags: ['Verified Tokens'],
+        }),
+        async (c) => {
+          const db = Db.get(c.get('db'))
+          const { address } = c.req.valid('param')
+          const { chainId } = c.req.valid('query')
+          const body = c.req.valid('json')
+          try {
+            const { snapshot, token } = await VerifiedTokens.patch(db, chainId, address, body, {
+              ...ifMatch(c),
+            })
+            return c.json(
+              Response.validated(schema.patchVerifiedToken.Response, {
+                data: token,
+                version: snapshot.version,
+              }),
+            )
+          } catch (cause) {
+            return mutationError(c, cause)
+          }
+        },
+      )
+      .delete(
+        '/:address',
+        OpenApi.validate('param', schema.Params, {
+          code: 'address_invalid',
+          message: 'Invalid token address',
+        }),
+        OpenApi.validate('query', schema.deleteVerifiedToken.Query, {
+          code: 'query_invalid',
+          message: 'Invalid query parameters',
+        }),
+        OpenApi.describeRoute({
+          operationId: 'deleteVerifiedToken',
+          responses: OpenApi.responses({
+            errors: {
+              404: 'Verified token not found (or feature disabled).',
+              412: 'Version precondition failed.',
+            },
+            success: {
+              description: 'Removed; returns the new snapshot version.',
+              schema: schema.deleteVerifiedToken.Response,
+            },
+          }),
+          summary: 'Delete verified token',
+          tags: ['Verified Tokens'],
+        }),
+        async (c) => {
+          const db = Db.get(c.get('db'))
+          const { address } = c.req.valid('param')
+          const { chainId } = c.req.valid('query')
+          try {
+            const { snapshot } = await VerifiedTokens.remove(db, chainId, address, {
+              ...ifMatch(c),
+            })
+            return c.json(
+              Response.validated(schema.deleteVerifiedToken.Response, {
+                version: snapshot.version,
+              }),
+            )
+          } catch (cause) {
+            return mutationError(c, cause)
+          }
+        },
+      )
+      .get(
+        '/:address/logo',
+        OpenApi.validate('param', schema.Params, {
+          code: 'address_invalid',
+          message: 'Invalid token address',
+        }),
+        OpenApi.validate('query', schema.getVerifiedTokenLogo.Query, {
+          code: 'query_invalid',
+          message: 'Invalid query parameters',
+        }),
+        async (c) => {
+          const assets = c.get('assets')
+          const { address } = c.req.valid('param')
+          const { chainId } = c.req.valid('query')
+          const logo = await assets?.get(logoKey(chainId, address))
+          if (!logo)
+            return Response.error(c, {
+              code: 'logo_not_found',
+              message: 'Logo not found.',
+              status: 404,
+            })
+          c.header('Content-Type', logo.contentType)
+          return c.body(logo.body)
+        },
+      )
+      .put(
+        '/:address/logo',
+        OpenApi.validate('param', schema.Params, {
+          code: 'address_invalid',
+          message: 'Invalid token address',
+        }),
+        OpenApi.validate('query', schema.uploadVerifiedTokenLogo.Query, {
+          code: 'query_invalid',
+          message: 'Invalid query parameters',
+        }),
+        OpenApi.describeRoute({
+          operationId: 'uploadVerifiedTokenLogo',
+          responses: OpenApi.responses({
+            errors: {
+              404: 'Asset uploads are not enabled.',
+              413: 'Logo exceeds the size limit.',
+              415: 'Body is not `image/svg+xml`.',
+            },
+            success: {
+              description: 'Stored logo location.',
+              schema: schema.uploadVerifiedTokenLogo.Response,
+            },
+          }),
+          summary: 'Upload verified-token logo',
+          tags: ['Verified Tokens'],
+        }),
+        async (c) => {
+          const assets = c.get('assets')
+          if (!assets?.put) return assetsNotEnabled(c)
+          const { address } = c.req.valid('param')
+          const { chainId } = c.req.valid('query')
+          const contentType = c.req.header('content-type')?.split(';')[0]?.trim().toLowerCase()
+          if (contentType !== 'image/svg+xml')
+            return Response.error(c, {
+              code: 'unsupported_media_type',
+              message: 'Logo uploads must be `image/svg+xml`.',
+              status: 415,
+            })
+          const body = await c.req.arrayBuffer()
+          if (body.byteLength === 0)
+            return Response.error(c, {
+              code: 'body_invalid',
+              message: 'Logo body is empty.',
+              status: 400,
+            })
+          if (body.byteLength > maxLogoBytes)
+            return Response.error(c, {
+              code: 'payload_too_large',
+              message: `Logo exceeds the ${maxLogoBytes / 1024} KiB limit.`,
+              status: 413,
+            })
+          // Keyed as the main API's loader reads it (curated icon takes precedence).
+          const key = logoKey(chainId, address)
+          await assets.put(key, { body, contentType: 'image/svg+xml' })
           return c.json(
-            Response.validated(schema.patchVerifiedToken.Response, {
-              data: token,
-              version: snapshot.version,
+            Response.validated(schema.uploadVerifiedTokenLogo.Response, {
+              key,
+              path: `/assets/${key}`,
             }),
           )
-        } catch (cause) {
-          return mutationError(c, cause)
-        }
-      },
-    )
-    .delete(
-      '/:address',
-      OpenApi.validate('param', schema.Params, {
-        code: 'address_invalid',
-        message: 'Invalid token address',
-      }),
-      OpenApi.validate('query', schema.deleteVerifiedToken.Query, {
-        code: 'query_invalid',
-        message: 'Invalid query parameters',
-      }),
-      OpenApi.describeRoute({
-        operationId: 'deleteVerifiedToken',
-        responses: OpenApi.responses({
-          errors: {
-            404: 'Verified token not found (or feature disabled).',
-            412: 'Version precondition failed.',
-          },
-          success: {
-            description: 'Removed; returns the new snapshot version.',
-            schema: schema.deleteVerifiedToken.Response,
-          },
+        },
+      )
+      // Request-review routes live under the literal `/requests` segment; a
+      // future single-segment `GET`/`POST /:address` route would shadow it.
+      .get(
+        '/requests',
+        OpenApi.validate('query', schema.listVerifiedTokenRequests.Query, {
+          code: 'query_invalid',
+          message: 'Invalid query parameters',
         }),
-        summary: 'Delete verified token',
-        tags: ['Verified Tokens'],
-      }),
-      async (c) => {
-        const db = Db.get(c.get('db'))
-        const { address } = c.req.valid('param')
-        const { chainId } = c.req.valid('query')
-        try {
-          const { snapshot } = await VerifiedTokens.remove(db, chainId, address, {
-            ...ifMatch(c),
-          })
+        OpenApi.describeRoute({
+          operationId: 'listVerifiedTokenRequests',
+          responses: OpenApi.responses({
+            success: {
+              description: 'Verification requests.',
+              schema: schema.listVerifiedTokenRequests.Response,
+            },
+          }),
+          summary: 'List token requests',
+          tags: ['Verified Tokens'],
+        }),
+        async (c) => {
+          const db = Db.get(c.get('db'))
+          const { status } = c.req.valid('query')
+          const records = await VerifiedTokenRequests.listByStatus(db, status)
           return c.json(
-            Response.validated(schema.deleteVerifiedToken.Response, {
-              version: snapshot.version,
+            Response.validated(schema.listVerifiedTokenRequests.Response, {
+              data: records.map((record) => ({
+                ...VerifiedTokenRequests.toRequest(record),
+                orgName: record.orgName,
+              })),
             }),
           )
-        } catch (cause) {
-          return mutationError(c, cause)
-        }
-      },
-    )
-    .get(
-      '/:address/logo',
-      OpenApi.validate('param', schema.Params, {
-        code: 'address_invalid',
-        message: 'Invalid token address',
-      }),
-      OpenApi.validate('query', schema.getVerifiedTokenLogo.Query, {
-        code: 'query_invalid',
-        message: 'Invalid query parameters',
-      }),
-      async (c) => {
-        const assets = c.get('assets')
-        const { address } = c.req.valid('param')
-        const { chainId } = c.req.valid('query')
-        const logo = await assets?.get(logoKey(chainId, address))
-        if (!logo)
-          return Response.error(c, {
-            code: 'logo_not_found',
-            message: 'Logo not found.',
-            status: 404,
-          })
-        c.header('Content-Type', logo.contentType)
-        return c.body(logo.body)
-      },
-    )
-    .put(
-      '/:address/logo',
-      OpenApi.validate('param', schema.Params, {
-        code: 'address_invalid',
-        message: 'Invalid token address',
-      }),
-      OpenApi.validate('query', schema.uploadVerifiedTokenLogo.Query, {
-        code: 'query_invalid',
-        message: 'Invalid query parameters',
-      }),
-      OpenApi.describeRoute({
-        operationId: 'uploadVerifiedTokenLogo',
-        responses: OpenApi.responses({
-          errors: {
-            404: 'Asset uploads are not enabled.',
-            413: 'Logo exceeds the size limit.',
-            415: 'Body is not `image/svg+xml`.',
-          },
-          success: {
-            description: 'Stored logo location.',
-            schema: schema.uploadVerifiedTokenLogo.Response,
-          },
+        },
+      )
+      .post(
+        '/requests/:requestId/approve',
+        OpenApi.validate('param', schema.RequestParams, {
+          code: 'param_invalid',
+          message: 'Invalid request id',
         }),
-        summary: 'Upload verified-token logo',
-        tags: ['Verified Tokens'],
-      }),
-      async (c) => {
-        const assets = c.get('assets')
-        if (!assets?.put) return assetsNotEnabled(c)
-        const { address } = c.req.valid('param')
-        const { chainId } = c.req.valid('query')
-        const contentType = c.req.header('content-type')?.split(';')[0]?.trim().toLowerCase()
-        if (contentType !== 'image/svg+xml')
-          return Response.error(c, {
-            code: 'unsupported_media_type',
-            message: 'Logo uploads must be `image/svg+xml`.',
-            status: 415,
-          })
-        const body = await c.req.arrayBuffer()
-        if (body.byteLength === 0)
-          return Response.error(c, {
-            code: 'body_invalid',
-            message: 'Logo body is empty.',
-            status: 400,
-          })
-        if (body.byteLength > maxLogoBytes)
-          return Response.error(c, {
-            code: 'payload_too_large',
-            message: `Logo exceeds the ${maxLogoBytes / 1024} KiB limit.`,
-            status: 413,
-          })
-        // Keyed as the main API's loader reads it (curated icon takes precedence).
-        const key = logoKey(chainId, address)
-        await assets.put(key, { body, contentType: 'image/svg+xml' })
-        return c.json(
-          Response.validated(schema.uploadVerifiedTokenLogo.Response, {
-            key,
-            path: `/assets/${key}`,
+        OpenApi.describeRoute({
+          operationId: 'approveVerifiedTokenRequest',
+          responses: OpenApi.responses({
+            errors: {
+              404: 'Verification request not found.',
+              409: 'Request already reviewed, or the token conflicts with the verified list.',
+            },
+            success: {
+              description: 'Approved request; the token is now verified.',
+              schema: schema.reviewVerifiedTokenRequest.Response,
+            },
           }),
-        )
-      },
-    )
+          summary: 'Approve token request',
+          tags: ['Verified Tokens'],
+        }),
+        async (c) => {
+          const db = Db.get(c.get('db'))
+          const { requestId } = c.req.valid('param')
+          try {
+            const record = await VerifiedTokenRequests.get(db, requestId)
+            if (!record) return requestNotFound(c)
+            if (record.status !== 'pending') return requestNotPending(c)
+            // Skip creation when the token is already listed: the token create
+            // and the request review commit separately, so a crash between them
+            // leaves the request pending; re-approving converges here.
+            const snapshot = await VerifiedTokens.read(db, record.chainId)
+            if (!snapshot?.byAddress.has(record.address)) {
+              // A requester-uploaded logo publishes to the asset store first,
+              // so an upload failure leaves no token behind.
+              if (record.logo !== null) {
+                const assets = c.get('assets')
+                if (!assets?.put) return assetsNotEnabled(c)
+                await assets.put(logoKey(record.chainId, record.address), {
+                  body: encodeLogo(record.logo),
+                  contentType: 'image/svg+xml',
+                })
+              }
+              await VerifiedTokens.create(db, {
+                address: record.address,
+                chainId: record.chainId,
+                currency: record.currency,
+                decimals: record.decimals,
+                ...(record.logoUri === null ? {} : { logoUri: record.logoUri }),
+                name: record.name,
+                symbol: record.symbol,
+              })
+            }
+            const updated = await VerifiedTokenRequests.review(db, requestId, {
+              reviewedBy: c.get('identity')!.email,
+              status: 'approved',
+            })
+            if (!updated) return requestNotPending(c)
+            return c.json(
+              Response.validated(schema.reviewVerifiedTokenRequest.Response, {
+                data: await withOrgName(db, updated),
+              }),
+            )
+          } catch (cause) {
+            return mutationError(c, cause)
+          }
+        },
+      )
+      .post(
+        '/requests/:requestId/deny',
+        OpenApi.validate('param', schema.RequestParams, {
+          code: 'param_invalid',
+          message: 'Invalid request id',
+        }),
+        OpenApi.validate('json', schema.denyVerifiedTokenRequest.Body, {
+          code: 'body_invalid',
+          message: 'Invalid request body',
+        }),
+        OpenApi.describeRoute({
+          operationId: 'denyVerifiedTokenRequest',
+          responses: OpenApi.responses({
+            errors: {
+              404: 'Verification request not found.',
+              409: 'Request already reviewed.',
+            },
+            success: {
+              description: 'Denied request.',
+              schema: schema.reviewVerifiedTokenRequest.Response,
+            },
+          }),
+          summary: 'Deny token request',
+          tags: ['Verified Tokens'],
+        }),
+        async (c) => {
+          const db = Db.get(c.get('db'))
+          const { requestId } = c.req.valid('param')
+          const body = c.req.valid('json')
+          try {
+            const record = await VerifiedTokenRequests.get(db, requestId)
+            if (!record) return requestNotFound(c)
+            const updated = await VerifiedTokenRequests.review(db, requestId, {
+              ...(body.reviewNote ? { reviewNote: body.reviewNote } : {}),
+              reviewedBy: c.get('identity')!.email,
+              status: 'denied',
+            })
+            if (!updated) return requestNotPending(c)
+            return c.json(
+              Response.validated(schema.reviewVerifiedTokenRequest.Response, {
+                data: await withOrgName(db, updated),
+              }),
+            )
+          } catch (cause) {
+            return mutationError(c, cause)
+          }
+        },
+      )
+  )
+}
+
+/** Attaches the requesting org's current name to a request's wire shape. */
+async function withOrgName(db: Db.Db, record: VerifiedTokenRequests.Record) {
+  const org = await Organizations.get(db, record.orgId)
+  return { ...VerifiedTokenRequests.toRequest(record), orgName: org?.name ?? null }
+}
+
+function requestNotFound(c: Context<App.Environment>) {
+  return Response.error(c, {
+    code: 'verified_token_request_not_found',
+    message: 'Verification request not found',
+    status: 404,
+  })
+}
+
+function requestNotPending(c: Context<App.Environment>) {
+  return Response.error(c, {
+    code: 'request_not_pending',
+    message: 'Request has already been reviewed',
+    status: 409,
+  })
 }
 
 /** Largest accepted logo upload (SVG icons are tiny; this is generous). */