From fdc0603f5e0c34e58c1639482527dd18bf97a213 Mon Sep 17 00:00:00 2001
From: Marco Filho <markimkr@gmail.com>
Date: Tue, 15 Sep 2026 06:06:00 -0300
Subject: [PATCH 01/17] [196] Send HMA bank metadata in the request body

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 server/services/hmaService/index.test.ts | 46 ++++++++++++++++++++++++
 server/services/hmaService/index.ts      | 20 +++++------
 2 files changed, 54 insertions(+), 12 deletions(-)

diff --git a/server/services/hmaService/index.test.ts b/server/services/hmaService/index.test.ts
index a51b9be6e..fb8bf781d 100644
--- a/server/services/hmaService/index.test.ts
+++ b/server/services/hmaService/index.test.ts
@@ -383,4 +383,50 @@ describe('HmaService', () => {
       expect(result.credentials_schema).toBeNull();
     });
   });
+
+  describe('addContentToBank', () => {
+    it('sends the url as a query param and the metadata in the JSON body', async () => {
+      const fetchHTTP = jest
+        .fn()
+        .mockResolvedValue(ok({ id: 7, signals: { pdq: 'abc' } }));
+      const svc = makeService(fetchHTTP);
+
+      const result = await svc.addContentToBank('COOP_ORG1_BANK', {
+        url: 'https://cdn.example.com/a.jpg?sig=1',
+        metadata: {
+          content_id: 'type1:item1',
+          json: { source: 'ncmec_report' },
+        },
+      });
+
+      expect(result).toEqual({ id: 7, signals: { pdq: 'abc' } });
+      expect(fetchHTTP).toHaveBeenCalledTimes(1);
+      const call = fetchHTTP.mock.calls[0][0];
+      const url = new URL(call.url);
+      expect(url.pathname).toBe('/c/bank/COOP_ORG1_BANK/content');
+      expect([...url.searchParams.keys()]).toEqual(['url']);
+      expect(url.searchParams.get('url')).toBe(
+        'https://cdn.example.com/a.jpg?sig=1',
+      );
+      expect(call.method).toBe('post');
+      expect(call.headers).toEqual({ 'Content-Type': 'application/json' });
+      expect(jsonParse(call.body)).toEqual({
+        metadata: {
+          content_id: 'type1:item1',
+          json: { source: 'ncmec_report' },
+        },
+      });
+    });
+
+    it('throws when HMA rejects the content', async () => {
+      const fetchHTTP = jest.fn().mockResolvedValue(fail(400));
+      const svc = makeService(fetchHTTP);
+
+      await expect(
+        svc.addContentToBank('COOP_ORG1_BANK', {
+          url: 'https://cdn.example.com/a.jpg',
+        }),
+      ).rejects.toThrow('Failed to add content to bank: 400');
+    });
+  });
 });
diff --git a/server/services/hmaService/index.ts b/server/services/hmaService/index.ts
index be81a152d..3a61f2cfc 100644
--- a/server/services/hmaService/index.ts
+++ b/server/services/hmaService/index.ts
@@ -814,21 +814,17 @@ export class HmaService {
 
     let response;
     if (url) {
-      // URL-based content
-      const params = new URLSearchParams();
-      params.append('url', url);
-      if (metadata) {
-        if (metadata.content_id)
-          params.append('content_id', metadata.content_id);
-        if (metadata.content_uri)
-          params.append('content_uri', metadata.content_uri);
-        if (metadata.json)
-          params.append('metadata', jsonStringify(metadata.json));
-      }
-
+      // HMA reads `metadata` from the JSON body only; query-param metadata is dropped.
+      const params = new URLSearchParams({ url });
       response = await this.fetchHTTP({
         url: `${this.hmaServiceUrl}/c/bank/${bankName}/content?${params.toString()}`,
         method: 'post',
+        ...(metadata
+          ? {
+              body: jsonStringify({ metadata }),
+              headers: { 'Content-Type': 'application/json' },
+            }
+          : {}),
         handleResponseBody: 'as-json',
       });
     } else {

From 2246834e8ddd8475652f552e1b75c24e05d13c1d Mon Sep 17 00:00:00 2001
From: Marco Filho <markimkr@gmail.com>
Date: Tue, 15 Sep 2026 06:10:00 -0300
Subject: [PATCH 02/17] [196] Add a hash bank setting for reported NCMEC media

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 client/src/graphql/generated.ts               | 13 +++
 .../src/webpages/settings/NCMECSettings.tsx   | 47 +++++++++++
 ..._media_hash_bank_to_ncmec_org_settings.sql | 11 +++
 server/graphql/generated.ts                   |  7 ++
 server/graphql/modules/ncmec.resolver.test.ts | 82 ++++++++++++++++++-
 server/graphql/modules/ncmec.ts               | 10 +++
 .../modules/ncmecOrgSettingsValidation.ts     | 25 ++++++
 server/services/ncmecService/dbTypes.ts       |  1 +
 server/services/ncmecService/ncmecService.ts  |  4 +
 .../ncmec-report-submission.integ.test.ts     |  1 +
 .../test/integ/ncmec-submission.integ.test.ts |  1 +
 11 files changed, 200 insertions(+), 2 deletions(-)
 create mode 100644 db/src/scripts/api-server-pg/2026.09.15T04.40.33.add_reported_media_hash_bank_to_ncmec_org_settings.sql

diff --git a/client/src/graphql/generated.ts b/client/src/graphql/generated.ts
index 9e79aa587..ad769f9ea 100644
--- a/client/src/graphql/generated.ts
+++ b/client/src/graphql/generated.ts
@@ -3147,6 +3147,7 @@ export type GQLNcmecOrgSettings = {
   readonly ncmecAdditionalInfoEndpoint?: Maybe<Scalars['String']['output']>;
   readonly ncmecPreservationEndpoint?: Maybe<Scalars['String']['output']>;
   readonly password: Scalars['String']['output'];
+  readonly reportedMediaHashBankId?: Maybe<Scalars['ID']['output']>;
   readonly termsOfService?: Maybe<Scalars['String']['output']>;
   readonly username: Scalars['String']['output'];
 };
@@ -3167,6 +3168,7 @@ export type GQLNcmecOrgSettingsInput = {
   readonly ncmecAdditionalInfoEndpoint?: InputMaybe<Scalars['String']['input']>;
   readonly ncmecPreservationEndpoint?: InputMaybe<Scalars['String']['input']>;
   readonly password: Scalars['String']['input'];
+  readonly reportedMediaHashBankId?: InputMaybe<Scalars['ID']['input']>;
   readonly termsOfService?: InputMaybe<Scalars['String']['input']>;
   readonly username: Scalars['String']['input'];
 };
@@ -25059,7 +25061,13 @@ export type GQLNcmecOrgSettingsQuery = {
     readonly contactPersonPhone?: string | null;
     readonly mediaReviewRequirement?: GQLNcmecMediaReviewRequirement | null;
     readonly minMediaToReview?: number | null;
+    readonly reportedMediaHashBankId?: string | null;
   } | null;
+  readonly hashBanks: ReadonlyArray<{
+    readonly __typename: 'HashBank';
+    readonly id: string;
+    readonly name: string;
+  }>;
   readonly myOrg?: {
     readonly __typename: 'Org';
     readonly hasNCMECReportingEnabled: boolean;
@@ -44311,6 +44319,11 @@ export const GQLNcmecOrgSettingsDocument = gql`
       contactPersonPhone
       mediaReviewRequirement
       minMediaToReview
+      reportedMediaHashBankId
+    }
+    hashBanks {
+      id
+      name
     }
     myOrg {
       hasNCMECReportingEnabled
diff --git a/client/src/webpages/settings/NCMECSettings.tsx b/client/src/webpages/settings/NCMECSettings.tsx
index 1fd50124c..096e2d279 100644
--- a/client/src/webpages/settings/NCMECSettings.tsx
+++ b/client/src/webpages/settings/NCMECSettings.tsx
@@ -48,6 +48,11 @@ gql`
       contactPersonPhone
       mediaReviewRequirement
       minMediaToReview
+      reportedMediaHashBankId
+    }
+    hashBanks {
+      id
+      name
     }
     myOrg {
       hasNCMECReportingEnabled
@@ -83,6 +88,7 @@ type NcmecSettings = {
   contactPersonPhone: string;
   mediaReviewRequirement: GQLNcmecMediaReviewRequirement;
   minMediaToReview: string;
+  reportedMediaHashBankId: string;
 };
 
 export default function NCMECSettings() {
@@ -104,6 +110,7 @@ export default function NCMECSettings() {
     contactPersonPhone: '',
     mediaReviewRequirement: GQLNcmecMediaReviewRequirement.All,
     minMediaToReview: '1',
+    reportedMediaHashBankId: '',
   });
 
   const { loading, error, data } = useGQLNcmecOrgSettingsQuery({
@@ -149,6 +156,8 @@ export default function NCMECSettings() {
           data.ncmecOrgSettings.mediaReviewRequirement ??
           GQLNcmecMediaReviewRequirement.All,
         minMediaToReview: String(data.ncmecOrgSettings.minMediaToReview ?? 1),
+        reportedMediaHashBankId:
+          data.ncmecOrgSettings.reportedMediaHashBankId ?? '',
       });
     }
   }, [data?.ncmecOrgSettings]);
@@ -237,6 +246,7 @@ export default function NCMECSettings() {
           contactPersonPhone: settings.contactPersonPhone || null,
           mediaReviewRequirement: settings.mediaReviewRequirement,
           minMediaToReview: isMinimumPolicy ? parsedMinMedia : null,
+          reportedMediaHashBankId: settings.reportedMediaHashBankId || null,
         },
       },
     });
@@ -573,6 +583,43 @@ export default function NCMECSettings() {
             </Text>
           </div>
 
+          <div className="flex flex-col gap-2">
+            <Label
+              htmlFor="reportedMediaHashBankId"
+              className="text-sm font-medium"
+            >
+              Hash bank for reported media
+            </Label>
+            <Select
+              value={settings.reportedMediaHashBankId || '__none__'}
+              onValueChange={(value) =>
+                setSettings({
+                  ...settings,
+                  reportedMediaHashBankId: value === '__none__' ? '' : value,
+                })
+              }
+            >
+              <SelectTrigger id="reportedMediaHashBankId">
+                <SelectValue placeholder="Don't add reported media to a bank" />
+              </SelectTrigger>
+              <SelectContent>
+                <SelectItem value="__none__">
+                  Don&apos;t add reported media to a bank
+                </SelectItem>
+                {(data?.hashBanks ?? []).map((bank) => (
+                  <SelectItem key={bank.id} value={bank.id}>
+                    {bank.name}
+                  </SelectItem>
+                ))}
+              </SelectContent>
+            </Select>
+            <Text size="XS" className="text-gray-500">
+              Media from each report accepted by NCMEC is added to this bank so
+              it can be matched if it is uploaded again. Only applies when
+              reports are sent to the NCMEC production endpoint.
+            </Text>
+          </div>
+
           <div className="flex flex-col gap-2">
             <Label
               htmlFor="defaultInternetDetailType"
diff --git a/db/src/scripts/api-server-pg/2026.09.15T04.40.33.add_reported_media_hash_bank_to_ncmec_org_settings.sql b/db/src/scripts/api-server-pg/2026.09.15T04.40.33.add_reported_media_hash_bank_to_ncmec_org_settings.sql
new file mode 100644
index 000000000..617493eef
--- /dev/null
+++ b/db/src/scripts/api-server-pg/2026.09.15T04.40.33.add_reported_media_hash_bank_to_ncmec_org_settings.sql
@@ -0,0 +1,11 @@
+ALTER TABLE ncmec_reporting.ncmec_org_settings
+  ADD COLUMN IF NOT EXISTS reported_media_hash_bank_id integer NULL;
+
+ALTER TABLE ncmec_reporting.ncmec_org_settings
+  ADD CONSTRAINT ncmec_org_settings_reported_media_hash_bank_fkey
+  FOREIGN KEY (reported_media_hash_bank_id)
+  REFERENCES public.hash_banks(id)
+  ON DELETE SET NULL;
+
+COMMENT ON COLUMN ncmec_reporting.ncmec_org_settings.reported_media_hash_bank_id IS
+  'When set, media from accepted production NCMEC reports is added to this hash bank.';
diff --git a/server/graphql/generated.ts b/server/graphql/generated.ts
index 75338fcf7..9be62294f 100644
--- a/server/graphql/generated.ts
+++ b/server/graphql/generated.ts
@@ -3215,6 +3215,7 @@ export type GQLNcmecOrgSettings = {
   readonly ncmecAdditionalInfoEndpoint?: Maybe<Scalars['String']['output']>;
   readonly ncmecPreservationEndpoint?: Maybe<Scalars['String']['output']>;
   readonly password: Scalars['String']['output'];
+  readonly reportedMediaHashBankId?: Maybe<Scalars['ID']['output']>;
   readonly termsOfService?: Maybe<Scalars['String']['output']>;
   readonly username: Scalars['String']['output'];
 };
@@ -3235,6 +3236,7 @@ export type GQLNcmecOrgSettingsInput = {
   readonly ncmecAdditionalInfoEndpoint?: InputMaybe<Scalars['String']['input']>;
   readonly ncmecPreservationEndpoint?: InputMaybe<Scalars['String']['input']>;
   readonly password: Scalars['String']['input'];
+  readonly reportedMediaHashBankId?: InputMaybe<Scalars['ID']['input']>;
   readonly termsOfService?: InputMaybe<Scalars['String']['input']>;
   readonly username: Scalars['String']['input'];
 };
@@ -11866,6 +11868,11 @@ export type GQLNcmecOrgSettingsResolvers<
     ContextType
   >;
   password?: Resolver<GQLResolversTypes['String'], ParentType, ContextType>;
+  reportedMediaHashBankId?: Resolver<
+    Maybe<GQLResolversTypes['ID']>,
+    ParentType,
+    ContextType
+  >;
   termsOfService?: Resolver<
     Maybe<GQLResolversTypes['String']>,
     ParentType,
diff --git a/server/graphql/modules/ncmec.resolver.test.ts b/server/graphql/modules/ncmec.resolver.test.ts
index 169cf9953..66097e08f 100644
--- a/server/graphql/modules/ncmec.resolver.test.ts
+++ b/server/graphql/modules/ncmec.resolver.test.ts
@@ -17,15 +17,21 @@ const VALID_INPUT = {
 
 function makeCtx(permissions: readonly UserPermission[]) {
   const updateNcmecOrgSettings = jest.fn(async () => undefined);
+  const getBankById = jest.fn(async (orgId: string, id: number) =>
+    orgId === 'org-1' && id === 42 ? { id: 42, org_id: 'org-1' } : null,
+  );
   const ctx = {
     getUser: () => ({
       id: 'user-1',
       orgId: 'org-1',
       getPermissions: () => permissions,
     }),
-    services: { NcmecService: { updateNcmecOrgSettings } },
+    services: {
+      NcmecService: { updateNcmecOrgSettings },
+      HMAHashBankService: { getBankById },
+    },
   };
-  return { ctx, updateNcmecOrgSettings };
+  return { ctx, updateNcmecOrgSettings, getBankById };
 }
 
 describe('updateNcmecOrgSettings media review policy', () => {
@@ -140,3 +146,75 @@ describe('updateNcmecOrgSettings media review policy', () => {
     expect(updateNcmecOrgSettings).not.toHaveBeenCalled();
   });
 });
+
+describe('updateNcmecOrgSettings reported media hash bank', () => {
+  it('persists a bank that belongs to the org', async () => {
+    const { ctx, updateNcmecOrgSettings, getBankById } = makeCtx([
+      UserPermission.MANAGE_ORG,
+    ]);
+    await Mutation.updateNcmecOrgSettings(
+      {},
+      { input: { ...VALID_INPUT, reportedMediaHashBankId: '42' } },
+      ctx,
+    );
+    expect(getBankById).toHaveBeenCalledWith('org-1', 42);
+    expect(updateNcmecOrgSettings).toHaveBeenCalledWith(
+      expect.objectContaining({ reportedMediaHashBankId: 42 }),
+    );
+  });
+
+  it('clears the bank when none is supplied', async () => {
+    const { ctx, updateNcmecOrgSettings, getBankById } = makeCtx([
+      UserPermission.MANAGE_ORG,
+    ]);
+    await Mutation.updateNcmecOrgSettings(
+      {},
+      { input: { ...VALID_INPUT, reportedMediaHashBankId: null } },
+      ctx,
+    );
+    expect(getBankById).not.toHaveBeenCalled();
+    expect(updateNcmecOrgSettings).toHaveBeenCalledWith(
+      expect.objectContaining({ reportedMediaHashBankId: null }),
+    );
+  });
+
+  it('rejects a bank from another org and a missing bank with the same message', async () => {
+    const { ctx, updateNcmecOrgSettings, getBankById } = makeCtx([
+      UserPermission.MANAGE_ORG,
+    ]);
+    getBankById.mockImplementation(async (orgId: string, id: number) =>
+      orgId === 'org-2' && id === 7 ? { id: 7, org_id: 'org-2' } : null,
+    );
+    const errorFor = async (id: string) =>
+      Mutation.updateNcmecOrgSettings(
+        {},
+        { input: { ...VALID_INPUT, reportedMediaHashBankId: id } },
+        ctx,
+      ).then(
+        () => undefined,
+        (e: Error) => e.message,
+      );
+
+    const otherOrgMessage = await errorFor('7');
+    const missingMessage = await errorFor('999');
+
+    expect(otherOrgMessage).toBeDefined();
+    expect(otherOrgMessage).toBe(missingMessage);
+    expect(updateNcmecOrgSettings).not.toHaveBeenCalled();
+  });
+
+  it('rejects a non-numeric bank id', async () => {
+    const { ctx, updateNcmecOrgSettings, getBankById } = makeCtx([
+      UserPermission.MANAGE_ORG,
+    ]);
+    await expect(
+      Mutation.updateNcmecOrgSettings(
+        {},
+        { input: { ...VALID_INPUT, reportedMediaHashBankId: '4x2' } },
+        ctx,
+      ),
+    ).rejects.toThrow('reportedMediaHashBankId');
+    expect(getBankById).not.toHaveBeenCalled();
+    expect(updateNcmecOrgSettings).not.toHaveBeenCalled();
+  });
+});
diff --git a/server/graphql/modules/ncmec.ts b/server/graphql/modules/ncmec.ts
index 61e3090f6..514c455ba 100644
--- a/server/graphql/modules/ncmec.ts
+++ b/server/graphql/modules/ncmec.ts
@@ -14,6 +14,7 @@ import {
   isValidContactEmail,
   parseInternetDetailType,
   parseMediaReviewPolicy,
+  parseReportedMediaHashBankId,
   type NcmecOrgSettingsInputShape,
 } from './ncmecOrgSettingsValidation.js';
 
@@ -79,6 +80,7 @@ const typeDefs = /* GraphQL */ `
     contactPersonPhone: String
     mediaReviewRequirement: NcmecMediaReviewRequirement
     minMediaToReview: Int
+    reportedMediaHashBankId: ID
   }
 
   input NcmecOrgSettingsInput {
@@ -99,6 +101,7 @@ const typeDefs = /* GraphQL */ `
     contactPersonPhone: String
     mediaReviewRequirement: NcmecMediaReviewRequirement
     minMediaToReview: Int
+    reportedMediaHashBankId: ID
   }
 
   type UpdateNcmecOrgSettingsResponse {
@@ -349,6 +352,12 @@ const Mutation: GQLMutationResolvers = {
     const { mediaReviewRequirement, minMediaToReview } =
       parseMediaReviewPolicy(input);
 
+    const reportedMediaHashBankId = await parseReportedMediaHashBankId(
+      input,
+      user.orgId,
+      context.services.HMAHashBankService,
+    );
+
     await context.services.NcmecService.updateNcmecOrgSettings({
       orgId: user.orgId,
       username,
@@ -368,6 +377,7 @@ const Mutation: GQLMutationResolvers = {
       contactPersonPhone: input.contactPersonPhone ?? null,
       mediaReviewRequirement,
       minMediaToReview,
+      reportedMediaHashBankId,
     });
 
     return { success: true };
diff --git a/server/graphql/modules/ncmecOrgSettingsValidation.ts b/server/graphql/modules/ncmecOrgSettingsValidation.ts
index 9d5ee4da0..af538ffb5 100644
--- a/server/graphql/modules/ncmecOrgSettingsValidation.ts
+++ b/server/graphql/modules/ncmecOrgSettingsValidation.ts
@@ -1,3 +1,4 @@
+import { type HmaService } from '../../services/hmaService/index.js';
 import { userInputError } from '../utils/errors.js';
 
 /** Input shape for updateNcmecOrgSettings; mirrors NcmecOrgSettingsInput so the
@@ -20,6 +21,7 @@ export type NcmecOrgSettingsInputShape = {
   contactPersonPhone?: string | null;
   mediaReviewRequirement?: string | null;
   minMediaToReview?: number | null;
+  reportedMediaHashBankId?: string | null;
 };
 
 const VALID_NCMEC_MEDIA_REVIEW_REQUIREMENTS = ['ALL', 'MINIMUM'] as const;
@@ -99,3 +101,26 @@ export function parseMediaReviewPolicy(input: NcmecOrgSettingsInputShape): {
   }
   return { mediaReviewRequirement: requirement, minMediaToReview };
 }
+
+/** Returns the bank id to store, or null to clear it. A bank that is missing
+ * and a bank owned by another org get the same error, so callers cannot probe
+ * other orgs' bank ids. */
+export async function parseReportedMediaHashBankId(
+  input: NcmecOrgSettingsInputShape,
+  orgId: string,
+  hmaService: Pick<HmaService, 'getBankById'>,
+): Promise<number | null> {
+  const raw = input.reportedMediaHashBankId?.trim() ?? '';
+  if (raw === '') {
+    return null;
+  }
+  if (!/^\d+$/.test(raw)) {
+    throw userInputError('reportedMediaHashBankId must be a hash bank ID.');
+  }
+  const bankId = Number(raw);
+  const bank = await hmaService.getBankById(orgId, bankId);
+  if (!bank) {
+    throw userInputError('Selected hash bank was not found.');
+  }
+  return bankId;
+}
diff --git a/server/services/ncmecService/dbTypes.ts b/server/services/ncmecService/dbTypes.ts
index a26c57f7c..0c8d581e9 100644
--- a/server/services/ncmecService/dbTypes.ts
+++ b/server/services/ncmecService/dbTypes.ts
@@ -27,6 +27,7 @@ export type NcmecReportingServicePg = {
     contact_person_phone?: string | null;
     media_review_requirement?: 'ALL' | 'MINIMUM';
     min_media_to_review?: number | null;
+    reported_media_hash_bank_id?: number | null;
     created_at: GeneratedAlways<Date>;
     updated_at: GeneratedAlways<Date>;
   } & (
diff --git a/server/services/ncmecService/ncmecService.ts b/server/services/ncmecService/ncmecService.ts
index 67b18fbf0..61ae969a5 100644
--- a/server/services/ncmecService/ncmecService.ts
+++ b/server/services/ncmecService/ncmecService.ts
@@ -238,6 +238,7 @@ export class NcmecService {
         'contact_person_phone as contactPersonPhone',
         'media_review_requirement as mediaReviewRequirement',
         'min_media_to_review as minMediaToReview',
+        'reported_media_hash_bank_id as reportedMediaHashBankId',
       ])
       .where('org_id', '=', orgId)
       .executeTakeFirst();
@@ -264,6 +265,7 @@ export class NcmecService {
     contactPersonPhone: string | null;
     mediaReviewRequirement: 'ALL' | 'MINIMUM';
     minMediaToReview: number | null;
+    reportedMediaHashBankId: number | null;
   }) {
     await this.pgQuery
       .insertInto('ncmec_reporting.ncmec_org_settings')
@@ -288,6 +290,7 @@ export class NcmecService {
         contact_person_phone: params.contactPersonPhone ?? null,
         media_review_requirement: params.mediaReviewRequirement,
         min_media_to_review: params.minMediaToReview ?? null,
+        reported_media_hash_bank_id: params.reportedMediaHashBankId,
         actions_to_run_upon_report_creation: null,
         policies_applied_to_actions_run_on_report_creation: null,
       })
@@ -313,6 +316,7 @@ export class NcmecService {
           contact_person_phone: params.contactPersonPhone ?? null,
           media_review_requirement: params.mediaReviewRequirement,
           min_media_to_review: params.minMediaToReview ?? null,
+          reported_media_hash_bank_id: params.reportedMediaHashBankId,
         }),
       )
       .execute();
diff --git a/server/test/integ/ncmec-report-submission.integ.test.ts b/server/test/integ/ncmec-report-submission.integ.test.ts
index 02bbc358b..01a61ea28 100644
--- a/server/test/integ/ncmec-report-submission.integ.test.ts
+++ b/server/test/integ/ncmec-report-submission.integ.test.ts
@@ -100,6 +100,7 @@ describe('NCMEC report and submission (integration)', () => {
       contactPersonPhone: null,
       mediaReviewRequirement: 'ALL',
       minMediaToReview: null,
+      reportedMediaHashBankId: null,
     });
   }, 60_000);
 
diff --git a/server/test/integ/ncmec-submission.integ.test.ts b/server/test/integ/ncmec-submission.integ.test.ts
index b979fcf8f..896c0c5e7 100644
--- a/server/test/integ/ncmec-submission.integ.test.ts
+++ b/server/test/integ/ncmec-submission.integ.test.ts
@@ -48,6 +48,7 @@ describe('NCMEC submitReport (integration)', () => {
       contactPersonPhone: null,
       mediaReviewRequirement: 'ALL',
       minMediaToReview: null,
+      reportedMediaHashBankId: null,
     });
 
     const stub = makeStubFetchHTTP(reportId, fileId, {

From dda7dbb059b192356eccb248930174e6ae2d4295 Mon Sep 17 00:00:00 2001
From: Marco Filho <markimkr@gmail.com>
Date: Tue, 15 Sep 2026 06:10:59 -0300
Subject: [PATCH 03/17] [196] Add reported media to the hash bank once NCMEC
 accepts a report

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 docs/integrations/ncmec.md                    |   1 +
 .../addReportedMediaToHashBank.test.ts        | 178 ++++++++++++++++++
 .../addReportedMediaToHashBank.ts             |  94 +++++++++
 .../services/ncmecService/ncmecReporting.ts   |  14 ++
 server/services/ncmecService/ncmecService.ts  |   3 +
 .../test/fixtureHelpers/makeStubFetchHTTP.ts  |  18 +-
 .../test/integ/ncmec-submission.integ.test.ts | 168 +++++++++++++++--
 7 files changed, 457 insertions(+), 19 deletions(-)
 create mode 100644 server/services/ncmecService/addReportedMediaToHashBank.test.ts
 create mode 100644 server/services/ncmecService/addReportedMediaToHashBank.ts

diff --git a/docs/integrations/ncmec.md b/docs/integrations/ncmec.md
index 20b6b56a9..29e160fc7 100644
--- a/docs/integrations/ncmec.md
+++ b/docs/integrations/ncmec.md
@@ -45,6 +45,7 @@ Configure NCMEC reporting under **Settings** → **NCMEC Settings**.
 | **Contact Person (for law enforcement)** | A contact person law enforcement can reach (other than the reporting contact email): first name, last name, email, phone.                                                                                                                           |
 | **More Info URL**                        | URL for additional information about your reporting process (e.g. `https://yourcompany.com/ncmec-info`). Used as the web page URL when "Default internet detail type" is set to "Web page."                                                         |
 | **Default NCMEC Queue**                  | When reviewers click "Enqueue to NCMEC," jobs are sent to this queue. Leave as "Use org default queue" to fall back to the organization's default queue.                                                                                            |
+| **Hash Bank for Reported Media**         | Media from each CyberTip accepted by NCMEC is added to this hash bank so it can be matched if it is uploaded again. Only applies to [production submissions](#test-vs-production-submissions).                                                      |
 | **Default Internet Detail Type**         | The incident context (channel/medium) included in every CyberTip: Web page, Email, Newsgroup, Chat/IM, Online gaming, Cell phone, Non-internet, or Peer-to-peer.                                                                                    |
 | **NCMEC Additional Info Endpoint**       | Webhook URL Coop calls before submitting a CyberTip to fetch enriched user and media metadata. See [Additional Info Endpoint](#additional-info-endpoint) below. Strongly recommended as without it, CyberTips are submitted with minimal user data. |
 | **NCMEC Preservation Endpoint**          | Webhook URL Coop calls after a successful CyberTip submission with the report ID. See [Preservation Endpoint](#preservation-endpoint) below.                                                                                                        |
diff --git a/server/services/ncmecService/addReportedMediaToHashBank.test.ts b/server/services/ncmecService/addReportedMediaToHashBank.test.ts
new file mode 100644
index 000000000..29654d163
--- /dev/null
+++ b/server/services/ncmecService/addReportedMediaToHashBank.test.ts
@@ -0,0 +1,178 @@
+import { jsonStringify } from '../../utils/encoding.js';
+import type { HashBank } from '../hmaService/index.js';
+import {
+  addReportedMediaToHashBank,
+  type AddReportedMediaToHashBankDeps,
+} from './addReportedMediaToHashBank.js';
+
+const BANK: HashBank = {
+  id: 42,
+  name: 'Reported CSAM',
+  hma_name: 'COOP_ORG1_REPORTED_CSAM',
+  description: null,
+  enabled_ratio: 1,
+  org_id: 'org1',
+  created_at: new Date(),
+  updated_at: new Date(),
+};
+
+const MEDIA = [
+  { id: 'img-1', typeId: 'type-a', url: 'https://cdn.example.com/1.jpg?sig=x' },
+  { id: 'img-2', typeId: 'type-a', url: 'https://cdn.example.com/2.jpg' },
+  { id: 'vid-1', typeId: 'type-b', url: 'https://cdn.example.com/1.mp4' },
+];
+
+function makeDeps(
+  overrides: Partial<AddReportedMediaToHashBankDeps['hmaService']> = {},
+) {
+  const deps = {
+    hmaService: {
+      getBankById: jest.fn().mockResolvedValue(BANK),
+      addContentToBank: jest
+        .fn()
+        .mockResolvedValue({ id: 1, signals: { pdq: 'abc' } }),
+      ...overrides,
+    },
+    logError: jest.fn(),
+  };
+  return deps as typeof deps & AddReportedMediaToHashBankDeps;
+}
+
+describe('addReportedMediaToHashBank', () => {
+  it('does nothing when the org has no bank selected', async () => {
+    const deps = makeDeps();
+
+    await addReportedMediaToHashBank(deps, {
+      orgId: 'org1',
+      bankId: null,
+      ncmecReportId: '123',
+      media: MEDIA,
+    });
+
+    expect(deps.hmaService.getBankById).not.toHaveBeenCalled();
+    expect(deps.hmaService.addContentToBank).not.toHaveBeenCalled();
+  });
+
+  it('does nothing when the report has no media', async () => {
+    const deps = makeDeps();
+
+    await addReportedMediaToHashBank(deps, {
+      orgId: 'org1',
+      bankId: BANK.id,
+      ncmecReportId: '123',
+      media: [],
+    });
+
+    expect(deps.hmaService.addContentToBank).not.toHaveBeenCalled();
+  });
+
+  it('does not add content when the selected bank is not found for the org', async () => {
+    const deps = makeDeps({ getBankById: jest.fn().mockResolvedValue(null) });
+
+    await addReportedMediaToHashBank(deps, {
+      orgId: 'org1',
+      bankId: BANK.id,
+      ncmecReportId: '123',
+      media: MEDIA,
+    });
+
+    expect(deps.hmaService.getBankById).toHaveBeenCalledWith('org1', BANK.id);
+    expect(deps.hmaService.addContentToBank).not.toHaveBeenCalled();
+  });
+
+  it('adds every reported media item with metadata identifying the item and report', async () => {
+    const deps = makeDeps();
+
+    await addReportedMediaToHashBank(deps, {
+      orgId: 'org1',
+      bankId: BANK.id,
+      ncmecReportId: '123',
+      media: MEDIA,
+    });
+
+    expect(deps.hmaService.addContentToBank).toHaveBeenCalledTimes(3);
+    expect(deps.hmaService.addContentToBank).toHaveBeenCalledWith(
+      BANK.hma_name,
+      {
+        url: 'https://cdn.example.com/1.mp4',
+        metadata: {
+          content_id: 'type-b:vid-1',
+          json: {
+            source: 'ncmec_report',
+            orgId: 'org1',
+            ncmecReportId: '123',
+            itemId: 'vid-1',
+            itemTypeId: 'type-b',
+          },
+        },
+      },
+    );
+    expect(deps.logError).not.toHaveBeenCalled();
+  });
+
+  it('keeps adding the remaining media when one item is rejected, and logs only that item', async () => {
+    const addContentToBank = jest
+      .fn()
+      .mockResolvedValueOnce({ id: 1, signals: {} })
+      .mockRejectedValueOnce(new Error('Failed to add content to bank: 400'))
+      .mockResolvedValueOnce({ id: 3, signals: {} });
+    const deps = makeDeps({ addContentToBank });
+
+    await addReportedMediaToHashBank(deps, {
+      orgId: 'org1',
+      bankId: BANK.id,
+      ncmecReportId: '123',
+      media: MEDIA,
+    });
+
+    expect(addContentToBank).toHaveBeenCalledTimes(3);
+    expect(deps.logError).toHaveBeenCalledTimes(1);
+    const logged = jsonStringify(deps.logError.mock.calls[0][0]);
+    expect(logged).toContain('org1');
+    expect(logged).toContain('123');
+    expect(logged).toContain('img-2');
+    expect(logged).toContain(String(BANK.id));
+    expect(logged).toContain('Failed to add content to bank: 400');
+  });
+
+  it('never rejects, even when the bank lookup throws', async () => {
+    const deps = makeDeps({
+      getBankById: jest.fn().mockRejectedValue(new Error('db down')),
+    });
+
+    await expect(
+      addReportedMediaToHashBank(deps, {
+        orgId: 'org1',
+        bankId: BANK.id,
+        ncmecReportId: '123',
+        media: MEDIA,
+      }),
+    ).resolves.toBeUndefined();
+
+    expect(deps.hmaService.addContentToBank).not.toHaveBeenCalled();
+    expect(deps.logError).toHaveBeenCalledTimes(1);
+  });
+
+  it('never writes the media URL to the log, even when the error message contains it', async () => {
+    const url = MEDIA[0].url;
+    const error = new Error(
+      `Failed to parse response body. Response body started with: could not fetch ${url} (${encodeURIComponent(url)}) ${new URLSearchParams({ url }).toString()}`,
+      { cause: new Error(url) },
+    );
+    const deps = makeDeps({
+      addContentToBank: jest.fn().mockRejectedValue(error),
+    });
+
+    await addReportedMediaToHashBank(deps, {
+      orgId: 'org1',
+      bankId: BANK.id,
+      ncmecReportId: '123',
+      media: [MEDIA[0]],
+    });
+
+    expect(deps.logError).toHaveBeenCalledTimes(1);
+    const logged = jsonStringify(deps.logError.mock.calls[0][0]);
+    expect(logged).not.toContain('cdn.example.com');
+    expect(logged).toContain('img-1');
+  });
+});
diff --git a/server/services/ncmecService/addReportedMediaToHashBank.ts b/server/services/ncmecService/addReportedMediaToHashBank.ts
new file mode 100644
index 000000000..c3c22180e
--- /dev/null
+++ b/server/services/ncmecService/addReportedMediaToHashBank.ts
@@ -0,0 +1,94 @@
+import { jsonStringify } from '../../utils/encoding.js';
+import { type logErrorJson } from '../../utils/logging.js';
+import { type HmaService } from '../hmaService/index.js';
+
+export interface AddReportedMediaToHashBankDeps {
+  hmaService: Pick<HmaService, 'getBankById' | 'addContentToBank'>;
+  logError: typeof logErrorJson;
+}
+
+type ReportedMedia = { id: string; typeId: string; url: string };
+
+/** Adds the media of an accepted NCMEC report to the org's selected hash bank.
+ * Best-effort: never rejects, so a banking failure cannot turn an accepted
+ * report into a retryable one. Failures are logged without the media URL. */
+export async function addReportedMediaToHashBank(
+  deps: AddReportedMediaToHashBankDeps,
+  opts: {
+    orgId: string;
+    bankId: number | null | undefined;
+    ncmecReportId: string;
+    media: readonly ReportedMedia[];
+  },
+): Promise<void> {
+  const { orgId, bankId, ncmecReportId, media } = opts;
+  if (bankId == null || media.length === 0) {
+    return;
+  }
+
+  const logFailure = (error: unknown, item?: ReportedMedia) => {
+    deps.logError({
+      error: toLogSafeError(error, item?.url),
+      message: jsonStringify({
+        event: 'ncmecReportedMediaBankingFailed',
+        orgId,
+        ncmecReportId,
+        bankId,
+        itemId: item?.id,
+        itemTypeId: item?.typeId,
+      }),
+    });
+  };
+
+  let bank;
+  try {
+    bank = await deps.hmaService.getBankById(orgId, bankId);
+  } catch (e) {
+    logFailure(e);
+    return;
+  }
+  if (!bank) {
+    return;
+  }
+  const { hma_name: hmaName } = bank;
+
+  const results = await Promise.allSettled(
+    media.map(async (item) =>
+      deps.hmaService.addContentToBank(hmaName, {
+        url: item.url,
+        metadata: {
+          content_id: `${item.typeId}:${item.id}`,
+          json: {
+            source: 'ncmec_report',
+            orgId,
+            ncmecReportId,
+            itemId: item.id,
+            itemTypeId: item.typeId,
+          },
+        },
+      }),
+    ),
+  );
+
+  results.forEach((result, i) => {
+    if (result.status === 'rejected') {
+      logFailure(result.reason, media[i]);
+    }
+  });
+}
+
+function toLogSafeError(error: unknown, url: string | undefined) {
+  const name = error instanceof Error ? error.name : 'Error';
+  let message = error instanceof Error ? error.message : String(error);
+  if (url !== undefined) {
+    const forms = [
+      url,
+      encodeURIComponent(url),
+      new URLSearchParams({ url }).toString().slice('url='.length),
+    ];
+    for (const form of forms) {
+      message = message.replaceAll(form, '[media url]');
+    }
+  }
+  return { name, message };
+}
diff --git a/server/services/ncmecService/ncmecReporting.ts b/server/services/ncmecService/ncmecReporting.ts
index c5e388b72..70440081e 100644
--- a/server/services/ncmecService/ncmecReporting.ts
+++ b/server/services/ncmecService/ncmecReporting.ts
@@ -28,6 +28,7 @@ import {
   makeFormDataLikeWithStreams,
   type FormDataLikeWithStreams,
 } from '../networkingService/index.js';
+import { addReportedMediaToHashBank } from './addReportedMediaToHashBank.js';
 import { type NcmecReportingServicePg } from './dbTypes.js';
 import {
   ncmecDebugDump,
@@ -1391,6 +1392,7 @@ export default class NcmecReporting {
     private moderationConfigService: Dependencies['ModerationConfigService'],
     private getItemTypeEventuallyConsistent: Dependencies['getItemTypeEventuallyConsistent'],
     private readonly tracer: Dependencies['Tracer'],
+    private readonly hmaService: Dependencies['HMAHashBankService'],
   ) {}
   async hasNCMECReportingEnabled(orgId: string) {
     const ncmecOrgSettings = await this.pgQuery
@@ -2058,6 +2060,18 @@ export default class NcmecReporting {
             })
             .execute();
 
+          if (isTest === false) {
+            await addReportedMediaToHashBank(
+              { hmaService: this.hmaService, logError: logErrorJson },
+              {
+                orgId: reportParams.orgId,
+                bankId: ncmecConfig?.reported_media_hash_bank_id,
+                ncmecReportId: reportId,
+                media: reportParams.media,
+              },
+            );
+          }
+
           if (ncmecConfig?.ncmec_preservation_endpoint && isTest === false) {
             await this.#sendUserPreservationRequest({
               orgId: reportParams.orgId,
diff --git a/server/services/ncmecService/ncmecService.ts b/server/services/ncmecService/ncmecService.ts
index 61ae969a5..a6cb444cc 100644
--- a/server/services/ncmecService/ncmecService.ts
+++ b/server/services/ncmecService/ncmecService.ts
@@ -38,6 +38,7 @@ export class NcmecService {
     readonly tracer: Dependencies['Tracer'],
     readonly itemInvestigationService: Dependencies['ItemInvestigationService'],
     readonly getItemTypeEventuallyConsistent: Dependencies['getItemTypeEventuallyConsistent'],
+    readonly hmaService: Dependencies['HMAHashBankService'],
   ) {
     this.ncmecReporting = new NcmecReporting(
       pgQuery,
@@ -47,6 +48,7 @@ export class NcmecService {
       moderationConfigService,
       getItemTypeEventuallyConsistent,
       tracer,
+      hmaService,
     );
     this.ncmecEnqueueToMrt = new NcmecEnqueueToMrt(
       partialItemsService,
@@ -335,6 +337,7 @@ export default inject(
     'Tracer',
     'ItemInvestigationService',
     'getItemTypeEventuallyConsistent',
+    'HMAHashBankService',
   ],
   NcmecService,
 );
diff --git a/server/test/fixtureHelpers/makeStubFetchHTTP.ts b/server/test/fixtureHelpers/makeStubFetchHTTP.ts
index 96ac27763..008853e02 100644
--- a/server/test/fixtureHelpers/makeStubFetchHTTP.ts
+++ b/server/test/fixtureHelpers/makeStubFetchHTTP.ts
@@ -20,18 +20,21 @@ export type RecordedFetchHTTPCall = {
 export function makeStubFetchHTTP(
   reportId: string,
   fileId: string,
-  opts: { preservationUrl?: string } = {},
+  opts: { preservationUrl?: string; hmaAddContentStatus?: number } = {},
 ): {
   fetchHTTP: FetchHTTP;
   calls: RecordedFetchHTTPCall[];
 } {
   const calls: RecordedFetchHTTPCall[] = [];
   const preservationUrl = opts.preservationUrl;
-  const ok = <T extends HandleResponseBody>(body: unknown): CoopResponse<T> =>
+  const ok = <T extends HandleResponseBody>(
+    body: unknown,
+    status = 200,
+  ): CoopResponse<T> =>
     // eslint-disable-next-line @typescript-eslint/consistent-type-assertions -- the stub returns a canned body through a slot typed by the caller's T.
     ({
-      status: 200,
-      ok: true,
+      status,
+      ok: status >= 200 && status < 300,
       headers: new Headers(),
       body,
     }) as CoopResponse<T>;
@@ -82,6 +85,13 @@ export function makeStubFetchHTTP(
     if (preservationUrl != null && url === preservationUrl) {
       return ok<T>(undefined);
     }
+    // HMA add-content; GET /c/bank/<name> is covered by the media download branch.
+    if (method === 'post' && /\/c\/bank\/[^/]+\/content\?/.test(url)) {
+      return ok<T>(
+        { id: 1, signals: { pdq: 'stub-pdq' } },
+        opts.hmaAddContentStatus ?? 200,
+      );
+    }
     throw new Error(`stub fetchHTTP: unexpected request ${method} ${url}`);
   };
   return { fetchHTTP, calls };
diff --git a/server/test/integ/ncmec-submission.integ.test.ts b/server/test/integ/ncmec-submission.integ.test.ts
index 896c0c5e7..02f2c4f6a 100644
--- a/server/test/integ/ncmec-submission.integ.test.ts
+++ b/server/test/integ/ncmec-submission.integ.test.ts
@@ -1,5 +1,9 @@
 import { uid } from 'uid';
 
+import {
+  HashBankService,
+  HmaService,
+} from '../../services/hmaService/index.js';
 import {
   NCMECFileAnnotation,
   NCMECIncidentType,
@@ -7,18 +11,78 @@ import {
   NcmecReporting,
   type NCMECReportParams,
 } from '../../services/ncmecService/index.js';
+import { jsonParse, type JsonOf } from '../../utils/encoding.js';
 import createOrg from '../fixtureHelpers/createOrg.js';
-import { makeStubFetchHTTP } from '../fixtureHelpers/makeStubFetchHTTP.js';
+import {
+  makeStubFetchHTTP,
+  type RecordedFetchHTTPCall,
+} from '../fixtureHelpers/makeStubFetchHTTP.js';
 import { makeTransactionalTestWithFixture } from '../harness/transactionalTest.js';
+import { type MockedServer } from '../setupMockedServer.js';
 
 const MEDIA_URL = 'https://cdn.example/sample.jpg';
+const SECOND_MEDIA_URL = 'https://cdn.example/clip.mp4';
 const PRESERVATION_URL = 'https://preserve.example/req';
 
+type Deps = MockedServer['deps'];
+
+function makeReporting(
+  deps: Deps,
+  reportId: string,
+  stubOpts: { hmaAddContentStatus?: number } = {},
+) {
+  const stub = makeStubFetchHTTP(reportId, 'f1', {
+    preservationUrl: PRESERVATION_URL,
+    ...stubOpts,
+  });
+  const ncmecReporting = new NcmecReporting(
+    deps.KyselyPg,
+    deps.KyselyPgReadReplica,
+    stub.fetchHTTP,
+    deps.SigningKeyPairService,
+    deps.ModerationConfigService,
+    deps.getItemTypeEventuallyConsistent,
+    deps.Tracer,
+    new HmaService(stub.fetchHTTP, deps.KyselyPg),
+  );
+  return { stub, ncmecReporting };
+}
+
+function reportWithTwoMedia(
+  orgId: string,
+  userItemTypeId: string,
+): NCMECReportParams {
+  return {
+    orgId,
+    reviewerId: 'reviewer-1',
+    reportedUser: { id: uid(), typeId: userItemTypeId },
+    media: [MEDIA_URL, SECOND_MEDIA_URL].map((url, i) => ({
+      id: `media-${i + 1}`,
+      typeId: userItemTypeId,
+      url,
+      createdAt: '2026-06-30T12:00:00.000Z',
+      industryClassification: NCMECIndustryClassification.A1,
+      fileAnnotations: [],
+    })),
+    threads: [],
+    incidentType:
+      NCMECIncidentType[
+        'Child Pornography (possession, manufacture, and distribution)'
+      ],
+    jobId: `job-${uid()}`,
+  };
+}
+
+function hmaAddContentCalls(calls: readonly RecordedFetchHTTPCall[]) {
+  return calls.filter(
+    (c) => c.method === 'post' && /\/c\/bank\/[^/]+\/content\?/.test(c.url),
+  );
+}
+
 describe('NCMEC submitReport (integration)', () => {
   const testWithFixture = makeTransactionalTestWithFixture(async ({ deps }) => {
     const orgId = uid();
     const reportId = uid();
-    const fileId = 'f1';
 
     const orgFixture = await createOrg(
       {
@@ -29,6 +93,13 @@ describe('NCMEC submitReport (integration)', () => {
       orgId,
     );
 
+    const hashBank = await new HashBankService(deps.KyselyPg).create({
+      name: 'Reported CSAM',
+      hma_name: `COOP_TEST_${uid()}`,
+      enabled_ratio: 1,
+      org_id: orgId,
+    });
+
     await deps.NcmecService.updateNcmecOrgSettings({
       orgId,
       username: 'espuser',
@@ -48,27 +119,17 @@ describe('NCMEC submitReport (integration)', () => {
       contactPersonPhone: null,
       mediaReviewRequirement: 'ALL',
       minMediaToReview: null,
-      reportedMediaHashBankId: null,
+      reportedMediaHashBankId: hashBank.id,
     });
 
-    const stub = makeStubFetchHTTP(reportId, fileId, {
-      preservationUrl: PRESERVATION_URL,
-    });
-    const ncmecReporting = new NcmecReporting(
-      deps.KyselyPg,
-      deps.KyselyPgReadReplica,
-      stub.fetchHTTP,
-      deps.SigningKeyPairService,
-      deps.ModerationConfigService,
-      deps.getItemTypeEventuallyConsistent,
-      deps.Tracer,
-    );
+    const { stub, ncmecReporting } = makeReporting(deps, reportId);
 
     return {
       orgId,
       reportId,
       stub,
       ncmecReporting,
+      hashBank,
       userItemTypeId: orgFixture.defaultUserItemType.id,
     };
   });
@@ -153,4 +214,81 @@ describe('NCMEC submitReport (integration)', () => {
     },
     60_000,
   );
+  testWithFixture(
+    'adds every reported media item to the selected hash bank once a production report is accepted',
+    async ({
+      ncmecReporting,
+      orgId,
+      reportId,
+      stub,
+      hashBank,
+      userItemTypeId,
+    }) => {
+      const params = reportWithTwoMedia(orgId, userItemTypeId);
+
+      const result = await ncmecReporting.submitReport(params, false);
+
+      expect(result).toBe('SUCCESS');
+      const addCalls = hmaAddContentCalls(stub.calls);
+      expect(addCalls.map((c) => new URL(c.url).pathname)).toEqual([
+        `/c/bank/${hashBank.hma_name}/content`,
+        `/c/bank/${hashBank.hma_name}/content`,
+      ]);
+      expect(
+        addCalls.map((c) => new URL(c.url).searchParams.get('url')).sort(),
+      ).toEqual([SECOND_MEDIA_URL, MEDIA_URL].sort());
+      const bodies = addCalls.map((c) => jsonParse(c.body as JsonOf<unknown>));
+      expect(bodies).toContainEqual({
+        metadata: {
+          content_id: `${userItemTypeId}:media-1`,
+          json: {
+            source: 'ncmec_report',
+            orgId,
+            ncmecReportId: reportId,
+            itemId: 'media-1',
+            itemTypeId: userItemTypeId,
+          },
+        },
+      });
+    },
+    60_000,
+  );
+
+  testWithFixture(
+    'does not add anything to the hash bank for a test submission',
+    async ({ ncmecReporting, orgId, stub, userItemTypeId }) => {
+      const result = await ncmecReporting.submitReport(
+        reportWithTwoMedia(orgId, userItemTypeId),
+        true,
+      );
+
+      expect(result).toBe('SUCCESS');
+      expect(hmaAddContentCalls(stub.calls)).toHaveLength(0);
+    },
+    60_000,
+  );
+
+  testWithFixture(
+    'keeps the report successful and records no NCMEC error when HMA rejects the content',
+    async ({ deps, orgId, reportId, userItemTypeId }) => {
+      const { stub, ncmecReporting } = makeReporting(deps, reportId, {
+        hmaAddContentStatus: 500,
+      });
+      const params = reportWithTwoMedia(orgId, userItemTypeId);
+
+      const result = await ncmecReporting.submitReport(params, false);
+
+      expect(result).toBe('SUCCESS');
+      expect(hmaAddContentCalls(stub.calls)).toHaveLength(2);
+      expect(stub.calls.some((c) => c.url === PRESERVATION_URL)).toBe(true);
+      const errorRow = await deps.KyselyPg.selectFrom(
+        'ncmec_reporting.ncmec_reports_errors',
+      )
+        .selectAll()
+        .where('job_id', '=', params.jobId!)
+        .executeTakeFirst();
+      expect(errorRow).toBeUndefined();
+    },
+    60_000,
+  );
 });

From 7f31f622ca7089dfbe254aebcac50b044c8813f7 Mon Sep 17 00:00:00 2001
From: Marco Filho <markimkr@gmail.com>
Date: Wed, 16 Sep 2026 18:27:53 -0300
Subject: [PATCH 04/17] [196] Make HMA URL assertions independent of the base
 URL

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 server/services/hmaService/index.test.ts         |  2 +-
 server/test/integ/ncmec-submission.integ.test.ts | 12 ++++++++----
 2 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/server/services/hmaService/index.test.ts b/server/services/hmaService/index.test.ts
index fb8bf781d..b942759ba 100644
--- a/server/services/hmaService/index.test.ts
+++ b/server/services/hmaService/index.test.ts
@@ -403,7 +403,7 @@ describe('HmaService', () => {
       expect(fetchHTTP).toHaveBeenCalledTimes(1);
       const call = fetchHTTP.mock.calls[0][0];
       const url = new URL(call.url);
-      expect(url.pathname).toBe('/c/bank/COOP_ORG1_BANK/content');
+      expect(url.pathname).toMatch(/\/c\/bank\/COOP_ORG1_BANK\/content$/);
       expect([...url.searchParams.keys()]).toEqual(['url']);
       expect(url.searchParams.get('url')).toBe(
         'https://cdn.example.com/a.jpg?sig=1',
diff --git a/server/test/integ/ncmec-submission.integ.test.ts b/server/test/integ/ncmec-submission.integ.test.ts
index 02f2c4f6a..f9588d7de 100644
--- a/server/test/integ/ncmec-submission.integ.test.ts
+++ b/server/test/integ/ncmec-submission.integ.test.ts
@@ -230,10 +230,14 @@ describe('NCMEC submitReport (integration)', () => {
 
       expect(result).toBe('SUCCESS');
       const addCalls = hmaAddContentCalls(stub.calls);
-      expect(addCalls.map((c) => new URL(c.url).pathname)).toEqual([
-        `/c/bank/${hashBank.hma_name}/content`,
-        `/c/bank/${hashBank.hma_name}/content`,
-      ]);
+      expect(addCalls).toHaveLength(2);
+      for (const call of addCalls) {
+        expect(
+          new URL(call.url).pathname.endsWith(
+            `/c/bank/${hashBank.hma_name}/content`,
+          ),
+        ).toBe(true);
+      }
       expect(
         addCalls.map((c) => new URL(c.url).searchParams.get('url')).sort(),
       ).toEqual([SECOND_MEDIA_URL, MEDIA_URL].sort());

From 6fe382f75398cd63edab25df255be242fe55ab54 Mon Sep 17 00:00:00 2001
From: Marco Filho <markimkr@gmail.com>
Date: Thu, 17 Sep 2026 01:50:37 -0300
Subject: [PATCH 05/17] [196] Add CHANGELOG entry

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 40d847a20..892110e24 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,7 @@ For more information about each release including git tags and artifacts, see [R
 
 ### Added
 
+- Setting to add media from accepted NCMEC reports to a hash bank ([#1208](https://github.com/roostorg/coop/pull/1208) by [@maarkN](https://github.com/maarkN), closes [#196](https://github.com/roostorg/coop/issues/196))
 - List parameters used in the action in the item action history view ([#1173](https://github.com/roostorg/coop/pull/1173) by [@maarkN](https://github.com/maarkN), closes [#833](https://github.com/roostorg/coop/issues/833))
 - Manual Review Analytics with average handle time per moderator ([#1022](https://github.com/roostorg/coop/pull/1022) by [@juanmrad](https://github.com/juanmrad), closes [#380](https://github.com/roostorg/coop/issues/380))
 - Support for text-only NCMEC reports ([#866](https://github.com/roostorg/coop/pull/866), [#881](https://github.com/roostorg/coop/pull/881) by [@calebmcquaid](https://github.com/calebmcquaid), closes [#661](https://github.com/roostorg/coop/issues/661))

From 14434a09edeed2685c9c48bd323ae6a0136b37e4 Mon Sep 17 00:00:00 2001
From: Marco Filho <markimkr@gmail.com>
Date: Thu, 17 Sep 2026 04:53:32 -0300
Subject: [PATCH 06/17] [196] Support HMA notes when adding content to a bank

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 server/services/hmaService/index.test.ts | 128 +++++++++++++++++++++++
 server/services/hmaService/index.ts      |  25 +++--
 2 files changed, 147 insertions(+), 6 deletions(-)

diff --git a/server/services/hmaService/index.test.ts b/server/services/hmaService/index.test.ts
index b942759ba..7f1a4b94c 100644
--- a/server/services/hmaService/index.test.ts
+++ b/server/services/hmaService/index.test.ts
@@ -428,5 +428,133 @@ describe('HmaService', () => {
         }),
       ).rejects.toThrow('Failed to add content to bank: 400');
     });
+
+    describe('note', () => {
+      const URL_OPTIONS = { url: 'https://cdn.example.com/a.jpg' };
+
+      function makeOkService() {
+        const fetchHTTP = jest
+          .fn()
+          .mockResolvedValue(ok({ id: 7, signals: { pdq: 'abc' } }));
+        return { fetchHTTP, svc: makeService(fetchHTTP) };
+      }
+
+      it('sends the note next to the metadata in the JSON body', async () => {
+        const { fetchHTTP, svc } = makeOkService();
+
+        await svc.addContentToBank('COOP_ORG1_BANK', {
+          ...URL_OPTIONS,
+          metadata: { content_id: 'type1:item1' },
+          note: 'Reported to NCMEC',
+        });
+
+        expect(jsonParse(fetchHTTP.mock.calls[0][0].body)).toEqual({
+          metadata: { content_id: 'type1:item1' },
+          note: 'Reported to NCMEC',
+        });
+      });
+
+      it('sends a JSON body with only the note when there is no metadata', async () => {
+        const { fetchHTTP, svc } = makeOkService();
+
+        await svc.addContentToBank('COOP_ORG1_BANK', {
+          ...URL_OPTIONS,
+          note: 'Reported to NCMEC',
+        });
+
+        const call = fetchHTTP.mock.calls[0][0];
+        expect(call.headers).toEqual({ 'Content-Type': 'application/json' });
+        expect(jsonParse(call.body)).toEqual({ note: 'Reported to NCMEC' });
+      });
+
+      it('sends no body and no JSON content type without metadata or note', async () => {
+        const { fetchHTTP, svc } = makeOkService();
+
+        await svc.addContentToBank('COOP_ORG1_BANK', URL_OPTIONS);
+
+        const call = fetchHTTP.mock.calls[0][0];
+        expect(call.body).toBeUndefined();
+        expect(call.headers).toBeUndefined();
+      });
+
+      it('does not send an empty note, since HMA treats it as no note', async () => {
+        const { fetchHTTP, svc } = makeOkService();
+
+        await svc.addContentToBank('COOP_ORG1_BANK', {
+          ...URL_OPTIONS,
+          metadata: { content_id: 'type1:item1' },
+          note: '',
+        });
+
+        expect(jsonParse(fetchHTTP.mock.calls[0][0].body)).toEqual({
+          metadata: { content_id: 'type1:item1' },
+        });
+      });
+
+      it('accepts a note with exactly 255 characters', async () => {
+        const { fetchHTTP, svc } = makeOkService();
+        const note = 'a'.repeat(255);
+
+        await svc.addContentToBank('COOP_ORG1_BANK', { ...URL_OPTIONS, note });
+
+        expect(jsonParse(fetchHTTP.mock.calls[0][0].body)).toEqual({ note });
+      });
+
+      it('rejects a note longer than 255 characters before calling HMA', async () => {
+        const { fetchHTTP, svc } = makeOkService();
+
+        await expect(
+          svc.addContentToBank('COOP_ORG1_BANK', {
+            ...URL_OPTIONS,
+            note: 'a'.repeat(256),
+          }),
+        ).rejects.toThrow('note must be 255 characters or less');
+        expect(fetchHTTP).not.toHaveBeenCalled();
+      });
+
+      it('counts characters like HMA does, so 255 emoji are accepted and 256 are not', async () => {
+        const { fetchHTTP, svc } = makeOkService();
+
+        await svc.addContentToBank('COOP_ORG1_BANK', {
+          ...URL_OPTIONS,
+          note: '🚩'.repeat(255),
+        });
+        expect(fetchHTTP).toHaveBeenCalledTimes(1);
+
+        await expect(
+          svc.addContentToBank('COOP_ORG1_BANK', {
+            ...URL_OPTIONS,
+            note: '🚩'.repeat(256),
+          }),
+        ).rejects.toThrow('note must be 255 characters or less');
+        expect(fetchHTTP).toHaveBeenCalledTimes(1);
+      });
+
+      it('appends the note to the form data on file uploads', async () => {
+        const { fetchHTTP, svc } = makeOkService();
+
+        await svc.addContentToBank('COOP_ORG1_BANK', {
+          file: new Blob(['bytes'], { type: 'image/png' }),
+          contentType: 'photo',
+          note: 'Reported to NCMEC',
+        });
+
+        const form = fetchHTTP.mock.calls[0][0].body as FormData;
+        expect(form.get('note')).toBe('Reported to NCMEC');
+      });
+
+      it('does not append an empty note on file uploads', async () => {
+        const { fetchHTTP, svc } = makeOkService();
+
+        await svc.addContentToBank('COOP_ORG1_BANK', {
+          file: new Blob(['bytes'], { type: 'image/png' }),
+          contentType: 'photo',
+          note: '',
+        });
+
+        const form = fetchHTTP.mock.calls[0][0].body as FormData;
+        expect(form.has('note')).toBe(false);
+      });
+    });
   });
 });
diff --git a/server/services/hmaService/index.ts b/server/services/hmaService/index.ts
index 3a61f2cfc..d3e950b4e 100644
--- a/server/services/hmaService/index.ts
+++ b/server/services/hmaService/index.ts
@@ -802,9 +802,10 @@ export class HmaService {
         content_uri?: string;
         json?: Record<string, unknown>;
       };
+      note?: string;
     },
   ): Promise<BankContentResponse> {
-    const { file, contentType, url, metadata } = options;
+    const { file, contentType, url, metadata, note } = options;
 
     if (!url && (!file || !contentType)) {
       throw new Error(
@@ -812,18 +813,28 @@ export class HmaService {
       );
     }
 
+    // HMA counts code points (Python len), not UTF-16 units.
+    if (note && [...note].length > 255) {
+      throw new Error('note must be 255 characters or less');
+    }
+
     let response;
     if (url) {
       // HMA reads `metadata` from the JSON body only; query-param metadata is dropped.
       const params = new URLSearchParams({ url });
+      let body: string | undefined;
+      if (metadata || note) {
+        body = jsonStringify({
+          ...(metadata ? { metadata } : {}),
+          ...(note ? { note } : {}),
+        });
+      }
+
       response = await this.fetchHTTP({
         url: `${this.hmaServiceUrl}/c/bank/${bankName}/content?${params.toString()}`,
         method: 'post',
-        ...(metadata
-          ? {
-              body: jsonStringify({ metadata }),
-              headers: { 'Content-Type': 'application/json' },
-            }
+        ...(body !== undefined
+          ? { body, headers: { 'Content-Type': 'application/json' } }
           : {}),
         handleResponseBody: 'as-json',
       });
@@ -845,6 +856,8 @@ export class HmaService {
           formData.append('metadata', jsonStringify(metadata.json));
       }
 
+      if (note) formData.append('note', note);
+
       response = await this.fetchHTTP({
         url: `${this.hmaServiceUrl}/c/bank/${bankName}/content`,
         method: 'post',

From 9fd4122626bc1532bd29bfc9d7b5ee75cba35729 Mon Sep 17 00:00:00 2001
From: Marco Filho <markimkr@gmail.com>
Date: Thu, 17 Sep 2026 05:25:35 -0300
Subject: [PATCH 07/17] [196] Check hash bank ownership in the resolver

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 server/graphql/modules/ncmec.resolver.test.ts   | 15 +++++++++++++++
 server/graphql/modules/ncmec.ts                 | 17 ++++++++++++-----
 .../modules/ncmecOrgSettingsValidation.ts       | 17 +++++------------
 3 files changed, 32 insertions(+), 17 deletions(-)

diff --git a/server/graphql/modules/ncmec.resolver.test.ts b/server/graphql/modules/ncmec.resolver.test.ts
index 66097e08f..618244b68 100644
--- a/server/graphql/modules/ncmec.resolver.test.ts
+++ b/server/graphql/modules/ncmec.resolver.test.ts
@@ -203,6 +203,21 @@ describe('updateNcmecOrgSettings reported media hash bank', () => {
     expect(updateNcmecOrgSettings).not.toHaveBeenCalled();
   });
 
+  it('rejects bank id 0 as not found', async () => {
+    const { ctx, updateNcmecOrgSettings, getBankById } = makeCtx([
+      UserPermission.MANAGE_ORG,
+    ]);
+    await expect(
+      Mutation.updateNcmecOrgSettings(
+        {},
+        { input: { ...VALID_INPUT, reportedMediaHashBankId: '0' } },
+        ctx,
+      ),
+    ).rejects.toThrow('Selected hash bank was not found.');
+    expect(getBankById).toHaveBeenCalledWith('org-1', 0);
+    expect(updateNcmecOrgSettings).not.toHaveBeenCalled();
+  });
+
   it('rejects a non-numeric bank id', async () => {
     const { ctx, updateNcmecOrgSettings, getBankById } = makeCtx([
       UserPermission.MANAGE_ORG,
diff --git a/server/graphql/modules/ncmec.ts b/server/graphql/modules/ncmec.ts
index 514c455ba..5818db63d 100644
--- a/server/graphql/modules/ncmec.ts
+++ b/server/graphql/modules/ncmec.ts
@@ -352,11 +352,18 @@ const Mutation: GQLMutationResolvers = {
     const { mediaReviewRequirement, minMediaToReview } =
       parseMediaReviewPolicy(input);
 
-    const reportedMediaHashBankId = await parseReportedMediaHashBankId(
-      input,
-      user.orgId,
-      context.services.HMAHashBankService,
-    );
+    const reportedMediaHashBankId = parseReportedMediaHashBankId(input);
+
+    if (reportedMediaHashBankId !== null) {
+      const bank = await context.services.HMAHashBankService.getBankById(
+        user.orgId,
+        reportedMediaHashBankId,
+      );
+
+      if (!bank) {
+        throw userInputError('Selected hash bank was not found.');
+      }
+    }
 
     await context.services.NcmecService.updateNcmecOrgSettings({
       orgId: user.orgId,
diff --git a/server/graphql/modules/ncmecOrgSettingsValidation.ts b/server/graphql/modules/ncmecOrgSettingsValidation.ts
index af538ffb5..d725c30cb 100644
--- a/server/graphql/modules/ncmecOrgSettingsValidation.ts
+++ b/server/graphql/modules/ncmecOrgSettingsValidation.ts
@@ -1,4 +1,3 @@
-import { type HmaService } from '../../services/hmaService/index.js';
 import { userInputError } from '../utils/errors.js';
 
 /** Input shape for updateNcmecOrgSettings; mirrors NcmecOrgSettingsInput so the
@@ -102,14 +101,11 @@ export function parseMediaReviewPolicy(input: NcmecOrgSettingsInputShape): {
   return { mediaReviewRequirement: requirement, minMediaToReview };
 }
 
-/** Returns the bank id to store, or null to clear it. A bank that is missing
- * and a bank owned by another org get the same error, so callers cannot probe
- * other orgs' bank ids. */
-export async function parseReportedMediaHashBankId(
+/** Returns the bank id to store, or null to clear it. Only checks the format;
+ * the resolver checks that the bank belongs to the org. */
+export function parseReportedMediaHashBankId(
   input: NcmecOrgSettingsInputShape,
-  orgId: string,
-  hmaService: Pick<HmaService, 'getBankById'>,
-): Promise<number | null> {
+): number | null {
   const raw = input.reportedMediaHashBankId?.trim() ?? '';
   if (raw === '') {
     return null;
@@ -118,9 +114,6 @@ export async function parseReportedMediaHashBankId(
     throw userInputError('reportedMediaHashBankId must be a hash bank ID.');
   }
   const bankId = Number(raw);
-  const bank = await hmaService.getBankById(orgId, bankId);
-  if (!bank) {
-    throw userInputError('Selected hash bank was not found.');
-  }
+
   return bankId;
 }

From 0a833092964621e7acc4446279ff02c9b1f71fab Mon Sep 17 00:00:00 2001
From: Marco Filho <markimkr@gmail.com>
Date: Thu, 17 Sep 2026 05:25:40 -0300
Subject: [PATCH 08/17] [196] Only bank reported media when the org has a bank
 selected

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../addReportedMediaToHashBank.test.ts        | 14 --------------
 .../addReportedMediaToHashBank.ts             |  4 ++--
 .../services/ncmecService/ncmecReporting.ts   |  6 ++++--
 .../test/integ/ncmec-submission.integ.test.ts | 19 +++++++++++++++++++
 4 files changed, 25 insertions(+), 18 deletions(-)

diff --git a/server/services/ncmecService/addReportedMediaToHashBank.test.ts b/server/services/ncmecService/addReportedMediaToHashBank.test.ts
index 29654d163..0cc621057 100644
--- a/server/services/ncmecService/addReportedMediaToHashBank.test.ts
+++ b/server/services/ncmecService/addReportedMediaToHashBank.test.ts
@@ -39,20 +39,6 @@ function makeDeps(
 }
 
 describe('addReportedMediaToHashBank', () => {
-  it('does nothing when the org has no bank selected', async () => {
-    const deps = makeDeps();
-
-    await addReportedMediaToHashBank(deps, {
-      orgId: 'org1',
-      bankId: null,
-      ncmecReportId: '123',
-      media: MEDIA,
-    });
-
-    expect(deps.hmaService.getBankById).not.toHaveBeenCalled();
-    expect(deps.hmaService.addContentToBank).not.toHaveBeenCalled();
-  });
-
   it('does nothing when the report has no media', async () => {
     const deps = makeDeps();
 
diff --git a/server/services/ncmecService/addReportedMediaToHashBank.ts b/server/services/ncmecService/addReportedMediaToHashBank.ts
index c3c22180e..782a388ca 100644
--- a/server/services/ncmecService/addReportedMediaToHashBank.ts
+++ b/server/services/ncmecService/addReportedMediaToHashBank.ts
@@ -16,13 +16,13 @@ export async function addReportedMediaToHashBank(
   deps: AddReportedMediaToHashBankDeps,
   opts: {
     orgId: string;
-    bankId: number | null | undefined;
+    bankId: number;
     ncmecReportId: string;
     media: readonly ReportedMedia[];
   },
 ): Promise<void> {
   const { orgId, bankId, ncmecReportId, media } = opts;
-  if (bankId == null || media.length === 0) {
+  if (media.length === 0) {
     return;
   }
 
diff --git a/server/services/ncmecService/ncmecReporting.ts b/server/services/ncmecService/ncmecReporting.ts
index 70440081e..3ea837e38 100644
--- a/server/services/ncmecService/ncmecReporting.ts
+++ b/server/services/ncmecService/ncmecReporting.ts
@@ -2060,12 +2060,14 @@ export default class NcmecReporting {
             })
             .execute();
 
-          if (isTest === false) {
+          const reportedMediaHashBankId =
+            ncmecConfig?.reported_media_hash_bank_id;
+          if (isTest === false && reportedMediaHashBankId != null) {
             await addReportedMediaToHashBank(
               { hmaService: this.hmaService, logError: logErrorJson },
               {
                 orgId: reportParams.orgId,
-                bankId: ncmecConfig?.reported_media_hash_bank_id,
+                bankId: reportedMediaHashBankId,
                 ncmecReportId: reportId,
                 media: reportParams.media,
               },
diff --git a/server/test/integ/ncmec-submission.integ.test.ts b/server/test/integ/ncmec-submission.integ.test.ts
index f9588d7de..ecc356d31 100644
--- a/server/test/integ/ncmec-submission.integ.test.ts
+++ b/server/test/integ/ncmec-submission.integ.test.ts
@@ -258,6 +258,25 @@ describe('NCMEC submitReport (integration)', () => {
     60_000,
   );
 
+  testWithFixture(
+    'does not add anything to a hash bank when the org has no bank selected',
+    async ({ deps, ncmecReporting, orgId, stub, userItemTypeId }) => {
+      await deps.KyselyPg.updateTable('ncmec_reporting.ncmec_org_settings')
+        .set({ reported_media_hash_bank_id: null })
+        .where('org_id', '=', orgId)
+        .execute();
+
+      const result = await ncmecReporting.submitReport(
+        reportWithTwoMedia(orgId, userItemTypeId),
+        false,
+      );
+
+      expect(result).toBe('SUCCESS');
+      expect(stub.calls.some((c) => c.url.includes('/c/bank/'))).toBe(false);
+    },
+    60_000,
+  );
+
   testWithFixture(
     'does not add anything to the hash bank for a test submission',
     async ({ ncmecReporting, orgId, stub, userItemTypeId }) => {

From 4fb0e408cf5e4d4fc02583a0dddd6b7306bc7cec Mon Sep 17 00:00:00 2001
From: Marco Filho <markimkr@gmail.com>
Date: Thu, 17 Sep 2026 07:08:59 -0300
Subject: [PATCH 09/17] [196] Bank reported media the same way as the
 preservation request

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../addReportedMediaToHashBank.test.ts        | 164 ------------------
 .../addReportedMediaToHashBank.ts             |  94 ----------
 .../services/ncmecService/ncmecReporting.ts   |  96 ++++++++--
 .../test/integ/ncmec-submission.integ.test.ts |  10 +-
 4 files changed, 87 insertions(+), 277 deletions(-)
 delete mode 100644 server/services/ncmecService/addReportedMediaToHashBank.test.ts
 delete mode 100644 server/services/ncmecService/addReportedMediaToHashBank.ts

diff --git a/server/services/ncmecService/addReportedMediaToHashBank.test.ts b/server/services/ncmecService/addReportedMediaToHashBank.test.ts
deleted file mode 100644
index 0cc621057..000000000
--- a/server/services/ncmecService/addReportedMediaToHashBank.test.ts
+++ /dev/null
@@ -1,164 +0,0 @@
-import { jsonStringify } from '../../utils/encoding.js';
-import type { HashBank } from '../hmaService/index.js';
-import {
-  addReportedMediaToHashBank,
-  type AddReportedMediaToHashBankDeps,
-} from './addReportedMediaToHashBank.js';
-
-const BANK: HashBank = {
-  id: 42,
-  name: 'Reported CSAM',
-  hma_name: 'COOP_ORG1_REPORTED_CSAM',
-  description: null,
-  enabled_ratio: 1,
-  org_id: 'org1',
-  created_at: new Date(),
-  updated_at: new Date(),
-};
-
-const MEDIA = [
-  { id: 'img-1', typeId: 'type-a', url: 'https://cdn.example.com/1.jpg?sig=x' },
-  { id: 'img-2', typeId: 'type-a', url: 'https://cdn.example.com/2.jpg' },
-  { id: 'vid-1', typeId: 'type-b', url: 'https://cdn.example.com/1.mp4' },
-];
-
-function makeDeps(
-  overrides: Partial<AddReportedMediaToHashBankDeps['hmaService']> = {},
-) {
-  const deps = {
-    hmaService: {
-      getBankById: jest.fn().mockResolvedValue(BANK),
-      addContentToBank: jest
-        .fn()
-        .mockResolvedValue({ id: 1, signals: { pdq: 'abc' } }),
-      ...overrides,
-    },
-    logError: jest.fn(),
-  };
-  return deps as typeof deps & AddReportedMediaToHashBankDeps;
-}
-
-describe('addReportedMediaToHashBank', () => {
-  it('does nothing when the report has no media', async () => {
-    const deps = makeDeps();
-
-    await addReportedMediaToHashBank(deps, {
-      orgId: 'org1',
-      bankId: BANK.id,
-      ncmecReportId: '123',
-      media: [],
-    });
-
-    expect(deps.hmaService.addContentToBank).not.toHaveBeenCalled();
-  });
-
-  it('does not add content when the selected bank is not found for the org', async () => {
-    const deps = makeDeps({ getBankById: jest.fn().mockResolvedValue(null) });
-
-    await addReportedMediaToHashBank(deps, {
-      orgId: 'org1',
-      bankId: BANK.id,
-      ncmecReportId: '123',
-      media: MEDIA,
-    });
-
-    expect(deps.hmaService.getBankById).toHaveBeenCalledWith('org1', BANK.id);
-    expect(deps.hmaService.addContentToBank).not.toHaveBeenCalled();
-  });
-
-  it('adds every reported media item with metadata identifying the item and report', async () => {
-    const deps = makeDeps();
-
-    await addReportedMediaToHashBank(deps, {
-      orgId: 'org1',
-      bankId: BANK.id,
-      ncmecReportId: '123',
-      media: MEDIA,
-    });
-
-    expect(deps.hmaService.addContentToBank).toHaveBeenCalledTimes(3);
-    expect(deps.hmaService.addContentToBank).toHaveBeenCalledWith(
-      BANK.hma_name,
-      {
-        url: 'https://cdn.example.com/1.mp4',
-        metadata: {
-          content_id: 'type-b:vid-1',
-          json: {
-            source: 'ncmec_report',
-            orgId: 'org1',
-            ncmecReportId: '123',
-            itemId: 'vid-1',
-            itemTypeId: 'type-b',
-          },
-        },
-      },
-    );
-    expect(deps.logError).not.toHaveBeenCalled();
-  });
-
-  it('keeps adding the remaining media when one item is rejected, and logs only that item', async () => {
-    const addContentToBank = jest
-      .fn()
-      .mockResolvedValueOnce({ id: 1, signals: {} })
-      .mockRejectedValueOnce(new Error('Failed to add content to bank: 400'))
-      .mockResolvedValueOnce({ id: 3, signals: {} });
-    const deps = makeDeps({ addContentToBank });
-
-    await addReportedMediaToHashBank(deps, {
-      orgId: 'org1',
-      bankId: BANK.id,
-      ncmecReportId: '123',
-      media: MEDIA,
-    });
-
-    expect(addContentToBank).toHaveBeenCalledTimes(3);
-    expect(deps.logError).toHaveBeenCalledTimes(1);
-    const logged = jsonStringify(deps.logError.mock.calls[0][0]);
-    expect(logged).toContain('org1');
-    expect(logged).toContain('123');
-    expect(logged).toContain('img-2');
-    expect(logged).toContain(String(BANK.id));
-    expect(logged).toContain('Failed to add content to bank: 400');
-  });
-
-  it('never rejects, even when the bank lookup throws', async () => {
-    const deps = makeDeps({
-      getBankById: jest.fn().mockRejectedValue(new Error('db down')),
-    });
-
-    await expect(
-      addReportedMediaToHashBank(deps, {
-        orgId: 'org1',
-        bankId: BANK.id,
-        ncmecReportId: '123',
-        media: MEDIA,
-      }),
-    ).resolves.toBeUndefined();
-
-    expect(deps.hmaService.addContentToBank).not.toHaveBeenCalled();
-    expect(deps.logError).toHaveBeenCalledTimes(1);
-  });
-
-  it('never writes the media URL to the log, even when the error message contains it', async () => {
-    const url = MEDIA[0].url;
-    const error = new Error(
-      `Failed to parse response body. Response body started with: could not fetch ${url} (${encodeURIComponent(url)}) ${new URLSearchParams({ url }).toString()}`,
-      { cause: new Error(url) },
-    );
-    const deps = makeDeps({
-      addContentToBank: jest.fn().mockRejectedValue(error),
-    });
-
-    await addReportedMediaToHashBank(deps, {
-      orgId: 'org1',
-      bankId: BANK.id,
-      ncmecReportId: '123',
-      media: [MEDIA[0]],
-    });
-
-    expect(deps.logError).toHaveBeenCalledTimes(1);
-    const logged = jsonStringify(deps.logError.mock.calls[0][0]);
-    expect(logged).not.toContain('cdn.example.com');
-    expect(logged).toContain('img-1');
-  });
-});
diff --git a/server/services/ncmecService/addReportedMediaToHashBank.ts b/server/services/ncmecService/addReportedMediaToHashBank.ts
deleted file mode 100644
index 782a388ca..000000000
--- a/server/services/ncmecService/addReportedMediaToHashBank.ts
+++ /dev/null
@@ -1,94 +0,0 @@
-import { jsonStringify } from '../../utils/encoding.js';
-import { type logErrorJson } from '../../utils/logging.js';
-import { type HmaService } from '../hmaService/index.js';
-
-export interface AddReportedMediaToHashBankDeps {
-  hmaService: Pick<HmaService, 'getBankById' | 'addContentToBank'>;
-  logError: typeof logErrorJson;
-}
-
-type ReportedMedia = { id: string; typeId: string; url: string };
-
-/** Adds the media of an accepted NCMEC report to the org's selected hash bank.
- * Best-effort: never rejects, so a banking failure cannot turn an accepted
- * report into a retryable one. Failures are logged without the media URL. */
-export async function addReportedMediaToHashBank(
-  deps: AddReportedMediaToHashBankDeps,
-  opts: {
-    orgId: string;
-    bankId: number;
-    ncmecReportId: string;
-    media: readonly ReportedMedia[];
-  },
-): Promise<void> {
-  const { orgId, bankId, ncmecReportId, media } = opts;
-  if (media.length === 0) {
-    return;
-  }
-
-  const logFailure = (error: unknown, item?: ReportedMedia) => {
-    deps.logError({
-      error: toLogSafeError(error, item?.url),
-      message: jsonStringify({
-        event: 'ncmecReportedMediaBankingFailed',
-        orgId,
-        ncmecReportId,
-        bankId,
-        itemId: item?.id,
-        itemTypeId: item?.typeId,
-      }),
-    });
-  };
-
-  let bank;
-  try {
-    bank = await deps.hmaService.getBankById(orgId, bankId);
-  } catch (e) {
-    logFailure(e);
-    return;
-  }
-  if (!bank) {
-    return;
-  }
-  const { hma_name: hmaName } = bank;
-
-  const results = await Promise.allSettled(
-    media.map(async (item) =>
-      deps.hmaService.addContentToBank(hmaName, {
-        url: item.url,
-        metadata: {
-          content_id: `${item.typeId}:${item.id}`,
-          json: {
-            source: 'ncmec_report',
-            orgId,
-            ncmecReportId,
-            itemId: item.id,
-            itemTypeId: item.typeId,
-          },
-        },
-      }),
-    ),
-  );
-
-  results.forEach((result, i) => {
-    if (result.status === 'rejected') {
-      logFailure(result.reason, media[i]);
-    }
-  });
-}
-
-function toLogSafeError(error: unknown, url: string | undefined) {
-  const name = error instanceof Error ? error.name : 'Error';
-  let message = error instanceof Error ? error.message : String(error);
-  if (url !== undefined) {
-    const forms = [
-      url,
-      encodeURIComponent(url),
-      new URLSearchParams({ url }).toString().slice('url='.length),
-    ];
-    for (const form of forms) {
-      message = message.replaceAll(form, '[media url]');
-    }
-  }
-  return { name, message };
-}
diff --git a/server/services/ncmecService/ncmecReporting.ts b/server/services/ncmecService/ncmecReporting.ts
index 3ea837e38..105214de6 100644
--- a/server/services/ncmecService/ncmecReporting.ts
+++ b/server/services/ncmecService/ncmecReporting.ts
@@ -28,7 +28,6 @@ import {
   makeFormDataLikeWithStreams,
   type FormDataLikeWithStreams,
 } from '../networkingService/index.js';
-import { addReportedMediaToHashBank } from './addReportedMediaToHashBank.js';
 import { type NcmecReportingServicePg } from './dbTypes.js';
 import {
   ncmecDebugDump,
@@ -1724,6 +1723,65 @@ export default class NcmecReporting {
     await fetchWithRetries();
   }
 
+  async #addReportedMediaToHashBank(input: {
+    orgId: string;
+    reportedMedia: ReadonlyArray<Pick<Media, 'id' | 'typeId' | 'url'>>;
+    reportId: string;
+  }) {
+    const { orgId, reportedMedia, reportId } = input;
+    const reportedMediaHashBankId = await this.reportedMediaHashBankId(orgId);
+
+    if (reportedMediaHashBankId == null) {
+      throw new Error('Organization does not have a reported media hash bank');
+    }
+
+    const bank = await this.hmaService.getBankById(
+      orgId,
+      reportedMediaHashBankId,
+    );
+
+    if (bank == null) {
+      throw new Error('Reported media hash bank was not found');
+    }
+
+    const results = await Promise.allSettled(
+      reportedMedia.map(async (media) => {
+        const addWithRetries = withRetries(
+          {
+            maxRetries: 5,
+            initialTimeMsBetweenRetries: 5,
+            maxTimeMsBetweenRetries: 500,
+            jitter: true,
+          },
+          async () =>
+            this.hmaService.addContentToBank(bank.hma_name, {
+              url: media.url,
+              metadata: {
+                content_id: `${media.typeId}:${media.id}`,
+                json: {
+                  source: 'ncmec_report',
+                  orgId,
+                  ncmecReportId: reportId,
+                  itemId: media.id,
+                  itemTypeId: media.typeId,
+                },
+              },
+            }),
+        );
+
+        await addWithRetries();
+      }),
+    );
+
+    const failure = results.find(
+      (result): result is PromiseRejectedResult => result.status === 'rejected',
+    );
+
+    if (failure) {
+      throw failure.reason;
+    }
+  }
+
   async ncmecPreservationEndpoint(orgId: string): Promise<string | undefined> {
     const rows = await this.pgQuery
       .selectFrom('ncmec_reporting.ncmec_org_settings')
@@ -1744,6 +1802,15 @@ export default class NcmecReporting {
     return rows?.ncmec_additional_info_endpoint;
   }
 
+  async reportedMediaHashBankId(orgId: string): Promise<number | undefined> {
+    const rows = await this.pgQuery
+      .selectFrom('ncmec_reporting.ncmec_org_settings')
+      .select(['reported_media_hash_bank_id'])
+      .where('org_id', '=', orgId)
+      .executeTakeFirst();
+    return rows?.reported_media_hash_bank_id ?? undefined;
+  }
+
   async getUserHasExistingNcmeReport(params: {
     orgId: string;
     userId: string;
@@ -1969,6 +2036,7 @@ export default class NcmecReporting {
           // 3. #uploadAdditionalFile
           // 4. #finish
           // 5. #sendUserPreservationRequest
+          // 6. #addReportedMediaToHashBank
           // we should error and mark the span as failed if any single
           // call fails.
           // These 3 functions utilize #sendCyberTipRequest, which retries
@@ -2060,20 +2128,6 @@ export default class NcmecReporting {
             })
             .execute();
 
-          const reportedMediaHashBankId =
-            ncmecConfig?.reported_media_hash_bank_id;
-          if (isTest === false && reportedMediaHashBankId != null) {
-            await addReportedMediaToHashBank(
-              { hmaService: this.hmaService, logError: logErrorJson },
-              {
-                orgId: reportParams.orgId,
-                bankId: reportedMediaHashBankId,
-                ncmecReportId: reportId,
-                media: reportParams.media,
-              },
-            );
-          }
-
           if (ncmecConfig?.ncmec_preservation_endpoint && isTest === false) {
             await this.#sendUserPreservationRequest({
               orgId: reportParams.orgId,
@@ -2088,6 +2142,18 @@ export default class NcmecReporting {
               reportId: parseInt(reportId),
             });
           }
+
+          if (
+            ncmecConfig?.reported_media_hash_bank_id != null &&
+            reportParams.media.length > 0 &&
+            isTest === false
+          ) {
+            await this.#addReportedMediaToHashBank({
+              orgId: reportParams.orgId,
+              reportedMedia: reportParams.media,
+              reportId,
+            });
+          }
           return 'SUCCESS';
         } catch (e) {
           // We are intentionally using logErrorJson instead of relying on
diff --git a/server/test/integ/ncmec-submission.integ.test.ts b/server/test/integ/ncmec-submission.integ.test.ts
index ecc356d31..21e48470c 100644
--- a/server/test/integ/ncmec-submission.integ.test.ts
+++ b/server/test/integ/ncmec-submission.integ.test.ts
@@ -292,7 +292,7 @@ describe('NCMEC submitReport (integration)', () => {
   );
 
   testWithFixture(
-    'keeps the report successful and records no NCMEC error when HMA rejects the content',
+    'fails the report after retrying when HMA keeps rejecting the content',
     async ({ deps, orgId, reportId, userItemTypeId }) => {
       const { stub, ncmecReporting } = makeReporting(deps, reportId, {
         hmaAddContentStatus: 500,
@@ -301,8 +301,9 @@ describe('NCMEC submitReport (integration)', () => {
 
       const result = await ncmecReporting.submitReport(params, false);
 
-      expect(result).toBe('SUCCESS');
-      expect(hmaAddContentCalls(stub.calls)).toHaveLength(2);
+      expect(result).toBe('FAILURE');
+      // 2 media x (1 attempt + 5 retries)
+      expect(hmaAddContentCalls(stub.calls)).toHaveLength(12);
       expect(stub.calls.some((c) => c.url === PRESERVATION_URL)).toBe(true);
       const errorRow = await deps.KyselyPg.selectFrom(
         'ncmec_reporting.ncmec_reports_errors',
@@ -310,7 +311,8 @@ describe('NCMEC submitReport (integration)', () => {
         .selectAll()
         .where('job_id', '=', params.jobId!)
         .executeTakeFirst();
-      expect(errorRow).toBeUndefined();
+      expect(errorRow?.status).toBe('RETRYABLE_ERROR');
+      expect(errorRow?.last_error).not.toContain('cdn.example');
     },
     60_000,
   );

From 1e3e14b0ccc7f6828797c4e9eba82c3469482586 Mon Sep 17 00:00:00 2001
From: Marco Filho <markimkr@gmail.com>
Date: Thu, 17 Sep 2026 12:55:45 -0300
Subject: [PATCH 10/17] [196] Address review feedback

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 ..._media_hash_bank_to_ncmec_org_settings.sql | 15 ++++++---
 docs/integrations/ncmec.md                    | 30 ++++++++---------
 server/graphql/modules/ncmec.resolver.test.ts | 32 ++++++++++++++-----
 .../modules/ncmecOrgSettingsValidation.ts     |  5 +++
 server/services/hmaService/index.test.ts      | 27 ++++++++++++++++
 server/services/hmaService/index.ts           | 19 +++++++----
 .../services/ncmecService/ncmecReporting.ts   |  6 +++-
 .../ncmecService/ncmecReviewerErrors.test.ts  | 12 +++++++
 .../ncmecService/ncmecReviewerErrors.ts       | 11 +++++++
 .../test/integ/ncmec-submission.integ.test.ts | 27 ++++++++++------
 10 files changed, 140 insertions(+), 44 deletions(-)

diff --git a/db/src/scripts/api-server-pg/2026.09.15T04.40.33.add_reported_media_hash_bank_to_ncmec_org_settings.sql b/db/src/scripts/api-server-pg/2026.09.15T04.40.33.add_reported_media_hash_bank_to_ncmec_org_settings.sql
index 617493eef..cf3a046d5 100644
--- a/db/src/scripts/api-server-pg/2026.09.15T04.40.33.add_reported_media_hash_bank_to_ncmec_org_settings.sql
+++ b/db/src/scripts/api-server-pg/2026.09.15T04.40.33.add_reported_media_hash_bank_to_ncmec_org_settings.sql
@@ -1,11 +1,16 @@
 ALTER TABLE ncmec_reporting.ncmec_org_settings
   ADD COLUMN IF NOT EXISTS reported_media_hash_bank_id integer NULL;
 
-ALTER TABLE ncmec_reporting.ncmec_org_settings
-  ADD CONSTRAINT ncmec_org_settings_reported_media_hash_bank_fkey
-  FOREIGN KEY (reported_media_hash_bank_id)
-  REFERENCES public.hash_banks(id)
-  ON DELETE SET NULL;
+DO $$
+BEGIN
+  ALTER TABLE ncmec_reporting.ncmec_org_settings
+    ADD CONSTRAINT ncmec_org_settings_reported_media_hash_bank_fkey
+    FOREIGN KEY (reported_media_hash_bank_id)
+    REFERENCES public.hash_banks(id)
+    ON DELETE SET NULL;
+EXCEPTION
+  WHEN duplicate_object THEN NULL;
+END $$;
 
 COMMENT ON COLUMN ncmec_reporting.ncmec_org_settings.reported_media_hash_bank_id IS
   'When set, media from accepted production NCMEC reports is added to this hash bank.';
diff --git a/docs/integrations/ncmec.md b/docs/integrations/ncmec.md
index 29e160fc7..fb9639d3f 100644
--- a/docs/integrations/ncmec.md
+++ b/docs/integrations/ncmec.md
@@ -34,21 +34,21 @@ Configure NCMEC reporting under **Settings** → **NCMEC Settings**.
 
 ![Setting up NCMEC reporting on Coop: add the required information for the reports submitted to NCMEC for content violating your company policies](../images/settings-ncmec.png)
 
-| Setting                                  | Description                                                                                                                                                                                                                                         |
-| ---------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **Username**                             | Your NCMEC CyberTipline API username.                                                                                                                                                                                                               |
-| **Password**                             | Your NCMEC CyberTipline API password.                                                                                                                                                                                                               |
-| **Company Report Name**                  | Your organization name as it appears in NCMEC reports. This value is also sent as the ESP service name for the reported user in each CyberTip.                                                                                                      |
-| **Legal URL**                            | URL to your Terms of Service or legal policies (e.g. `https://yourcompany.com/terms`).                                                                                                                                                              |
-| **Contact Email**                        | Email for the reporting person on the CyberTip. The XML receipt from NCMEC can serve as the ESP notification.                                                                                                                                       |
-| **Terms of Service**                     | TOS text or URL to an acceptable use policy relevant to the incident being reported. Maximum 3000 characters.                                                                                                                                       |
-| **Contact Person (for law enforcement)** | A contact person law enforcement can reach (other than the reporting contact email): first name, last name, email, phone.                                                                                                                           |
-| **More Info URL**                        | URL for additional information about your reporting process (e.g. `https://yourcompany.com/ncmec-info`). Used as the web page URL when "Default internet detail type" is set to "Web page."                                                         |
-| **Default NCMEC Queue**                  | When reviewers click "Enqueue to NCMEC," jobs are sent to this queue. Leave as "Use org default queue" to fall back to the organization's default queue.                                                                                            |
-| **Hash Bank for Reported Media**         | Media from each CyberTip accepted by NCMEC is added to this hash bank so it can be matched if it is uploaded again. Only applies to [production submissions](#test-vs-production-submissions).                                                      |
-| **Default Internet Detail Type**         | The incident context (channel/medium) included in every CyberTip: Web page, Email, Newsgroup, Chat/IM, Online gaming, Cell phone, Non-internet, or Peer-to-peer.                                                                                    |
-| **NCMEC Additional Info Endpoint**       | Webhook URL Coop calls before submitting a CyberTip to fetch enriched user and media metadata. See [Additional Info Endpoint](#additional-info-endpoint) below. Strongly recommended as without it, CyberTips are submitted with minimal user data. |
-| **NCMEC Preservation Endpoint**          | Webhook URL Coop calls after a successful CyberTip submission with the report ID. See [Preservation Endpoint](#preservation-endpoint) below.                                                                                                        |
+| Setting                                  | Description                                                                                                                                                                                                                                                                             |
+| ---------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **Username**                             | Your NCMEC CyberTipline API username.                                                                                                                                                                                                                                                   |
+| **Password**                             | Your NCMEC CyberTipline API password.                                                                                                                                                                                                                                                   |
+| **Company Report Name**                  | Your organization name as it appears in NCMEC reports. This value is also sent as the ESP service name for the reported user in each CyberTip.                                                                                                                                          |
+| **Legal URL**                            | URL to your Terms of Service or legal policies (e.g. `https://yourcompany.com/terms`).                                                                                                                                                                                                  |
+| **Contact Email**                        | Email for the reporting person on the CyberTip. The XML receipt from NCMEC can serve as the ESP notification.                                                                                                                                                                           |
+| **Terms of Service**                     | TOS text or URL to an acceptable use policy relevant to the incident being reported. Maximum 3000 characters.                                                                                                                                                                           |
+| **Contact Person (for law enforcement)** | A contact person law enforcement can reach (other than the reporting contact email): first name, last name, email, phone.                                                                                                                                                               |
+| **More Info URL**                        | URL for additional information about your reporting process (e.g. `https://yourcompany.com/ncmec-info`). Used as the web page URL when "Default internet detail type" is set to "Web page."                                                                                             |
+| **Default NCMEC Queue**                  | When reviewers click "Enqueue to NCMEC," jobs are sent to this queue. Leave as "Use org default queue" to fall back to the organization's default queue.                                                                                                                                |
+| **Hash Bank for Reported Media**         | Media from each CyberTip accepted by NCMEC is added to this hash bank so it can be matched if it is uploaded again. Each item is retried a few times; if it still fails, the submission is marked as failed. Only applies to [production submissions](#test-vs-production-submissions). |
+| **Default Internet Detail Type**         | The incident context (channel/medium) included in every CyberTip: Web page, Email, Newsgroup, Chat/IM, Online gaming, Cell phone, Non-internet, or Peer-to-peer.                                                                                                                        |
+| **NCMEC Additional Info Endpoint**       | Webhook URL Coop calls before submitting a CyberTip to fetch enriched user and media metadata. See [Additional Info Endpoint](#additional-info-endpoint) below. Strongly recommended as without it, CyberTips are submitted with minimal user data.                                     |
+| **NCMEC Preservation Endpoint**          | Webhook URL Coop calls after a successful CyberTip submission with the report ID. See [Preservation Endpoint](#preservation-endpoint) below.                                                                                                                                            |
 
 Saving credentials, Company Report Name, and Legal URL enables NCMEC reporting for the organization. The remaining fields are not _required_ to submit a CyberTip, but **filling them out makes reports significantly more actionable** for NCMEC investigators.
 
diff --git a/server/graphql/modules/ncmec.resolver.test.ts b/server/graphql/modules/ncmec.resolver.test.ts
index 618244b68..181e08294 100644
--- a/server/graphql/modules/ncmec.resolver.test.ts
+++ b/server/graphql/modules/ncmec.resolver.test.ts
@@ -178,13 +178,10 @@ describe('updateNcmecOrgSettings reported media hash bank', () => {
     );
   });
 
-  it('rejects a bank from another org and a missing bank with the same message', async () => {
+  it('looks the bank up only within the user org, so a bank from another org reads as missing', async () => {
     const { ctx, updateNcmecOrgSettings, getBankById } = makeCtx([
       UserPermission.MANAGE_ORG,
     ]);
-    getBankById.mockImplementation(async (orgId: string, id: number) =>
-      orgId === 'org-2' && id === 7 ? { id: 7, org_id: 'org-2' } : null,
-    );
     const errorFor = async (id: string) =>
       Mutation.updateNcmecOrgSettings(
         {},
@@ -195,11 +192,15 @@ describe('updateNcmecOrgSettings reported media hash bank', () => {
         (e: Error) => e.message,
       );
 
-    const otherOrgMessage = await errorFor('7');
-    const missingMessage = await errorFor('999');
+    const otherOrgBankMessage = await errorFor('7');
+    const missingBankMessage = await errorFor('999');
 
-    expect(otherOrgMessage).toBeDefined();
-    expect(otherOrgMessage).toBe(missingMessage);
+    expect(getBankById.mock.calls).toEqual([
+      ['org-1', 7],
+      ['org-1', 999],
+    ]);
+    expect(otherOrgBankMessage).toBe('Selected hash bank was not found.');
+    expect(missingBankMessage).toBe(otherOrgBankMessage);
     expect(updateNcmecOrgSettings).not.toHaveBeenCalled();
   });
 
@@ -218,6 +219,21 @@ describe('updateNcmecOrgSettings reported media hash bank', () => {
     expect(updateNcmecOrgSettings).not.toHaveBeenCalled();
   });
 
+  it('rejects a bank id above the Postgres integer range before looking it up', async () => {
+    const { ctx, updateNcmecOrgSettings, getBankById } = makeCtx([
+      UserPermission.MANAGE_ORG,
+    ]);
+    await expect(
+      Mutation.updateNcmecOrgSettings(
+        {},
+        { input: { ...VALID_INPUT, reportedMediaHashBankId: '2147483648' } },
+        ctx,
+      ),
+    ).rejects.toThrow('reportedMediaHashBankId must be a hash bank ID.');
+    expect(getBankById).not.toHaveBeenCalled();
+    expect(updateNcmecOrgSettings).not.toHaveBeenCalled();
+  });
+
   it('rejects a non-numeric bank id', async () => {
     const { ctx, updateNcmecOrgSettings, getBankById } = makeCtx([
       UserPermission.MANAGE_ORG,
diff --git a/server/graphql/modules/ncmecOrgSettingsValidation.ts b/server/graphql/modules/ncmecOrgSettingsValidation.ts
index d725c30cb..e73426f6d 100644
--- a/server/graphql/modules/ncmecOrgSettingsValidation.ts
+++ b/server/graphql/modules/ncmecOrgSettingsValidation.ts
@@ -113,7 +113,12 @@ export function parseReportedMediaHashBankId(
   if (!/^\d+$/.test(raw)) {
     throw userInputError('reportedMediaHashBankId must be a hash bank ID.');
   }
+
   const bankId = Number(raw);
 
+  if (!Number.isSafeInteger(bankId) || bankId > 2_147_483_647) {
+    throw userInputError('reportedMediaHashBankId must be a hash bank ID.');
+  }
+
   return bankId;
 }
diff --git a/server/services/hmaService/index.test.ts b/server/services/hmaService/index.test.ts
index 7f1a4b94c..dee0f0521 100644
--- a/server/services/hmaService/index.test.ts
+++ b/server/services/hmaService/index.test.ts
@@ -491,6 +491,33 @@ describe('HmaService', () => {
         });
       });
 
+      it('does not send a note with only whitespace', async () => {
+        const { fetchHTTP, svc } = makeOkService();
+
+        await svc.addContentToBank('COOP_ORG1_BANK', {
+          ...URL_OPTIONS,
+          metadata: { content_id: 'type1:item1' },
+          note: '   ',
+        });
+
+        expect(jsonParse(fetchHTTP.mock.calls[0][0].body)).toEqual({
+          metadata: { content_id: 'type1:item1' },
+        });
+      });
+
+      it('does not append a note with only whitespace on file uploads', async () => {
+        const { fetchHTTP, svc } = makeOkService();
+
+        await svc.addContentToBank('COOP_ORG1_BANK', {
+          file: new Blob(['bytes'], { type: 'image/png' }),
+          contentType: 'photo',
+          note: ' \n\t ',
+        });
+
+        const form = fetchHTTP.mock.calls[0][0].body as FormData;
+        expect(form.has('note')).toBe(false);
+      });
+
       it('accepts a note with exactly 255 characters', async () => {
         const { fetchHTTP, svc } = makeOkService();
         const note = 'a'.repeat(255);
diff --git a/server/services/hmaService/index.ts b/server/services/hmaService/index.ts
index d3e950b4e..31b7bdde6 100644
--- a/server/services/hmaService/index.ts
+++ b/server/services/hmaService/index.ts
@@ -805,7 +805,8 @@ export class HmaService {
       note?: string;
     },
   ): Promise<BankContentResponse> {
-    const { file, contentType, url, metadata, note } = options;
+    const { file, contentType, url, metadata } = options;
+    const note = toHmaNote(options.note);
 
     if (!url && (!file || !contentType)) {
       throw new Error(
@@ -813,11 +814,6 @@ export class HmaService {
       );
     }
 
-    // HMA counts code points (Python len), not UTF-16 units.
-    if (note && [...note].length > 255) {
-      throw new Error('note must be 255 characters or less');
-    }
-
     let response;
     if (url) {
       // HMA reads `metadata` from the JSON body only; query-param metadata is dropped.
@@ -959,4 +955,15 @@ export class HmaService {
   }
 }
 
+function toHmaNote(note: string | undefined): string | undefined {
+  if (!note?.trim()) {
+    return undefined;
+  }
+  // HMA counts code points (Python len), not UTF-16 units.
+  if ([...note].length > 255) {
+    throw new Error('note must be 255 characters or less');
+  }
+  return note;
+}
+
 export default inject(['fetchHTTP', 'KyselyPg'], HmaService);
diff --git a/server/services/ncmecService/ncmecReporting.ts b/server/services/ncmecService/ncmecReporting.ts
index 105214de6..5b0c0bb32 100644
--- a/server/services/ncmecService/ncmecReporting.ts
+++ b/server/services/ncmecService/ncmecReporting.ts
@@ -1778,7 +1778,11 @@ export default class NcmecReporting {
     );
 
     if (failure) {
-      throw failure.reason;
+      const reason =
+        failure.reason instanceof Error
+          ? failure.reason.message
+          : String(failure.reason);
+      throw new Error(`Failed to add reported media to hash bank: ${reason}`);
     }
   }
 
diff --git a/server/services/ncmecService/ncmecReviewerErrors.test.ts b/server/services/ncmecService/ncmecReviewerErrors.test.ts
index 6fda1b4e0..e86fdc778 100644
--- a/server/services/ncmecService/ncmecReviewerErrors.test.ts
+++ b/server/services/ncmecService/ncmecReviewerErrors.test.ts
@@ -49,6 +49,18 @@ describe('summarizeNcmecErrorForReviewer', () => {
     ).toMatch(/failed validation/);
   });
 
+  it('classifies reported media hash bank failures separately from NCMEC errors', () => {
+    for (const message of [
+      'Failed to add reported media to hash bank: Failed to add content to bank: 500',
+      'Reported media hash bank was not found',
+      'Organization does not have a reported media hash bank',
+    ]) {
+      expect(summarizeNcmecErrorForReviewer(new Error(message))).toBe(
+        'NCMEC accepted the report, but adding its media to the hash bank failed. Check the bank in Settings → NCMEC.',
+      );
+    }
+  });
+
   it('classifies missing-config throws to a config category', () => {
     expect(
       summarizeNcmecErrorForReviewer(
diff --git a/server/services/ncmecService/ncmecReviewerErrors.ts b/server/services/ncmecService/ncmecReviewerErrors.ts
index 299f5a111..7673e982b 100644
--- a/server/services/ncmecService/ncmecReviewerErrors.ts
+++ b/server/services/ncmecService/ncmecReviewerErrors.ts
@@ -11,6 +11,8 @@ const REVIEWER_ERROR_MESSAGES = {
   VALIDATION: 'Report failed validation before submission.',
   CONFIG: 'NCMEC configuration is incomplete. Check Settings → NCMEC.',
   MEDIA: 'Could not assemble the reported media for submission.',
+  HASH_BANK:
+    'NCMEC accepted the report, but adding its media to the hash bank failed. Check the bank in Settings → NCMEC.',
   UNKNOWN: 'Unexpected error submitting to NCMEC. See server logs.',
 } as const;
 
@@ -48,6 +50,15 @@ const REVIEWER_PREFIX_RULES: readonly {
     category: 'REJECTED',
   },
   { prefix: 'NCMEC report finish failed', category: 'SERVER' },
+  {
+    prefix: 'Failed to add reported media to hash bank',
+    category: 'HASH_BANK',
+  },
+  { prefix: 'Reported media hash bank was not found', category: 'HASH_BANK' },
+  {
+    prefix: 'Organization does not have a reported media hash bank',
+    category: 'HASH_BANK',
+  },
 ];
 
 function classifyByHttpStatus(status: number | undefined): string {
diff --git a/server/test/integ/ncmec-submission.integ.test.ts b/server/test/integ/ncmec-submission.integ.test.ts
index 21e48470c..020ca7907 100644
--- a/server/test/integ/ncmec-submission.integ.test.ts
+++ b/server/test/integ/ncmec-submission.integ.test.ts
@@ -51,7 +51,7 @@ function makeReporting(
 function reportWithTwoMedia(
   orgId: string,
   userItemTypeId: string,
-): NCMECReportParams {
+): NCMECReportParams & { jobId: string } {
   return {
     orgId,
     reviewerId: 'reviewer-1',
@@ -238,22 +238,28 @@ describe('NCMEC submitReport (integration)', () => {
           ),
         ).toBe(true);
       }
-      expect(
-        addCalls.map((c) => new URL(c.url).searchParams.get('url')).sort(),
-      ).toEqual([SECOND_MEDIA_URL, MEDIA_URL].sort());
-      const bodies = addCalls.map((c) => jsonParse(c.body as JsonOf<unknown>));
-      expect(bodies).toContainEqual({
+      const bodyByMediaUrl = Object.fromEntries(
+        addCalls.map((c) => [
+          new URL(c.url).searchParams.get('url'),
+          jsonParse(c.body as JsonOf<unknown>),
+        ]),
+      );
+      const expectedBody = (itemId: string) => ({
         metadata: {
-          content_id: `${userItemTypeId}:media-1`,
+          content_id: `${userItemTypeId}:${itemId}`,
           json: {
             source: 'ncmec_report',
             orgId,
             ncmecReportId: reportId,
-            itemId: 'media-1',
+            itemId,
             itemTypeId: userItemTypeId,
           },
         },
       });
+      expect(bodyByMediaUrl).toEqual({
+        [MEDIA_URL]: expectedBody('media-1'),
+        [SECOND_MEDIA_URL]: expectedBody('media-2'),
+      });
     },
     60_000,
   );
@@ -309,9 +315,12 @@ describe('NCMEC submitReport (integration)', () => {
         'ncmec_reporting.ncmec_reports_errors',
       )
         .selectAll()
-        .where('job_id', '=', params.jobId!)
+        .where('job_id', '=', params.jobId)
         .executeTakeFirst();
       expect(errorRow?.status).toBe('RETRYABLE_ERROR');
+      expect(errorRow?.last_error).toContain(
+        'adding its media to the hash bank failed',
+      );
       expect(errorRow?.last_error).not.toContain('cdn.example');
     },
     60_000,

From e5f1225bb2e7ab5c427b80945d47259203dfc881 Mon Sep 17 00:00:00 2001
From: Marco Filho <markimkr@gmail.com>
Date: Thu, 17 Sep 2026 14:48:44 -0300
Subject: [PATCH 11/17] [196] Use the hash bank read before submitting the
 report

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../services/ncmecService/ncmecReporting.ts   | 23 +++-----
 .../ncmecService/ncmecReviewerErrors.test.ts  |  1 -
 .../ncmecService/ncmecReviewerErrors.ts       |  4 --
 .../test/integ/ncmec-submission.integ.test.ts | 54 ++++++++++++++++++-
 4 files changed, 59 insertions(+), 23 deletions(-)

diff --git a/server/services/ncmecService/ncmecReporting.ts b/server/services/ncmecService/ncmecReporting.ts
index 5b0c0bb32..85aa2e93c 100644
--- a/server/services/ncmecService/ncmecReporting.ts
+++ b/server/services/ncmecService/ncmecReporting.ts
@@ -1727,13 +1727,9 @@ export default class NcmecReporting {
     orgId: string;
     reportedMedia: ReadonlyArray<Pick<Media, 'id' | 'typeId' | 'url'>>;
     reportId: string;
+    reportedMediaHashBankId: number;
   }) {
-    const { orgId, reportedMedia, reportId } = input;
-    const reportedMediaHashBankId = await this.reportedMediaHashBankId(orgId);
-
-    if (reportedMediaHashBankId == null) {
-      throw new Error('Organization does not have a reported media hash bank');
-    }
+    const { orgId, reportedMedia, reportId, reportedMediaHashBankId } = input;
 
     const bank = await this.hmaService.getBankById(
       orgId,
@@ -1806,15 +1802,6 @@ export default class NcmecReporting {
     return rows?.ncmec_additional_info_endpoint;
   }
 
-  async reportedMediaHashBankId(orgId: string): Promise<number | undefined> {
-    const rows = await this.pgQuery
-      .selectFrom('ncmec_reporting.ncmec_org_settings')
-      .select(['reported_media_hash_bank_id'])
-      .where('org_id', '=', orgId)
-      .executeTakeFirst();
-    return rows?.reported_media_hash_bank_id ?? undefined;
-  }
-
   async getUserHasExistingNcmeReport(params: {
     orgId: string;
     userId: string;
@@ -2147,8 +2134,11 @@ export default class NcmecReporting {
             });
           }
 
+          const reportedMediaHashBankId =
+            ncmecConfig?.reported_media_hash_bank_id;
+
           if (
-            ncmecConfig?.reported_media_hash_bank_id != null &&
+            reportedMediaHashBankId != null &&
             reportParams.media.length > 0 &&
             isTest === false
           ) {
@@ -2156,6 +2146,7 @@ export default class NcmecReporting {
               orgId: reportParams.orgId,
               reportedMedia: reportParams.media,
               reportId,
+              reportedMediaHashBankId,
             });
           }
           return 'SUCCESS';
diff --git a/server/services/ncmecService/ncmecReviewerErrors.test.ts b/server/services/ncmecService/ncmecReviewerErrors.test.ts
index e86fdc778..a2a8aa1e8 100644
--- a/server/services/ncmecService/ncmecReviewerErrors.test.ts
+++ b/server/services/ncmecService/ncmecReviewerErrors.test.ts
@@ -53,7 +53,6 @@ describe('summarizeNcmecErrorForReviewer', () => {
     for (const message of [
       'Failed to add reported media to hash bank: Failed to add content to bank: 500',
       'Reported media hash bank was not found',
-      'Organization does not have a reported media hash bank',
     ]) {
       expect(summarizeNcmecErrorForReviewer(new Error(message))).toBe(
         'NCMEC accepted the report, but adding its media to the hash bank failed. Check the bank in Settings → NCMEC.',
diff --git a/server/services/ncmecService/ncmecReviewerErrors.ts b/server/services/ncmecService/ncmecReviewerErrors.ts
index 7673e982b..956f45ed1 100644
--- a/server/services/ncmecService/ncmecReviewerErrors.ts
+++ b/server/services/ncmecService/ncmecReviewerErrors.ts
@@ -55,10 +55,6 @@ const REVIEWER_PREFIX_RULES: readonly {
     category: 'HASH_BANK',
   },
   { prefix: 'Reported media hash bank was not found', category: 'HASH_BANK' },
-  {
-    prefix: 'Organization does not have a reported media hash bank',
-    category: 'HASH_BANK',
-  },
 ];
 
 function classifyByHttpStatus(status: number | undefined): string {
diff --git a/server/test/integ/ncmec-submission.integ.test.ts b/server/test/integ/ncmec-submission.integ.test.ts
index 020ca7907..3f92d5166 100644
--- a/server/test/integ/ncmec-submission.integ.test.ts
+++ b/server/test/integ/ncmec-submission.integ.test.ts
@@ -11,6 +11,11 @@ import {
   NcmecReporting,
   type NCMECReportParams,
 } from '../../services/ncmecService/index.js';
+import {
+  type CoopRequestQuery,
+  type FetchHTTP,
+  type HandleResponseBody,
+} from '../../services/networkingService/index.js';
 import { jsonParse, type JsonOf } from '../../utils/encoding.js';
 import createOrg from '../fixtureHelpers/createOrg.js';
 import {
@@ -30,20 +35,27 @@ function makeReporting(
   deps: Deps,
   reportId: string,
   stubOpts: { hmaAddContentStatus?: number } = {},
+  onRequest?: (url: string) => Promise<void>,
 ) {
   const stub = makeStubFetchHTTP(reportId, 'f1', {
     preservationUrl: PRESERVATION_URL,
     ...stubOpts,
   });
+  const fetchHTTP: FetchHTTP = async <T extends HandleResponseBody>(
+    query: CoopRequestQuery<T>,
+  ) => {
+    await onRequest?.(query.url);
+    return stub.fetchHTTP(query);
+  };
   const ncmecReporting = new NcmecReporting(
     deps.KyselyPg,
     deps.KyselyPgReadReplica,
-    stub.fetchHTTP,
+    fetchHTTP,
     deps.SigningKeyPairService,
     deps.ModerationConfigService,
     deps.getItemTypeEventuallyConsistent,
     deps.Tracer,
-    new HmaService(stub.fetchHTTP, deps.KyselyPg),
+    new HmaService(fetchHTTP, deps.KyselyPg),
   );
   return { stub, ncmecReporting };
 }
@@ -264,6 +276,44 @@ describe('NCMEC submitReport (integration)', () => {
     60_000,
   );
 
+  testWithFixture(
+    'uses the bank read before submitting, even if the setting is cleared during submission',
+    async ({ deps, orgId, reportId, hashBank, userItemTypeId }) => {
+      const { stub, ncmecReporting } = makeReporting(
+        deps,
+        reportId,
+        {},
+        async (url) => {
+          if (url.endsWith('/ispws/submit')) {
+            await deps.KyselyPg.updateTable(
+              'ncmec_reporting.ncmec_org_settings',
+            )
+              .set({ reported_media_hash_bank_id: null })
+              .where('org_id', '=', orgId)
+              .execute();
+          }
+        },
+      );
+
+      const result = await ncmecReporting.submitReport(
+        reportWithTwoMedia(orgId, userItemTypeId),
+        false,
+      );
+
+      expect(result).toBe('SUCCESS');
+      const addCalls = hmaAddContentCalls(stub.calls);
+      expect(addCalls).toHaveLength(2);
+      for (const call of addCalls) {
+        expect(
+          new URL(call.url).pathname.endsWith(
+            `/c/bank/${hashBank.hma_name}/content`,
+          ),
+        ).toBe(true);
+      }
+    },
+    60_000,
+  );
+
   testWithFixture(
     'does not add anything to a hash bank when the org has no bank selected',
     async ({ deps, ncmecReporting, orgId, stub, userItemTypeId }) => {

From 3cc06879c4c46b78c0db3b3afed38daac04aeed4 Mon Sep 17 00:00:00 2001
From: Marco Filho <markimkr@gmail.com>
Date: Sat, 19 Sep 2026 08:32:46 -0300
Subject: [PATCH 12/17] [196] Bank reported media in its own BullMQ worker

Submitting a CyberTip now only enqueues one job per reported media item, so
adding media to the hash bank can no longer slow down or fail an accepted
report. The new worker retries each item on its own.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 docs/development/local.md                     |   8 +
 docs/integrations/ncmec.md                    |  30 ++--
 server/iocContainer/index.ts                  |  12 ++
 .../iocContainer/services/workersAndJobs.ts   |   7 +
 server/queues/reportedMediaBankingQueue.ts    |  87 +++++++++++
 .../services/ncmecService/ncmecReporting.ts   |  94 ++++--------
 .../ncmecService/ncmecReviewerErrors.test.ts  |  11 --
 .../ncmecService/ncmecReviewerErrors.ts       |   7 -
 server/services/ncmecService/ncmecService.ts  |   7 +-
 .../test/fixtureHelpers/makeStubFetchHTTP.ts  |  18 +--
 .../test/integ/ncmec-submission.integ.test.ts | 145 ++++++++----------
 .../ReportedMediaBankingWorker.test.ts        |  90 +++++++++++
 .../ReportedMediaBankingWorker.ts             |  92 +++++++++++
 13 files changed, 407 insertions(+), 201 deletions(-)
 create mode 100644 server/queues/reportedMediaBankingQueue.ts
 create mode 100644 server/workers_jobs/ReportedMediaBankingWorker.test.ts
 create mode 100644 server/workers_jobs/ReportedMediaBankingWorker.ts

diff --git a/docs/development/local.md b/docs/development/local.md
index e56fbc3c5..4fa234055 100644
--- a/docs/development/local.md
+++ b/docs/development/local.md
@@ -164,6 +164,14 @@ npm run runWorkerOrJob ItemProcessingWorker
 
 Without this running, submitted items will be enqueued in Redis but not processed. Other available workers/jobs can be found in `server/iocContainer/services/workersAndJobs.ts`.
 
+Media from accepted NCMEC reports is added to the configured hash bank by
+another worker, which you only need when working on that flow:
+
+```sh
+cd server
+npm run runWorkerOrJob ReportedMediaBankingWorker
+```
+
 To preview emails locally without configuring SES or SendGrid, add the
 following to `server/.env`. The recipient, subject, and rendered content will
 be printed in the server terminal. This transport requires
diff --git a/docs/integrations/ncmec.md b/docs/integrations/ncmec.md
index fb9639d3f..8a00871b9 100644
--- a/docs/integrations/ncmec.md
+++ b/docs/integrations/ncmec.md
@@ -34,21 +34,21 @@ Configure NCMEC reporting under **Settings** → **NCMEC Settings**.
 
 ![Setting up NCMEC reporting on Coop: add the required information for the reports submitted to NCMEC for content violating your company policies](../images/settings-ncmec.png)
 
-| Setting                                  | Description                                                                                                                                                                                                                                                                             |
-| ---------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **Username**                             | Your NCMEC CyberTipline API username.                                                                                                                                                                                                                                                   |
-| **Password**                             | Your NCMEC CyberTipline API password.                                                                                                                                                                                                                                                   |
-| **Company Report Name**                  | Your organization name as it appears in NCMEC reports. This value is also sent as the ESP service name for the reported user in each CyberTip.                                                                                                                                          |
-| **Legal URL**                            | URL to your Terms of Service or legal policies (e.g. `https://yourcompany.com/terms`).                                                                                                                                                                                                  |
-| **Contact Email**                        | Email for the reporting person on the CyberTip. The XML receipt from NCMEC can serve as the ESP notification.                                                                                                                                                                           |
-| **Terms of Service**                     | TOS text or URL to an acceptable use policy relevant to the incident being reported. Maximum 3000 characters.                                                                                                                                                                           |
-| **Contact Person (for law enforcement)** | A contact person law enforcement can reach (other than the reporting contact email): first name, last name, email, phone.                                                                                                                                                               |
-| **More Info URL**                        | URL for additional information about your reporting process (e.g. `https://yourcompany.com/ncmec-info`). Used as the web page URL when "Default internet detail type" is set to "Web page."                                                                                             |
-| **Default NCMEC Queue**                  | When reviewers click "Enqueue to NCMEC," jobs are sent to this queue. Leave as "Use org default queue" to fall back to the organization's default queue.                                                                                                                                |
-| **Hash Bank for Reported Media**         | Media from each CyberTip accepted by NCMEC is added to this hash bank so it can be matched if it is uploaded again. Each item is retried a few times; if it still fails, the submission is marked as failed. Only applies to [production submissions](#test-vs-production-submissions). |
-| **Default Internet Detail Type**         | The incident context (channel/medium) included in every CyberTip: Web page, Email, Newsgroup, Chat/IM, Online gaming, Cell phone, Non-internet, or Peer-to-peer.                                                                                                                        |
-| **NCMEC Additional Info Endpoint**       | Webhook URL Coop calls before submitting a CyberTip to fetch enriched user and media metadata. See [Additional Info Endpoint](#additional-info-endpoint) below. Strongly recommended as without it, CyberTips are submitted with minimal user data.                                     |
-| **NCMEC Preservation Endpoint**          | Webhook URL Coop calls after a successful CyberTip submission with the report ID. See [Preservation Endpoint](#preservation-endpoint) below.                                                                                                                                            |
+| Setting                                  | Description                                                                                                                                                                                                                                                                                            |
+| ---------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| **Username**                             | Your NCMEC CyberTipline API username.                                                                                                                                                                                                                                                                  |
+| **Password**                             | Your NCMEC CyberTipline API password.                                                                                                                                                                                                                                                                  |
+| **Company Report Name**                  | Your organization name as it appears in NCMEC reports. This value is also sent as the ESP service name for the reported user in each CyberTip.                                                                                                                                                         |
+| **Legal URL**                            | URL to your Terms of Service or legal policies (e.g. `https://yourcompany.com/terms`).                                                                                                                                                                                                                 |
+| **Contact Email**                        | Email for the reporting person on the CyberTip. The XML receipt from NCMEC can serve as the ESP notification.                                                                                                                                                                                          |
+| **Terms of Service**                     | TOS text or URL to an acceptable use policy relevant to the incident being reported. Maximum 3000 characters.                                                                                                                                                                                          |
+| **Contact Person (for law enforcement)** | A contact person law enforcement can reach (other than the reporting contact email): first name, last name, email, phone.                                                                                                                                                                              |
+| **More Info URL**                        | URL for additional information about your reporting process (e.g. `https://yourcompany.com/ncmec-info`). Used as the web page URL when "Default internet detail type" is set to "Web page."                                                                                                            |
+| **Default NCMEC Queue**                  | When reviewers click "Enqueue to NCMEC," jobs are sent to this queue. Leave as "Use org default queue" to fall back to the organization's default queue.                                                                                                                                               |
+| **Hash Bank for Reported Media**         | Media from each CyberTip accepted by NCMEC is added to this hash bank so it can be matched if it is uploaded again. Adding runs in the background (`ReportedMediaBankingWorker`), so it never blocks or fails the CyberTip. Only applies to [production submissions](#test-vs-production-submissions). |
+| **Default Internet Detail Type**         | The incident context (channel/medium) included in every CyberTip: Web page, Email, Newsgroup, Chat/IM, Online gaming, Cell phone, Non-internet, or Peer-to-peer.                                                                                                                                       |
+| **NCMEC Additional Info Endpoint**       | Webhook URL Coop calls before submitting a CyberTip to fetch enriched user and media metadata. See [Additional Info Endpoint](#additional-info-endpoint) below. Strongly recommended as without it, CyberTips are submitted with minimal user data.                                                    |
+| **NCMEC Preservation Endpoint**          | Webhook URL Coop calls after a successful CyberTip submission with the report ID. See [Preservation Endpoint](#preservation-endpoint) below.                                                                                                                                                           |
 
 Saving credentials, Company Report Name, and Legal URL enables NCMEC reporting for the organization. The remaining fields are not _required_ to submit a CyberTip, but **filling them out makes reports significantly more actionable** for NCMEC investigators.
 
diff --git a/server/iocContainer/index.ts b/server/iocContainer/index.ts
index 4ce8a390a..7cf848b83 100644
--- a/server/iocContainer/index.ts
+++ b/server/iocContainer/index.ts
@@ -34,6 +34,10 @@ import {
   makeItemSubmissionBulkWrite,
   type ItemSubmissionBulkWrite,
 } from '../queues/itemSubmissionQueue.js';
+import {
+  makeReportedMediaBankingEnqueue,
+  type ReportedMediaBankingEnqueue,
+} from '../queues/reportedMediaBankingQueue.js';
 import makeActionPublisher, {
   type ActionPublisher,
   type ActionTargetItem,
@@ -344,6 +348,8 @@ export interface Dependencies {
 
   itemSubmissionQueueBulkWrite: ItemSubmissionBulkWrite;
   itemSubmissionRetryQueueBulkWrite: ItemSubmissionBulkWrite;
+  /** Enqueues media of accepted NCMEC reports for hash banking. */
+  reportedMediaBankingEnqueue: ReportedMediaBankingEnqueue;
   IORedis: IORedis.Redis | Cluster;
   /**
    * Dedicated ioredis client for the items-async enqueue path. Same Redis
@@ -734,6 +740,11 @@ export default async function getBottle(
   bottle.factory('itemSubmissionRetryQueueBulkWrite', (container) =>
     makeItemSubmissionBulkWrite(container.IORedis, ITEM_SUBMISSION_DLQ_NAME),
   );
+  // Enqueued from the NCMEC submission path, so a Redis outage has to fail
+  // fast instead of buffering and holding up an accepted report.
+  bottle.factory('reportedMediaBankingEnqueue', (container) =>
+    makeReportedMediaBankingEnqueue(container.IORedisEnqueueNoBuffer),
+  );
 
   // Loggers
   register(bottle, 'RuleExecutionLogger', makeRuleExecutionLogger);
@@ -1753,6 +1764,7 @@ export default async function getBottle(
             'Scylla',
             'itemSubmissionQueueBulkWrite',
             'itemSubmissionRetryQueueBulkWrite',
+            'reportedMediaBankingEnqueue',
             'IORedis',
             'IORedisEnqueueNoBuffer',
             // Storage abstractions
diff --git a/server/iocContainer/services/workersAndJobs.ts b/server/iocContainer/services/workersAndJobs.ts
index e5dc00523..e76d425d4 100644
--- a/server/iocContainer/services/workersAndJobs.ts
+++ b/server/iocContainer/services/workersAndJobs.ts
@@ -5,6 +5,7 @@ import { makeRefreshUserScoresCacheJob } from '../../services/userStatisticsServ
 import { type Job, type Worker } from '../../workers_jobs/index.js';
 import makeItemProcessingWorker from '../../workers_jobs/ItemProcessingWorker.js';
 import makeRefreshMRTDecisionsMaterializedViewJob from '../../workers_jobs/RefreshMRTDecisionsMaterializedViewJob.js';
+import makeReportedMediaBankingWorker from '../../workers_jobs/ReportedMediaBankingWorker.js';
 import makeRetryFailedNcmecDecisionsJob from '../../workers_jobs/RetryFailedNcmecDecisionsJob.js';
 import makeRunUserRulesJob from '../../workers_jobs/RunUserRulesJob.js';
 import { type Dependencies } from '../index.js';
@@ -15,6 +16,7 @@ declare module '../index.js' {
     // NB: worker deps cannot be renamed
     // w/o breaking the kubernetes logic that starts them!
     ItemProcessingWorker: Worker;
+    ReportedMediaBankingWorker: Worker;
 
     // Jobs. Like workers, can't be renamed w/o breaking stuff.
     // The distinction between jobs and workers is that workers run continuously,
@@ -30,6 +32,11 @@ declare module '../index.js' {
 
 export function registerWorkersAndJobs(bottle: Bottle<Dependencies>) {
   register(bottle, 'ItemProcessingWorker', makeItemProcessingWorker);
+  register(
+    bottle,
+    'ReportedMediaBankingWorker',
+    makeReportedMediaBankingWorker,
+  );
   register(bottle, 'RunUserRulesJob', makeRunUserRulesJob);
   register(
     bottle,
diff --git a/server/queues/reportedMediaBankingQueue.ts b/server/queues/reportedMediaBankingQueue.ts
new file mode 100644
index 000000000..86da4bed1
--- /dev/null
+++ b/server/queues/reportedMediaBankingQueue.ts
@@ -0,0 +1,87 @@
+import { Queue } from 'bullmq';
+import type IORedis from 'ioredis';
+import { type Cluster } from 'ioredis';
+
+import { jsonStringify } from '../utils/encoding.js';
+import { logErrorJson } from '../utils/logging.js';
+
+export const REPORTED_MEDIA_BANKING_QUEUE_NAME = 'reported-media-banking';
+
+/** One media item of an accepted NCMEC report, to be added to the org's hash
+ * bank. One job per item, so a failure retries only that item. */
+export type ReportedMediaBankingJobData = {
+  orgId: string;
+  hashBankId: number;
+  ncmecReportId: string;
+  itemId: string;
+  itemTypeId: string;
+  url: string;
+};
+
+/** The enqueue call, without the queue lifecycle the container owns. */
+export type ReportedMediaBankingEnqueueFn = (
+  jobs: readonly ReportedMediaBankingJobData[],
+) => Promise<void>;
+
+type RedisConnection = IORedis.Redis | Cluster;
+
+/** Factory for the function that enqueues reported media for banking. */
+function makeReportedMediaBankingEnqueue(redis: RedisConnection) {
+  let queue: Queue<ReportedMediaBankingJobData> | undefined;
+
+  // Built on first use: creating it opens a Redis connection, and most
+  // processes that depend on this service never enqueue anything.
+  function getQueue() {
+    if (queue === undefined) {
+      queue = new Queue<ReportedMediaBankingJobData>(
+        REPORTED_MEDIA_BANKING_QUEUE_NAME,
+        { connection: redis },
+      );
+      // BullMQ re-emits Redis connection errors, and an 'error' event with no
+      // listener takes the process down. Enqueue failures still reject below.
+      queue.on('error', (error) => {
+        // eslint-disable-next-line no-restricted-syntax
+        logErrorJson({
+          error,
+          message: jsonStringify({
+            event: 'reportedMediaBankingQueueError',
+            queue: REPORTED_MEDIA_BANKING_QUEUE_NAME,
+          }),
+        });
+      });
+    }
+    return queue;
+  }
+
+  async function reportedMediaBankingEnqueue(
+    jobs: readonly ReportedMediaBankingJobData[],
+  ) {
+    if (jobs.length === 0) {
+      return;
+    }
+    await getQueue().addBulk(
+      jobs.map((data) => ({
+        name: REPORTED_MEDIA_BANKING_QUEUE_NAME,
+        data,
+        opts: {
+          attempts: 5,
+          backoff: { type: 'exponential', delay: 1000 },
+          removeOnComplete: { count: 0 },
+          removeOnFail: { count: 1000 },
+        },
+      })),
+    );
+  }
+
+  reportedMediaBankingEnqueue.close = async () => {
+    await queue?.close();
+  };
+
+  return reportedMediaBankingEnqueue;
+}
+
+export type ReportedMediaBankingEnqueue = ReturnType<
+  typeof makeReportedMediaBankingEnqueue
+>;
+
+export { makeReportedMediaBankingEnqueue };
diff --git a/server/services/ncmecService/ncmecReporting.ts b/server/services/ncmecService/ncmecReporting.ts
index 85aa2e93c..5981e281f 100644
--- a/server/services/ncmecService/ncmecReporting.ts
+++ b/server/services/ncmecService/ncmecReporting.ts
@@ -8,6 +8,7 @@ import { FormData } from 'undici';
 import { js2xml } from 'xml-js';
 
 import { type Dependencies } from '../../iocContainer/index.js';
+import { type ReportedMediaBankingEnqueueFn } from '../../queues/reportedMediaBankingQueue.js';
 import { jsonStringify } from '../../utils/encoding.js';
 import { type JSONSchemaV4 } from '../../utils/json-schema-types.js';
 import { type FixKyselyRowCorrelation } from '../../utils/kysely.js';
@@ -1391,7 +1392,7 @@ export default class NcmecReporting {
     private moderationConfigService: Dependencies['ModerationConfigService'],
     private getItemTypeEventuallyConsistent: Dependencies['getItemTypeEventuallyConsistent'],
     private readonly tracer: Dependencies['Tracer'],
-    private readonly hmaService: Dependencies['HMAHashBankService'],
+    private readonly reportedMediaBankingEnqueue: ReportedMediaBankingEnqueueFn,
   ) {}
   async hasNCMECReportingEnabled(orgId: string) {
     const ncmecOrgSettings = await this.pgQuery
@@ -1723,65 +1724,6 @@ export default class NcmecReporting {
     await fetchWithRetries();
   }
 
-  async #addReportedMediaToHashBank(input: {
-    orgId: string;
-    reportedMedia: ReadonlyArray<Pick<Media, 'id' | 'typeId' | 'url'>>;
-    reportId: string;
-    reportedMediaHashBankId: number;
-  }) {
-    const { orgId, reportedMedia, reportId, reportedMediaHashBankId } = input;
-
-    const bank = await this.hmaService.getBankById(
-      orgId,
-      reportedMediaHashBankId,
-    );
-
-    if (bank == null) {
-      throw new Error('Reported media hash bank was not found');
-    }
-
-    const results = await Promise.allSettled(
-      reportedMedia.map(async (media) => {
-        const addWithRetries = withRetries(
-          {
-            maxRetries: 5,
-            initialTimeMsBetweenRetries: 5,
-            maxTimeMsBetweenRetries: 500,
-            jitter: true,
-          },
-          async () =>
-            this.hmaService.addContentToBank(bank.hma_name, {
-              url: media.url,
-              metadata: {
-                content_id: `${media.typeId}:${media.id}`,
-                json: {
-                  source: 'ncmec_report',
-                  orgId,
-                  ncmecReportId: reportId,
-                  itemId: media.id,
-                  itemTypeId: media.typeId,
-                },
-              },
-            }),
-        );
-
-        await addWithRetries();
-      }),
-    );
-
-    const failure = results.find(
-      (result): result is PromiseRejectedResult => result.status === 'rejected',
-    );
-
-    if (failure) {
-      const reason =
-        failure.reason instanceof Error
-          ? failure.reason.message
-          : String(failure.reason);
-      throw new Error(`Failed to add reported media to hash bank: ${reason}`);
-    }
-  }
-
   async ncmecPreservationEndpoint(orgId: string): Promise<string | undefined> {
     const rows = await this.pgQuery
       .selectFrom('ncmec_reporting.ncmec_org_settings')
@@ -2027,7 +1969,6 @@ export default class NcmecReporting {
           // 3. #uploadAdditionalFile
           // 4. #finish
           // 5. #sendUserPreservationRequest
-          // 6. #addReportedMediaToHashBank
           // we should error and mark the span as failed if any single
           // call fails.
           // These 3 functions utilize #sendCyberTipRequest, which retries
@@ -2142,12 +2083,31 @@ export default class NcmecReporting {
             reportParams.media.length > 0 &&
             isTest === false
           ) {
-            await this.#addReportedMediaToHashBank({
-              orgId: reportParams.orgId,
-              reportedMedia: reportParams.media,
-              reportId,
-              reportedMediaHashBankId,
-            });
+            // Banking runs in its own worker. Enqueueing must never fail an
+            // accepted report, so a Redis outage is logged and dropped here.
+            try {
+              await this.reportedMediaBankingEnqueue(
+                reportParams.media.map((media) => ({
+                  orgId: reportParams.orgId,
+                  hashBankId: reportedMediaHashBankId,
+                  ncmecReportId: reportId,
+                  itemId: media.id,
+                  itemTypeId: media.typeId,
+                  url: media.url,
+                })),
+              );
+            } catch (e) {
+              // eslint-disable-next-line no-restricted-syntax
+              logErrorJson({
+                error: e,
+                message: jsonStringify({
+                  event: 'ncmecReportedMediaBankingEnqueueFailed',
+                  orgId: reportParams.orgId,
+                  ncmecReportId: reportId,
+                  hashBankId: reportedMediaHashBankId,
+                }),
+              });
+            }
           }
           return 'SUCCESS';
         } catch (e) {
diff --git a/server/services/ncmecService/ncmecReviewerErrors.test.ts b/server/services/ncmecService/ncmecReviewerErrors.test.ts
index a2a8aa1e8..6fda1b4e0 100644
--- a/server/services/ncmecService/ncmecReviewerErrors.test.ts
+++ b/server/services/ncmecService/ncmecReviewerErrors.test.ts
@@ -49,17 +49,6 @@ describe('summarizeNcmecErrorForReviewer', () => {
     ).toMatch(/failed validation/);
   });
 
-  it('classifies reported media hash bank failures separately from NCMEC errors', () => {
-    for (const message of [
-      'Failed to add reported media to hash bank: Failed to add content to bank: 500',
-      'Reported media hash bank was not found',
-    ]) {
-      expect(summarizeNcmecErrorForReviewer(new Error(message))).toBe(
-        'NCMEC accepted the report, but adding its media to the hash bank failed. Check the bank in Settings → NCMEC.',
-      );
-    }
-  });
-
   it('classifies missing-config throws to a config category', () => {
     expect(
       summarizeNcmecErrorForReviewer(
diff --git a/server/services/ncmecService/ncmecReviewerErrors.ts b/server/services/ncmecService/ncmecReviewerErrors.ts
index 956f45ed1..299f5a111 100644
--- a/server/services/ncmecService/ncmecReviewerErrors.ts
+++ b/server/services/ncmecService/ncmecReviewerErrors.ts
@@ -11,8 +11,6 @@ const REVIEWER_ERROR_MESSAGES = {
   VALIDATION: 'Report failed validation before submission.',
   CONFIG: 'NCMEC configuration is incomplete. Check Settings → NCMEC.',
   MEDIA: 'Could not assemble the reported media for submission.',
-  HASH_BANK:
-    'NCMEC accepted the report, but adding its media to the hash bank failed. Check the bank in Settings → NCMEC.',
   UNKNOWN: 'Unexpected error submitting to NCMEC. See server logs.',
 } as const;
 
@@ -50,11 +48,6 @@ const REVIEWER_PREFIX_RULES: readonly {
     category: 'REJECTED',
   },
   { prefix: 'NCMEC report finish failed', category: 'SERVER' },
-  {
-    prefix: 'Failed to add reported media to hash bank',
-    category: 'HASH_BANK',
-  },
-  { prefix: 'Reported media hash bank was not found', category: 'HASH_BANK' },
 ];
 
 function classifyByHttpStatus(status: number | undefined): string {
diff --git a/server/services/ncmecService/ncmecService.ts b/server/services/ncmecService/ncmecService.ts
index a6cb444cc..52a7be91c 100644
--- a/server/services/ncmecService/ncmecService.ts
+++ b/server/services/ncmecService/ncmecService.ts
@@ -3,6 +3,7 @@ import _Ajv from 'ajv-draft-04';
 import { sql, type Kysely } from 'kysely';
 
 import { inject, type Dependencies } from '../../iocContainer/index.js';
+import { type ReportedMediaBankingEnqueueFn } from '../../queues/reportedMediaBankingQueue.js';
 import { type ActionExecutionCorrelationId } from '../analyticsLoggers/ActionExecutionLogger.js';
 import { type RuleExecutionCorrelationId } from '../analyticsLoggers/ruleExecutionLoggingUtils.js';
 import { type ItemSubmissionWithTypeIdentifier } from '../itemProcessingService/makeItemSubmissionWithTypeIdentifier.js';
@@ -38,7 +39,7 @@ export class NcmecService {
     readonly tracer: Dependencies['Tracer'],
     readonly itemInvestigationService: Dependencies['ItemInvestigationService'],
     readonly getItemTypeEventuallyConsistent: Dependencies['getItemTypeEventuallyConsistent'],
-    readonly hmaService: Dependencies['HMAHashBankService'],
+    readonly reportedMediaBankingEnqueue: ReportedMediaBankingEnqueueFn,
   ) {
     this.ncmecReporting = new NcmecReporting(
       pgQuery,
@@ -48,7 +49,7 @@ export class NcmecService {
       moderationConfigService,
       getItemTypeEventuallyConsistent,
       tracer,
-      hmaService,
+      reportedMediaBankingEnqueue,
     );
     this.ncmecEnqueueToMrt = new NcmecEnqueueToMrt(
       partialItemsService,
@@ -337,7 +338,7 @@ export default inject(
     'Tracer',
     'ItemInvestigationService',
     'getItemTypeEventuallyConsistent',
-    'HMAHashBankService',
+    'reportedMediaBankingEnqueue',
   ],
   NcmecService,
 );
diff --git a/server/test/fixtureHelpers/makeStubFetchHTTP.ts b/server/test/fixtureHelpers/makeStubFetchHTTP.ts
index 008853e02..96ac27763 100644
--- a/server/test/fixtureHelpers/makeStubFetchHTTP.ts
+++ b/server/test/fixtureHelpers/makeStubFetchHTTP.ts
@@ -20,21 +20,18 @@ export type RecordedFetchHTTPCall = {
 export function makeStubFetchHTTP(
   reportId: string,
   fileId: string,
-  opts: { preservationUrl?: string; hmaAddContentStatus?: number } = {},
+  opts: { preservationUrl?: string } = {},
 ): {
   fetchHTTP: FetchHTTP;
   calls: RecordedFetchHTTPCall[];
 } {
   const calls: RecordedFetchHTTPCall[] = [];
   const preservationUrl = opts.preservationUrl;
-  const ok = <T extends HandleResponseBody>(
-    body: unknown,
-    status = 200,
-  ): CoopResponse<T> =>
+  const ok = <T extends HandleResponseBody>(body: unknown): CoopResponse<T> =>
     // eslint-disable-next-line @typescript-eslint/consistent-type-assertions -- the stub returns a canned body through a slot typed by the caller's T.
     ({
-      status,
-      ok: status >= 200 && status < 300,
+      status: 200,
+      ok: true,
       headers: new Headers(),
       body,
     }) as CoopResponse<T>;
@@ -85,13 +82,6 @@ export function makeStubFetchHTTP(
     if (preservationUrl != null && url === preservationUrl) {
       return ok<T>(undefined);
     }
-    // HMA add-content; GET /c/bank/<name> is covered by the media download branch.
-    if (method === 'post' && /\/c\/bank\/[^/]+\/content\?/.test(url)) {
-      return ok<T>(
-        { id: 1, signals: { pdq: 'stub-pdq' } },
-        opts.hmaAddContentStatus ?? 200,
-      );
-    }
     throw new Error(`stub fetchHTTP: unexpected request ${method} ${url}`);
   };
   return { fetchHTTP, calls };
diff --git a/server/test/integ/ncmec-submission.integ.test.ts b/server/test/integ/ncmec-submission.integ.test.ts
index 3f92d5166..55db0895a 100644
--- a/server/test/integ/ncmec-submission.integ.test.ts
+++ b/server/test/integ/ncmec-submission.integ.test.ts
@@ -1,9 +1,7 @@
 import { uid } from 'uid';
 
-import {
-  HashBankService,
-  HmaService,
-} from '../../services/hmaService/index.js';
+import { type ReportedMediaBankingEnqueueFn } from '../../queues/reportedMediaBankingQueue.js';
+import { HashBankService } from '../../services/hmaService/index.js';
 import {
   NCMECFileAnnotation,
   NCMECIncidentType,
@@ -16,12 +14,8 @@ import {
   type FetchHTTP,
   type HandleResponseBody,
 } from '../../services/networkingService/index.js';
-import { jsonParse, type JsonOf } from '../../utils/encoding.js';
 import createOrg from '../fixtureHelpers/createOrg.js';
-import {
-  makeStubFetchHTTP,
-  type RecordedFetchHTTPCall,
-} from '../fixtureHelpers/makeStubFetchHTTP.js';
+import { makeStubFetchHTTP } from '../fixtureHelpers/makeStubFetchHTTP.js';
 import { makeTransactionalTestWithFixture } from '../harness/transactionalTest.js';
 import { type MockedServer } from '../setupMockedServer.js';
 
@@ -34,12 +28,11 @@ type Deps = MockedServer['deps'];
 function makeReporting(
   deps: Deps,
   reportId: string,
-  stubOpts: { hmaAddContentStatus?: number } = {},
   onRequest?: (url: string) => Promise<void>,
+  reportedMediaBankingEnqueue: ReportedMediaBankingEnqueueFn = jest.fn(),
 ) {
   const stub = makeStubFetchHTTP(reportId, 'f1', {
     preservationUrl: PRESERVATION_URL,
-    ...stubOpts,
   });
   const fetchHTTP: FetchHTTP = async <T extends HandleResponseBody>(
     query: CoopRequestQuery<T>,
@@ -55,9 +48,9 @@ function makeReporting(
     deps.ModerationConfigService,
     deps.getItemTypeEventuallyConsistent,
     deps.Tracer,
-    new HmaService(fetchHTTP, deps.KyselyPg),
+    reportedMediaBankingEnqueue,
   );
-  return { stub, ncmecReporting };
+  return { stub, ncmecReporting, reportedMediaBankingEnqueue };
 }
 
 function reportWithTwoMedia(
@@ -85,12 +78,6 @@ function reportWithTwoMedia(
   };
 }
 
-function hmaAddContentCalls(calls: readonly RecordedFetchHTTPCall[]) {
-  return calls.filter(
-    (c) => c.method === 'post' && /\/c\/bank\/[^/]+\/content\?/.test(c.url),
-  );
-}
-
 describe('NCMEC submitReport (integration)', () => {
   const testWithFixture = makeTransactionalTestWithFixture(async ({ deps }) => {
     const orgId = uid();
@@ -134,13 +121,17 @@ describe('NCMEC submitReport (integration)', () => {
       reportedMediaHashBankId: hashBank.id,
     });
 
-    const { stub, ncmecReporting } = makeReporting(deps, reportId);
+    const { stub, ncmecReporting, reportedMediaBankingEnqueue } = makeReporting(
+      deps,
+      reportId,
+    );
 
     return {
       orgId,
       reportId,
       stub,
       ncmecReporting,
+      reportedMediaBankingEnqueue,
       hashBank,
       userItemTypeId: orgFixture.defaultUserItemType.id,
     };
@@ -227,51 +218,34 @@ describe('NCMEC submitReport (integration)', () => {
     60_000,
   );
   testWithFixture(
-    'adds every reported media item to the selected hash bank once a production report is accepted',
+    'enqueues one banking job per reported media item once a production report is accepted',
     async ({
       ncmecReporting,
+      reportedMediaBankingEnqueue,
       orgId,
       reportId,
-      stub,
       hashBank,
       userItemTypeId,
     }) => {
-      const params = reportWithTwoMedia(orgId, userItemTypeId);
-
-      const result = await ncmecReporting.submitReport(params, false);
+      const result = await ncmecReporting.submitReport(
+        reportWithTwoMedia(orgId, userItemTypeId),
+        false,
+      );
 
       expect(result).toBe('SUCCESS');
-      const addCalls = hmaAddContentCalls(stub.calls);
-      expect(addCalls).toHaveLength(2);
-      for (const call of addCalls) {
-        expect(
-          new URL(call.url).pathname.endsWith(
-            `/c/bank/${hashBank.hma_name}/content`,
-          ),
-        ).toBe(true);
-      }
-      const bodyByMediaUrl = Object.fromEntries(
-        addCalls.map((c) => [
-          new URL(c.url).searchParams.get('url'),
-          jsonParse(c.body as JsonOf<unknown>),
-        ]),
-      );
-      const expectedBody = (itemId: string) => ({
-        metadata: {
-          content_id: `${userItemTypeId}:${itemId}`,
-          json: {
-            source: 'ncmec_report',
-            orgId,
-            ncmecReportId: reportId,
-            itemId,
-            itemTypeId: userItemTypeId,
-          },
-        },
-      });
-      expect(bodyByMediaUrl).toEqual({
-        [MEDIA_URL]: expectedBody('media-1'),
-        [SECOND_MEDIA_URL]: expectedBody('media-2'),
+      const job = (itemId: string, url: string) => ({
+        orgId,
+        hashBankId: hashBank.id,
+        ncmecReportId: reportId,
+        itemId,
+        itemTypeId: userItemTypeId,
+        url,
       });
+      expect(reportedMediaBankingEnqueue).toHaveBeenCalledTimes(1);
+      expect(reportedMediaBankingEnqueue).toHaveBeenCalledWith([
+        job('media-1', MEDIA_URL),
+        job('media-2', SECOND_MEDIA_URL),
+      ]);
     },
     60_000,
   );
@@ -279,10 +253,9 @@ describe('NCMEC submitReport (integration)', () => {
   testWithFixture(
     'uses the bank read before submitting, even if the setting is cleared during submission',
     async ({ deps, orgId, reportId, hashBank, userItemTypeId }) => {
-      const { stub, ncmecReporting } = makeReporting(
+      const { ncmecReporting, reportedMediaBankingEnqueue } = makeReporting(
         deps,
         reportId,
-        {},
         async (url) => {
           if (url.endsWith('/ispws/submit')) {
             await deps.KyselyPg.updateTable(
@@ -301,22 +274,24 @@ describe('NCMEC submitReport (integration)', () => {
       );
 
       expect(result).toBe('SUCCESS');
-      const addCalls = hmaAddContentCalls(stub.calls);
-      expect(addCalls).toHaveLength(2);
-      for (const call of addCalls) {
-        expect(
-          new URL(call.url).pathname.endsWith(
-            `/c/bank/${hashBank.hma_name}/content`,
-          ),
-        ).toBe(true);
-      }
+      expect(reportedMediaBankingEnqueue).toHaveBeenCalledWith(
+        expect.arrayContaining([
+          expect.objectContaining({ hashBankId: hashBank.id }),
+        ]),
+      );
     },
     60_000,
   );
 
   testWithFixture(
-    'does not add anything to a hash bank when the org has no bank selected',
-    async ({ deps, ncmecReporting, orgId, stub, userItemTypeId }) => {
+    'enqueues nothing when the org has no bank selected',
+    async ({
+      deps,
+      ncmecReporting,
+      reportedMediaBankingEnqueue,
+      orgId,
+      userItemTypeId,
+    }) => {
       await deps.KyselyPg.updateTable('ncmec_reporting.ncmec_org_settings')
         .set({ reported_media_hash_bank_id: null })
         .where('org_id', '=', orgId)
@@ -328,38 +303,44 @@ describe('NCMEC submitReport (integration)', () => {
       );
 
       expect(result).toBe('SUCCESS');
-      expect(stub.calls.some((c) => c.url.includes('/c/bank/'))).toBe(false);
+      expect(reportedMediaBankingEnqueue).not.toHaveBeenCalled();
     },
     60_000,
   );
 
   testWithFixture(
-    'does not add anything to the hash bank for a test submission',
-    async ({ ncmecReporting, orgId, stub, userItemTypeId }) => {
+    'enqueues nothing for a test submission',
+    async ({
+      ncmecReporting,
+      reportedMediaBankingEnqueue,
+      orgId,
+      userItemTypeId,
+    }) => {
       const result = await ncmecReporting.submitReport(
         reportWithTwoMedia(orgId, userItemTypeId),
         true,
       );
 
       expect(result).toBe('SUCCESS');
-      expect(hmaAddContentCalls(stub.calls)).toHaveLength(0);
+      expect(reportedMediaBankingEnqueue).not.toHaveBeenCalled();
     },
     60_000,
   );
 
   testWithFixture(
-    'fails the report after retrying when HMA keeps rejecting the content',
+    'keeps the report successful when the banking jobs cannot be enqueued',
     async ({ deps, orgId, reportId, userItemTypeId }) => {
-      const { stub, ncmecReporting } = makeReporting(deps, reportId, {
-        hmaAddContentStatus: 500,
-      });
+      const { stub, ncmecReporting } = makeReporting(
+        deps,
+        reportId,
+        undefined,
+        jest.fn().mockRejectedValue(new Error('Redis is down')),
+      );
       const params = reportWithTwoMedia(orgId, userItemTypeId);
 
       const result = await ncmecReporting.submitReport(params, false);
 
-      expect(result).toBe('FAILURE');
-      // 2 media x (1 attempt + 5 retries)
-      expect(hmaAddContentCalls(stub.calls)).toHaveLength(12);
+      expect(result).toBe('SUCCESS');
       expect(stub.calls.some((c) => c.url === PRESERVATION_URL)).toBe(true);
       const errorRow = await deps.KyselyPg.selectFrom(
         'ncmec_reporting.ncmec_reports_errors',
@@ -367,11 +348,7 @@ describe('NCMEC submitReport (integration)', () => {
         .selectAll()
         .where('job_id', '=', params.jobId)
         .executeTakeFirst();
-      expect(errorRow?.status).toBe('RETRYABLE_ERROR');
-      expect(errorRow?.last_error).toContain(
-        'adding its media to the hash bank failed',
-      );
-      expect(errorRow?.last_error).not.toContain('cdn.example');
+      expect(errorRow).toBeUndefined();
     },
     60_000,
   );
diff --git a/server/workers_jobs/ReportedMediaBankingWorker.test.ts b/server/workers_jobs/ReportedMediaBankingWorker.test.ts
new file mode 100644
index 000000000..e19fb1460
--- /dev/null
+++ b/server/workers_jobs/ReportedMediaBankingWorker.test.ts
@@ -0,0 +1,90 @@
+import { UnrecoverableError } from 'bullmq';
+
+import { type ReportedMediaBankingJobData } from '../queues/reportedMediaBankingQueue.js';
+import type { HashBank } from '../services/hmaService/index.js';
+import {
+  bankReportedMedia,
+  type ReportedMediaBankingDeps,
+} from './ReportedMediaBankingWorker.js';
+
+const BANK: HashBank = {
+  id: 42,
+  name: 'Reported CSAM',
+  hma_name: 'COOP_ORG1_REPORTED_CSAM',
+  description: null,
+  enabled_ratio: 1,
+  org_id: 'org1',
+  created_at: new Date(),
+  updated_at: new Date(),
+};
+
+const JOB: ReportedMediaBankingJobData = {
+  orgId: 'org1',
+  hashBankId: BANK.id,
+  ncmecReportId: '123',
+  itemId: 'img-1',
+  itemTypeId: 'type-a',
+  url: 'https://cdn.example.com/1.jpg',
+};
+
+function makeDeps(
+  overrides: Partial<ReportedMediaBankingDeps['hmaService']> = {},
+) {
+  const deps = {
+    hmaService: {
+      getBankById: jest.fn().mockResolvedValue(BANK),
+      addContentToBank: jest
+        .fn()
+        .mockResolvedValue({ id: 1, signals: { pdq: 'abc' } }),
+      ...overrides,
+    },
+  };
+  return deps as typeof deps & ReportedMediaBankingDeps;
+}
+
+describe('bankReportedMedia', () => {
+  it('adds the media to the org bank with metadata pointing back to the report', async () => {
+    const deps = makeDeps();
+
+    await bankReportedMedia(deps, JOB);
+
+    expect(deps.hmaService.getBankById).toHaveBeenCalledWith('org1', BANK.id);
+    expect(deps.hmaService.addContentToBank).toHaveBeenCalledWith(
+      BANK.hma_name,
+      {
+        url: JOB.url,
+        metadata: {
+          content_id: 'type-a:img-1',
+          json: {
+            source: 'ncmec_report',
+            orgId: 'org1',
+            ncmecReportId: '123',
+            itemId: 'img-1',
+            itemTypeId: 'type-a',
+          },
+        },
+      },
+    );
+  });
+
+  it('stops retrying when the bank is gone', async () => {
+    const deps = makeDeps({ getBankById: jest.fn().mockResolvedValue(null) });
+
+    await expect(bankReportedMedia(deps, JOB)).rejects.toBeInstanceOf(
+      UnrecoverableError,
+    );
+    expect(deps.hmaService.addContentToBank).not.toHaveBeenCalled();
+  });
+
+  it('lets a failed HMA call through, so the queue retries the job', async () => {
+    const deps = makeDeps({
+      addContentToBank: jest
+        .fn()
+        .mockRejectedValue(new Error('Failed to add content to bank: 500')),
+    });
+
+    await expect(bankReportedMedia(deps, JOB)).rejects.toThrow(
+      'Failed to add content to bank: 500',
+    );
+  });
+});
diff --git a/server/workers_jobs/ReportedMediaBankingWorker.ts b/server/workers_jobs/ReportedMediaBankingWorker.ts
new file mode 100644
index 000000000..bc878f592
--- /dev/null
+++ b/server/workers_jobs/ReportedMediaBankingWorker.ts
@@ -0,0 +1,92 @@
+import {
+  Worker as BullWorker,
+  UnrecoverableError,
+  type Job as BullJob,
+} from 'bullmq';
+import type IORedis from 'ioredis';
+import { type Cluster } from 'ioredis';
+
+import { inject } from '../iocContainer/utils.js';
+import {
+  REPORTED_MEDIA_BANKING_QUEUE_NAME,
+  type ReportedMediaBankingJobData,
+} from '../queues/reportedMediaBankingQueue.js';
+import { type HmaService } from '../services/hmaService/index.js';
+import { type Worker } from './index.js';
+
+export interface ReportedMediaBankingDeps {
+  hmaService: Pick<HmaService, 'getBankById' | 'addContentToBank'>;
+}
+
+/** Adds one media item of an accepted NCMEC report to the org's hash bank.
+ * Throwing hands the retry to BullMQ; `UnrecoverableError` stops retrying a
+ * job that cannot succeed, such as a bank that no longer exists. */
+export async function bankReportedMedia(
+  deps: ReportedMediaBankingDeps,
+  data: ReportedMediaBankingJobData,
+): Promise<void> {
+  const { orgId, hashBankId, ncmecReportId, itemId, itemTypeId, url } = data;
+  const bank = await deps.hmaService.getBankById(orgId, hashBankId);
+
+  if (bank == null) {
+    throw new UnrecoverableError(
+      `Hash bank ${hashBankId} no longer exists for org ${orgId}`,
+    );
+  }
+
+  await deps.hmaService.addContentToBank(bank.hma_name, {
+    url,
+    metadata: {
+      content_id: `${itemTypeId}:${itemId}`,
+      json: {
+        source: 'ncmec_report',
+        orgId,
+        ncmecReportId,
+        itemId,
+        itemTypeId,
+      },
+    },
+  });
+}
+
+export default inject(
+  ['IORedis', 'Tracer', 'HMAHashBankService'],
+  (redis: IORedis.Redis | Cluster, tracer, hmaService) => {
+    let worker: BullWorker<ReportedMediaBankingJobData> | undefined;
+
+    return {
+      type: 'Worker' as const,
+      async run(_signal) {
+        worker = new BullWorker<ReportedMediaBankingJobData>(
+          REPORTED_MEDIA_BANKING_QUEUE_NAME,
+          async (job: BullJob<ReportedMediaBankingJobData>) => {
+            const processJob = tracer.traced(
+              {
+                operation: 'processJob',
+                resource: 'reportedMediaBankingWorker',
+              },
+              async () => bankReportedMedia({ hmaService }, job.data),
+            );
+
+            await processJob();
+          },
+          {
+            connection: redis,
+            concurrency: 5,
+            removeOnComplete: { count: 0 },
+            removeOnFail: { count: 1000 },
+          },
+        );
+
+        await worker.waitUntilReady();
+
+        await new Promise<void>((resolve) => {
+          worker!.on('closed', () => resolve());
+        });
+      },
+      async shutdown() {
+        await worker?.close();
+      },
+    } satisfies Worker;
+  },
+);

From 3a241e715a42c6b08eae69e32dd5098358509815 Mon Sep 17 00:00:00 2001
From: Marco Filho <markimkr@gmail.com>
Date: Sat, 19 Sep 2026 10:40:25 -0300
Subject: [PATCH 13/17] [196] Log BullMQ worker errors and tighten the banking
 tests

An 'error' event with no listener takes the process down, so a Redis
blip would stop banking until the worker is restarted. The worker now
logs it and keeps running.

The tests also missed two regressions: the failure-path integration test
passed even with the enqueue call removed, and the unit test matched on
the error message, which an UnrecoverableError would also match while
silently disabling the retry it guards.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../test/integ/ncmec-submission.integ.test.ts | 14 +++++++-----
 .../ReportedMediaBankingWorker.test.ts        | 11 ++++++++--
 .../ReportedMediaBankingWorker.ts             | 22 ++++++++++++++++---
 3 files changed, 36 insertions(+), 11 deletions(-)

diff --git a/server/test/integ/ncmec-submission.integ.test.ts b/server/test/integ/ncmec-submission.integ.test.ts
index 55db0895a..a1089495b 100644
--- a/server/test/integ/ncmec-submission.integ.test.ts
+++ b/server/test/integ/ncmec-submission.integ.test.ts
@@ -330,17 +330,19 @@ describe('NCMEC submitReport (integration)', () => {
   testWithFixture(
     'keeps the report successful when the banking jobs cannot be enqueued',
     async ({ deps, orgId, reportId, userItemTypeId }) => {
-      const { stub, ncmecReporting } = makeReporting(
-        deps,
-        reportId,
-        undefined,
-        jest.fn().mockRejectedValue(new Error('Redis is down')),
-      );
+      const { stub, ncmecReporting, reportedMediaBankingEnqueue } =
+        makeReporting(
+          deps,
+          reportId,
+          undefined,
+          jest.fn().mockRejectedValue(new Error('Redis is down')),
+        );
       const params = reportWithTwoMedia(orgId, userItemTypeId);
 
       const result = await ncmecReporting.submitReport(params, false);
 
       expect(result).toBe('SUCCESS');
+      expect(reportedMediaBankingEnqueue).toHaveBeenCalledTimes(1);
       expect(stub.calls.some((c) => c.url === PRESERVATION_URL)).toBe(true);
       const errorRow = await deps.KyselyPg.selectFrom(
         'ncmec_reporting.ncmec_reports_errors',
diff --git a/server/workers_jobs/ReportedMediaBankingWorker.test.ts b/server/workers_jobs/ReportedMediaBankingWorker.test.ts
index e19fb1460..2debb0f04 100644
--- a/server/workers_jobs/ReportedMediaBankingWorker.test.ts
+++ b/server/workers_jobs/ReportedMediaBankingWorker.test.ts
@@ -83,8 +83,15 @@ describe('bankReportedMedia', () => {
         .mockRejectedValue(new Error('Failed to add content to bank: 500')),
     });
 
-    await expect(bankReportedMedia(deps, JOB)).rejects.toThrow(
-      'Failed to add content to bank: 500',
+    const error = await bankReportedMedia(deps, JOB).then(
+      () => null,
+      (e: unknown) => e,
     );
+
+    // An UnrecoverableError carries the same message but stops the retry, so
+    // the type is what this test is about.
+    expect(error).toBeInstanceOf(Error);
+    expect(error).not.toBeInstanceOf(UnrecoverableError);
+    expect((error as Error).message).toBe('Failed to add content to bank: 500');
   });
 });
diff --git a/server/workers_jobs/ReportedMediaBankingWorker.ts b/server/workers_jobs/ReportedMediaBankingWorker.ts
index bc878f592..ec003cfe2 100644
--- a/server/workers_jobs/ReportedMediaBankingWorker.ts
+++ b/server/workers_jobs/ReportedMediaBankingWorker.ts
@@ -12,6 +12,8 @@ import {
   type ReportedMediaBankingJobData,
 } from '../queues/reportedMediaBankingQueue.js';
 import { type HmaService } from '../services/hmaService/index.js';
+import { jsonStringify } from '../utils/encoding.js';
+import { logErrorJson } from '../utils/logging.js';
 import { type Worker } from './index.js';
 
 export interface ReportedMediaBankingDeps {
@@ -57,7 +59,7 @@ export default inject(
     return {
       type: 'Worker' as const,
       async run(_signal) {
-        worker = new BullWorker<ReportedMediaBankingJobData>(
+        const bankingWorker = new BullWorker<ReportedMediaBankingJobData>(
           REPORTED_MEDIA_BANKING_QUEUE_NAME,
           async (job: BullJob<ReportedMediaBankingJobData>) => {
             const processJob = tracer.traced(
@@ -77,11 +79,25 @@ export default inject(
             removeOnFail: { count: 1000 },
           },
         );
+        worker = bankingWorker;
 
-        await worker.waitUntilReady();
+        // An 'error' event with no listener takes the process down, which
+        // would stop banking until the worker is restarted.
+        bankingWorker.on('error', (error) => {
+          // eslint-disable-next-line no-restricted-syntax
+          logErrorJson({
+            error,
+            message: jsonStringify({
+              event: 'reportedMediaBankingWorkerError',
+              queue: REPORTED_MEDIA_BANKING_QUEUE_NAME,
+            }),
+          });
+        });
+
+        await bankingWorker.waitUntilReady();
 
         await new Promise<void>((resolve) => {
-          worker!.on('closed', () => resolve());
+          bankingWorker.on('closed', () => resolve());
         });
       },
       async shutdown() {

From f4edc7af4ddc2ace6707ad0aba2a83caee653360 Mon Sep 17 00:00:00 2001
From: Marco Filho <markimkr@gmail.com>
Date: Wed, 23 Sep 2026 01:22:00 -0300
Subject: [PATCH 14/17] [196] Remove implemementation details from NCMEC docs

---
 docs/integrations/ncmec.md | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/docs/integrations/ncmec.md b/docs/integrations/ncmec.md
index 8a00871b9..29e160fc7 100644
--- a/docs/integrations/ncmec.md
+++ b/docs/integrations/ncmec.md
@@ -34,21 +34,21 @@ Configure NCMEC reporting under **Settings** → **NCMEC Settings**.
 
 ![Setting up NCMEC reporting on Coop: add the required information for the reports submitted to NCMEC for content violating your company policies](../images/settings-ncmec.png)
 
-| Setting                                  | Description                                                                                                                                                                                                                                                                                            |
-| ---------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| **Username**                             | Your NCMEC CyberTipline API username.                                                                                                                                                                                                                                                                  |
-| **Password**                             | Your NCMEC CyberTipline API password.                                                                                                                                                                                                                                                                  |
-| **Company Report Name**                  | Your organization name as it appears in NCMEC reports. This value is also sent as the ESP service name for the reported user in each CyberTip.                                                                                                                                                         |
-| **Legal URL**                            | URL to your Terms of Service or legal policies (e.g. `https://yourcompany.com/terms`).                                                                                                                                                                                                                 |
-| **Contact Email**                        | Email for the reporting person on the CyberTip. The XML receipt from NCMEC can serve as the ESP notification.                                                                                                                                                                                          |
-| **Terms of Service**                     | TOS text or URL to an acceptable use policy relevant to the incident being reported. Maximum 3000 characters.                                                                                                                                                                                          |
-| **Contact Person (for law enforcement)** | A contact person law enforcement can reach (other than the reporting contact email): first name, last name, email, phone.                                                                                                                                                                              |
-| **More Info URL**                        | URL for additional information about your reporting process (e.g. `https://yourcompany.com/ncmec-info`). Used as the web page URL when "Default internet detail type" is set to "Web page."                                                                                                            |
-| **Default NCMEC Queue**                  | When reviewers click "Enqueue to NCMEC," jobs are sent to this queue. Leave as "Use org default queue" to fall back to the organization's default queue.                                                                                                                                               |
-| **Hash Bank for Reported Media**         | Media from each CyberTip accepted by NCMEC is added to this hash bank so it can be matched if it is uploaded again. Adding runs in the background (`ReportedMediaBankingWorker`), so it never blocks or fails the CyberTip. Only applies to [production submissions](#test-vs-production-submissions). |
-| **Default Internet Detail Type**         | The incident context (channel/medium) included in every CyberTip: Web page, Email, Newsgroup, Chat/IM, Online gaming, Cell phone, Non-internet, or Peer-to-peer.                                                                                                                                       |
-| **NCMEC Additional Info Endpoint**       | Webhook URL Coop calls before submitting a CyberTip to fetch enriched user and media metadata. See [Additional Info Endpoint](#additional-info-endpoint) below. Strongly recommended as without it, CyberTips are submitted with minimal user data.                                                    |
-| **NCMEC Preservation Endpoint**          | Webhook URL Coop calls after a successful CyberTip submission with the report ID. See [Preservation Endpoint](#preservation-endpoint) below.                                                                                                                                                           |
+| Setting                                  | Description                                                                                                                                                                                                                                         |
+| ---------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **Username**                             | Your NCMEC CyberTipline API username.                                                                                                                                                                                                               |
+| **Password**                             | Your NCMEC CyberTipline API password.                                                                                                                                                                                                               |
+| **Company Report Name**                  | Your organization name as it appears in NCMEC reports. This value is also sent as the ESP service name for the reported user in each CyberTip.                                                                                                      |
+| **Legal URL**                            | URL to your Terms of Service or legal policies (e.g. `https://yourcompany.com/terms`).                                                                                                                                                              |
+| **Contact Email**                        | Email for the reporting person on the CyberTip. The XML receipt from NCMEC can serve as the ESP notification.                                                                                                                                       |
+| **Terms of Service**                     | TOS text or URL to an acceptable use policy relevant to the incident being reported. Maximum 3000 characters.                                                                                                                                       |
+| **Contact Person (for law enforcement)** | A contact person law enforcement can reach (other than the reporting contact email): first name, last name, email, phone.                                                                                                                           |
+| **More Info URL**                        | URL for additional information about your reporting process (e.g. `https://yourcompany.com/ncmec-info`). Used as the web page URL when "Default internet detail type" is set to "Web page."                                                         |
+| **Default NCMEC Queue**                  | When reviewers click "Enqueue to NCMEC," jobs are sent to this queue. Leave as "Use org default queue" to fall back to the organization's default queue.                                                                                            |
+| **Hash Bank for Reported Media**         | Media from each CyberTip accepted by NCMEC is added to this hash bank so it can be matched if it is uploaded again. Only applies to [production submissions](#test-vs-production-submissions).                                                      |
+| **Default Internet Detail Type**         | The incident context (channel/medium) included in every CyberTip: Web page, Email, Newsgroup, Chat/IM, Online gaming, Cell phone, Non-internet, or Peer-to-peer.                                                                                    |
+| **NCMEC Additional Info Endpoint**       | Webhook URL Coop calls before submitting a CyberTip to fetch enriched user and media metadata. See [Additional Info Endpoint](#additional-info-endpoint) below. Strongly recommended as without it, CyberTips are submitted with minimal user data. |
+| **NCMEC Preservation Endpoint**          | Webhook URL Coop calls after a successful CyberTip submission with the report ID. See [Preservation Endpoint](#preservation-endpoint) below.                                                                                                        |
 
 Saving credentials, Company Report Name, and Legal URL enables NCMEC reporting for the organization. The remaining fields are not _required_ to submit a CyberTip, but **filling them out makes reports significantly more actionable** for NCMEC investigators.
 

From 1e49f86cf2982cfe3210ef433d4cdec647081f7c Mon Sep 17 00:00:00 2001
From: Marco Filho <markimkr@gmail.com>
Date: Wed, 23 Sep 2026 01:24:00 -0300
Subject: [PATCH 15/17] [196] Cut a long HMA note instead of failing the add

Getting the hash into the bank matters more than keeping the full note,
so a note over HMA's 255 code point limit is cut rather than rejected.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 server/services/hmaService/index.test.ts | 39 +++++++++++++-----------
 server/services/hmaService/index.ts      | 10 +++---
 2 files changed, 27 insertions(+), 22 deletions(-)

diff --git a/server/services/hmaService/index.test.ts b/server/services/hmaService/index.test.ts
index dee0f0521..d3a80b72a 100644
--- a/server/services/hmaService/index.test.ts
+++ b/server/services/hmaService/index.test.ts
@@ -527,34 +527,39 @@ describe('HmaService', () => {
         expect(jsonParse(fetchHTTP.mock.calls[0][0].body)).toEqual({ note });
       });
 
-      it('rejects a note longer than 255 characters before calling HMA', async () => {
+      it('cuts a note longer than 255 characters instead of failing the add', async () => {
         const { fetchHTTP, svc } = makeOkService();
 
-        await expect(
-          svc.addContentToBank('COOP_ORG1_BANK', {
-            ...URL_OPTIONS,
-            note: 'a'.repeat(256),
-          }),
-        ).rejects.toThrow('note must be 255 characters or less');
-        expect(fetchHTTP).not.toHaveBeenCalled();
+        await svc.addContentToBank('COOP_ORG1_BANK', {
+          ...URL_OPTIONS,
+          note: 'a'.repeat(256),
+        });
+
+        expect(jsonParse(fetchHTTP.mock.calls[0][0].body)).toEqual({
+          note: 'a'.repeat(255),
+        });
       });
 
-      it('counts characters like HMA does, so 255 emoji are accepted and 256 are not', async () => {
+      it('counts characters like HMA does, so 255 emoji go through whole', async () => {
         const { fetchHTTP, svc } = makeOkService();
 
         await svc.addContentToBank('COOP_ORG1_BANK', {
           ...URL_OPTIONS,
           note: '🚩'.repeat(255),
         });
-        expect(fetchHTTP).toHaveBeenCalledTimes(1);
+        expect(jsonParse(fetchHTTP.mock.calls[0][0].body)).toEqual({
+          note: '🚩'.repeat(255),
+        });
 
-        await expect(
-          svc.addContentToBank('COOP_ORG1_BANK', {
-            ...URL_OPTIONS,
-            note: '🚩'.repeat(256),
-          }),
-        ).rejects.toThrow('note must be 255 characters or less');
-        expect(fetchHTTP).toHaveBeenCalledTimes(1);
+        await svc.addContentToBank('COOP_ORG1_BANK', {
+          ...URL_OPTIONS,
+          note: '🚩'.repeat(256),
+        });
+        // Cut by code point, so the last emoji is dropped whole rather than
+        // leaving half a surrogate pair behind.
+        expect(jsonParse(fetchHTTP.mock.calls[1][0].body)).toEqual({
+          note: '🚩'.repeat(255),
+        });
       });
 
       it('appends the note to the form data on file uploads', async () => {
diff --git a/server/services/hmaService/index.ts b/server/services/hmaService/index.ts
index 31b7bdde6..262e6fd87 100644
--- a/server/services/hmaService/index.ts
+++ b/server/services/hmaService/index.ts
@@ -959,11 +959,11 @@ function toHmaNote(note: string | undefined): string | undefined {
   if (!note?.trim()) {
     return undefined;
   }
-  // HMA counts code points (Python len), not UTF-16 units.
-  if ([...note].length > 255) {
-    throw new Error('note must be 255 characters or less');
-  }
-  return note;
+  // HMA counts code points (Python len), not UTF-16 units, and rejects
+  // anything longer. Getting the hash in matters more than the full note, so
+  // cut it instead of failing the whole add.
+  const codePoints = [...note];
+  return codePoints.length > 255 ? codePoints.slice(0, 255).join('') : note;
 }
 
 export default inject(['fetchHTTP', 'KyselyPg'], HmaService);

From 31d310ada80dfd6305903baa135a01f9eefa6afb Mon Sep 17 00:00:00 2001
From: Marco Filho <markimkr@gmail.com>
Date: Wed, 23 Sep 2026 01:33:00 -0300
Subject: [PATCH 16/17] [196] Truncate HMA note to 255 to avoid errors

---
 server/services/hmaService/index.ts | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/server/services/hmaService/index.ts b/server/services/hmaService/index.ts
index 262e6fd87..deed57fb4 100644
--- a/server/services/hmaService/index.ts
+++ b/server/services/hmaService/index.ts
@@ -959,9 +959,7 @@ function toHmaNote(note: string | undefined): string | undefined {
   if (!note?.trim()) {
     return undefined;
   }
-  // HMA counts code points (Python len), not UTF-16 units, and rejects
-  // anything longer. Getting the hash in matters more than the full note, so
-  // cut it instead of failing the whole add.
+  // HMA counts code points (Python len), not UTF-16 units, truncate to 255 to avoid exceeding the limit.
   const codePoints = [...note];
   return codePoints.length > 255 ? codePoints.slice(0, 255).join('') : note;
 }

From a28f2405e05cee15aec0834becdb9cfd13e8ead5 Mon Sep 17 00:00:00 2001
From: Marco Filho <markimkr@gmail.com>
Date: Wed, 23 Sep 2026 04:27:12 -0300
Subject: [PATCH 17/17] [196] Take the reported media hash bank id as Int

GraphQL now rejects a non-integer bank id before the resolver runs, so
parseReportedMediaHashBankId and the resolver tests that covered its
format checks are gone, and the client sends a number instead of a
string.

The one case worth keeping, that a bank from another org is refused, is
now an integration test that goes through the real GraphQL API and
Postgres rather than a mocked HMAHashBankService.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 client/src/graphql/generated.ts               |   6 +-
 .../src/webpages/settings/NCMECSettings.tsx   |   6 +-
 server/graphql/generated.ts                   |   6 +-
 server/graphql/modules/ncmec.resolver.test.ts | 113 +--------------
 server/graphql/modules/ncmec.ts               |   7 +-
 .../modules/ncmecOrgSettingsValidation.ts     |  24 +---
 .../integ/ncmec-org-settings.integ.test.ts    | 130 ++++++++++++++++++
 7 files changed, 146 insertions(+), 146 deletions(-)
 create mode 100644 server/test/integ/ncmec-org-settings.integ.test.ts

diff --git a/client/src/graphql/generated.ts b/client/src/graphql/generated.ts
index d6c6b6bea..3d93045e8 100644
--- a/client/src/graphql/generated.ts
+++ b/client/src/graphql/generated.ts
@@ -3153,7 +3153,7 @@ export type GQLNcmecOrgSettings = {
   readonly ncmecAdditionalInfoEndpoint?: Maybe<Scalars['String']['output']>;
   readonly ncmecPreservationEndpoint?: Maybe<Scalars['String']['output']>;
   readonly password: Scalars['String']['output'];
-  readonly reportedMediaHashBankId?: Maybe<Scalars['ID']['output']>;
+  readonly reportedMediaHashBankId?: Maybe<Scalars['Int']['output']>;
   readonly termsOfService?: Maybe<Scalars['String']['output']>;
   readonly username: Scalars['String']['output'];
 };
@@ -3174,7 +3174,7 @@ export type GQLNcmecOrgSettingsInput = {
   readonly ncmecAdditionalInfoEndpoint?: InputMaybe<Scalars['String']['input']>;
   readonly ncmecPreservationEndpoint?: InputMaybe<Scalars['String']['input']>;
   readonly password: Scalars['String']['input'];
-  readonly reportedMediaHashBankId?: InputMaybe<Scalars['ID']['input']>;
+  readonly reportedMediaHashBankId?: InputMaybe<Scalars['Int']['input']>;
   readonly termsOfService?: InputMaybe<Scalars['String']['input']>;
   readonly username: Scalars['String']['input'];
 };
@@ -25067,7 +25067,7 @@ export type GQLNcmecOrgSettingsQuery = {
     readonly contactPersonPhone?: string | null;
     readonly mediaReviewRequirement?: GQLNcmecMediaReviewRequirement | null;
     readonly minMediaToReview?: number | null;
-    readonly reportedMediaHashBankId?: string | null;
+    readonly reportedMediaHashBankId?: number | null;
   } | null;
   readonly hashBanks: ReadonlyArray<{
     readonly __typename: 'HashBank';
diff --git a/client/src/webpages/settings/NCMECSettings.tsx b/client/src/webpages/settings/NCMECSettings.tsx
index 096e2d279..f4390e5de 100644
--- a/client/src/webpages/settings/NCMECSettings.tsx
+++ b/client/src/webpages/settings/NCMECSettings.tsx
@@ -157,7 +157,7 @@ export default function NCMECSettings() {
           GQLNcmecMediaReviewRequirement.All,
         minMediaToReview: String(data.ncmecOrgSettings.minMediaToReview ?? 1),
         reportedMediaHashBankId:
-          data.ncmecOrgSettings.reportedMediaHashBankId ?? '',
+          data.ncmecOrgSettings.reportedMediaHashBankId?.toString() ?? '',
       });
     }
   }, [data?.ncmecOrgSettings]);
@@ -246,7 +246,9 @@ export default function NCMECSettings() {
           contactPersonPhone: settings.contactPersonPhone || null,
           mediaReviewRequirement: settings.mediaReviewRequirement,
           minMediaToReview: isMinimumPolicy ? parsedMinMedia : null,
-          reportedMediaHashBankId: settings.reportedMediaHashBankId || null,
+          reportedMediaHashBankId: settings.reportedMediaHashBankId
+            ? Number(settings.reportedMediaHashBankId)
+            : null,
         },
       },
     });
diff --git a/server/graphql/generated.ts b/server/graphql/generated.ts
index 0b5efdf91..c90aba865 100644
--- a/server/graphql/generated.ts
+++ b/server/graphql/generated.ts
@@ -3221,7 +3221,7 @@ export type GQLNcmecOrgSettings = {
   readonly ncmecAdditionalInfoEndpoint?: Maybe<Scalars['String']['output']>;
   readonly ncmecPreservationEndpoint?: Maybe<Scalars['String']['output']>;
   readonly password: Scalars['String']['output'];
-  readonly reportedMediaHashBankId?: Maybe<Scalars['ID']['output']>;
+  readonly reportedMediaHashBankId?: Maybe<Scalars['Int']['output']>;
   readonly termsOfService?: Maybe<Scalars['String']['output']>;
   readonly username: Scalars['String']['output'];
 };
@@ -3242,7 +3242,7 @@ export type GQLNcmecOrgSettingsInput = {
   readonly ncmecAdditionalInfoEndpoint?: InputMaybe<Scalars['String']['input']>;
   readonly ncmecPreservationEndpoint?: InputMaybe<Scalars['String']['input']>;
   readonly password: Scalars['String']['input'];
-  readonly reportedMediaHashBankId?: InputMaybe<Scalars['ID']['input']>;
+  readonly reportedMediaHashBankId?: InputMaybe<Scalars['Int']['input']>;
   readonly termsOfService?: InputMaybe<Scalars['String']['input']>;
   readonly username: Scalars['String']['input'];
 };
@@ -11879,7 +11879,7 @@ export type GQLNcmecOrgSettingsResolvers<
   >;
   password?: Resolver<GQLResolversTypes['String'], ParentType, ContextType>;
   reportedMediaHashBankId?: Resolver<
-    Maybe<GQLResolversTypes['ID']>,
+    Maybe<GQLResolversTypes['Int']>,
     ParentType,
     ContextType
   >;
diff --git a/server/graphql/modules/ncmec.resolver.test.ts b/server/graphql/modules/ncmec.resolver.test.ts
index 181e08294..169cf9953 100644
--- a/server/graphql/modules/ncmec.resolver.test.ts
+++ b/server/graphql/modules/ncmec.resolver.test.ts
@@ -17,21 +17,15 @@ const VALID_INPUT = {
 
 function makeCtx(permissions: readonly UserPermission[]) {
   const updateNcmecOrgSettings = jest.fn(async () => undefined);
-  const getBankById = jest.fn(async (orgId: string, id: number) =>
-    orgId === 'org-1' && id === 42 ? { id: 42, org_id: 'org-1' } : null,
-  );
   const ctx = {
     getUser: () => ({
       id: 'user-1',
       orgId: 'org-1',
       getPermissions: () => permissions,
     }),
-    services: {
-      NcmecService: { updateNcmecOrgSettings },
-      HMAHashBankService: { getBankById },
-    },
+    services: { NcmecService: { updateNcmecOrgSettings } },
   };
-  return { ctx, updateNcmecOrgSettings, getBankById };
+  return { ctx, updateNcmecOrgSettings };
 }
 
 describe('updateNcmecOrgSettings media review policy', () => {
@@ -146,106 +140,3 @@ describe('updateNcmecOrgSettings media review policy', () => {
     expect(updateNcmecOrgSettings).not.toHaveBeenCalled();
   });
 });
-
-describe('updateNcmecOrgSettings reported media hash bank', () => {
-  it('persists a bank that belongs to the org', async () => {
-    const { ctx, updateNcmecOrgSettings, getBankById } = makeCtx([
-      UserPermission.MANAGE_ORG,
-    ]);
-    await Mutation.updateNcmecOrgSettings(
-      {},
-      { input: { ...VALID_INPUT, reportedMediaHashBankId: '42' } },
-      ctx,
-    );
-    expect(getBankById).toHaveBeenCalledWith('org-1', 42);
-    expect(updateNcmecOrgSettings).toHaveBeenCalledWith(
-      expect.objectContaining({ reportedMediaHashBankId: 42 }),
-    );
-  });
-
-  it('clears the bank when none is supplied', async () => {
-    const { ctx, updateNcmecOrgSettings, getBankById } = makeCtx([
-      UserPermission.MANAGE_ORG,
-    ]);
-    await Mutation.updateNcmecOrgSettings(
-      {},
-      { input: { ...VALID_INPUT, reportedMediaHashBankId: null } },
-      ctx,
-    );
-    expect(getBankById).not.toHaveBeenCalled();
-    expect(updateNcmecOrgSettings).toHaveBeenCalledWith(
-      expect.objectContaining({ reportedMediaHashBankId: null }),
-    );
-  });
-
-  it('looks the bank up only within the user org, so a bank from another org reads as missing', async () => {
-    const { ctx, updateNcmecOrgSettings, getBankById } = makeCtx([
-      UserPermission.MANAGE_ORG,
-    ]);
-    const errorFor = async (id: string) =>
-      Mutation.updateNcmecOrgSettings(
-        {},
-        { input: { ...VALID_INPUT, reportedMediaHashBankId: id } },
-        ctx,
-      ).then(
-        () => undefined,
-        (e: Error) => e.message,
-      );
-
-    const otherOrgBankMessage = await errorFor('7');
-    const missingBankMessage = await errorFor('999');
-
-    expect(getBankById.mock.calls).toEqual([
-      ['org-1', 7],
-      ['org-1', 999],
-    ]);
-    expect(otherOrgBankMessage).toBe('Selected hash bank was not found.');
-    expect(missingBankMessage).toBe(otherOrgBankMessage);
-    expect(updateNcmecOrgSettings).not.toHaveBeenCalled();
-  });
-
-  it('rejects bank id 0 as not found', async () => {
-    const { ctx, updateNcmecOrgSettings, getBankById } = makeCtx([
-      UserPermission.MANAGE_ORG,
-    ]);
-    await expect(
-      Mutation.updateNcmecOrgSettings(
-        {},
-        { input: { ...VALID_INPUT, reportedMediaHashBankId: '0' } },
-        ctx,
-      ),
-    ).rejects.toThrow('Selected hash bank was not found.');
-    expect(getBankById).toHaveBeenCalledWith('org-1', 0);
-    expect(updateNcmecOrgSettings).not.toHaveBeenCalled();
-  });
-
-  it('rejects a bank id above the Postgres integer range before looking it up', async () => {
-    const { ctx, updateNcmecOrgSettings, getBankById } = makeCtx([
-      UserPermission.MANAGE_ORG,
-    ]);
-    await expect(
-      Mutation.updateNcmecOrgSettings(
-        {},
-        { input: { ...VALID_INPUT, reportedMediaHashBankId: '2147483648' } },
-        ctx,
-      ),
-    ).rejects.toThrow('reportedMediaHashBankId must be a hash bank ID.');
-    expect(getBankById).not.toHaveBeenCalled();
-    expect(updateNcmecOrgSettings).not.toHaveBeenCalled();
-  });
-
-  it('rejects a non-numeric bank id', async () => {
-    const { ctx, updateNcmecOrgSettings, getBankById } = makeCtx([
-      UserPermission.MANAGE_ORG,
-    ]);
-    await expect(
-      Mutation.updateNcmecOrgSettings(
-        {},
-        { input: { ...VALID_INPUT, reportedMediaHashBankId: '4x2' } },
-        ctx,
-      ),
-    ).rejects.toThrow('reportedMediaHashBankId');
-    expect(getBankById).not.toHaveBeenCalled();
-    expect(updateNcmecOrgSettings).not.toHaveBeenCalled();
-  });
-});
diff --git a/server/graphql/modules/ncmec.ts b/server/graphql/modules/ncmec.ts
index 5818db63d..455ec7d7e 100644
--- a/server/graphql/modules/ncmec.ts
+++ b/server/graphql/modules/ncmec.ts
@@ -14,7 +14,6 @@ import {
   isValidContactEmail,
   parseInternetDetailType,
   parseMediaReviewPolicy,
-  parseReportedMediaHashBankId,
   type NcmecOrgSettingsInputShape,
 } from './ncmecOrgSettingsValidation.js';
 
@@ -80,7 +79,7 @@ const typeDefs = /* GraphQL */ `
     contactPersonPhone: String
     mediaReviewRequirement: NcmecMediaReviewRequirement
     minMediaToReview: Int
-    reportedMediaHashBankId: ID
+    reportedMediaHashBankId: Int
   }
 
   input NcmecOrgSettingsInput {
@@ -101,7 +100,7 @@ const typeDefs = /* GraphQL */ `
     contactPersonPhone: String
     mediaReviewRequirement: NcmecMediaReviewRequirement
     minMediaToReview: Int
-    reportedMediaHashBankId: ID
+    reportedMediaHashBankId: Int
   }
 
   type UpdateNcmecOrgSettingsResponse {
@@ -352,7 +351,7 @@ const Mutation: GQLMutationResolvers = {
     const { mediaReviewRequirement, minMediaToReview } =
       parseMediaReviewPolicy(input);
 
-    const reportedMediaHashBankId = parseReportedMediaHashBankId(input);
+    const reportedMediaHashBankId = input.reportedMediaHashBankId ?? null;
 
     if (reportedMediaHashBankId !== null) {
       const bank = await context.services.HMAHashBankService.getBankById(
diff --git a/server/graphql/modules/ncmecOrgSettingsValidation.ts b/server/graphql/modules/ncmecOrgSettingsValidation.ts
index e73426f6d..53ca21d12 100644
--- a/server/graphql/modules/ncmecOrgSettingsValidation.ts
+++ b/server/graphql/modules/ncmecOrgSettingsValidation.ts
@@ -20,7 +20,7 @@ export type NcmecOrgSettingsInputShape = {
   contactPersonPhone?: string | null;
   mediaReviewRequirement?: string | null;
   minMediaToReview?: number | null;
-  reportedMediaHashBankId?: string | null;
+  reportedMediaHashBankId?: number | null;
 };
 
 const VALID_NCMEC_MEDIA_REVIEW_REQUIREMENTS = ['ALL', 'MINIMUM'] as const;
@@ -100,25 +100,3 @@ export function parseMediaReviewPolicy(input: NcmecOrgSettingsInputShape): {
   }
   return { mediaReviewRequirement: requirement, minMediaToReview };
 }
-
-/** Returns the bank id to store, or null to clear it. Only checks the format;
- * the resolver checks that the bank belongs to the org. */
-export function parseReportedMediaHashBankId(
-  input: NcmecOrgSettingsInputShape,
-): number | null {
-  const raw = input.reportedMediaHashBankId?.trim() ?? '';
-  if (raw === '') {
-    return null;
-  }
-  if (!/^\d+$/.test(raw)) {
-    throw userInputError('reportedMediaHashBankId must be a hash bank ID.');
-  }
-
-  const bankId = Number(raw);
-
-  if (!Number.isSafeInteger(bankId) || bankId > 2_147_483_647) {
-    throw userInputError('reportedMediaHashBankId must be a hash bank ID.');
-  }
-
-  return bankId;
-}
diff --git a/server/test/integ/ncmec-org-settings.integ.test.ts b/server/test/integ/ncmec-org-settings.integ.test.ts
new file mode 100644
index 000000000..e42e7daf6
--- /dev/null
+++ b/server/test/integ/ncmec-org-settings.integ.test.ts
@@ -0,0 +1,130 @@
+/**
+ * Integration test: the reported-media hash bank setting is scoped to the
+ * caller's org.
+ *
+ * Goes through the real GraphQL API so the org check is exercised against
+ * Postgres instead of a mocked HMAHashBankService.
+ *
+ * Run with: docker compose run --rm test
+ * Requires: `npm run up && npm run db:update`
+ */
+import { uid } from 'uid';
+
+import { HashBankService } from '../../services/hmaService/index.js';
+import { jsonStringify } from '../../utils/encoding.js';
+import createOrg from '../fixtureHelpers/createOrg.js';
+import createUser from '../fixtureHelpers/createUser.js';
+import {
+  makeIntegrationServer,
+  type IntegrationServer,
+} from './setupIntegrationServer.js';
+
+const ADMIN_PASSWORD = 'integ-admin-password-1';
+
+describe('updateNcmecOrgSettings reported media hash bank (integration)', () => {
+  const orgId = uid();
+  const otherOrgId = uid();
+  let harness: IntegrationServer | undefined;
+  let ownBankId: number;
+  let otherOrgBankId: number;
+  let orgCleanup: (() => Promise<unknown>) | undefined;
+  let otherOrgCleanup: (() => Promise<unknown>) | undefined;
+  let adminCleanup: (() => Promise<unknown>) | undefined;
+
+  beforeAll(async () => {
+    harness = await makeIntegrationServer();
+
+    const orgDeps = {
+      KyselyPg: harness.deps.KyselyPg,
+      ModerationConfigService: harness.deps.ModerationConfigService,
+      ApiKeyService: harness.deps.ApiKeyService,
+    };
+    orgCleanup = (await createOrg(orgDeps, orgId)).cleanup;
+    otherOrgCleanup = (await createOrg(orgDeps, otherOrgId)).cleanup;
+
+    const adminFixture = await createUser(harness.deps.KyselyPg, orgId, {
+      password: ADMIN_PASSWORD,
+      loginMethods: ['password'],
+      approvedByAdmin: true,
+    });
+    adminCleanup = adminFixture.cleanup;
+
+    const hashBanks = new HashBankService(harness.deps.KyselyPg);
+    ownBankId = (
+      await hashBanks.create({
+        name: 'Reported CSAM',
+        hma_name: `COOP_TEST_${uid()}`,
+        enabled_ratio: 1,
+        org_id: orgId,
+      })
+    ).id;
+    otherOrgBankId = (
+      await hashBanks.create({
+        name: 'Someone else reported CSAM',
+        hma_name: `COOP_TEST_${uid()}`,
+        enabled_ratio: 1,
+        org_id: otherOrgId,
+      })
+    ).id;
+
+    const loginRes = await harness.request.post('/api/v1/graphql').send({
+      query: `mutation {
+        login(input: { email: ${jsonStringify(adminFixture.user.email)}, password: ${jsonStringify(ADMIN_PASSWORD)} }) {
+          __typename
+        }
+      }`,
+    });
+    expect(loginRes.body?.data?.login?.__typename).toBe('LoginSuccessResponse');
+  }, 60_000);
+
+  afterAll(async () => {
+    try {
+      await adminCleanup?.();
+      await orgCleanup?.();
+      await otherOrgCleanup?.();
+    } finally {
+      await harness?.shutdown();
+    }
+  }, 30_000);
+
+  const saveBank = async (bankId: number) => {
+    if (!harness) throw new Error('harness was not initialized');
+    return harness.request.post('/api/v1/graphql').send({
+      query: `mutation {
+        updateNcmecOrgSettings(input: {
+          username: "espuser"
+          password: "esppass"
+          contactEmail: "reporter@example.com"
+          reportedMediaHashBankId: ${bankId}
+        }) {
+          success
+        }
+      }`,
+    });
+  };
+
+  const readBankId = async () => {
+    if (!harness) throw new Error('harness was not initialized');
+    const res = await harness.request.post('/api/v1/graphql').send({
+      query: `query { ncmecOrgSettings { reportedMediaHashBankId } }`,
+    });
+    return res.body?.data?.ncmecOrgSettings?.reportedMediaHashBankId ?? null;
+  };
+
+  test('refuses a bank that belongs to another org and saves nothing', async () => {
+    const res = await saveBank(otherOrgBankId);
+
+    expect(res.body?.errors?.[0]?.message).toBe(
+      'Selected hash bank was not found.',
+    );
+    expect(await readBankId()).toBeNull();
+  });
+
+  test('saves a bank that belongs to the org', async () => {
+    const res = await saveBank(ownBankId);
+
+    expect(res.body?.errors).toBeUndefined();
+    expect(res.body?.data?.updateNcmecOrgSettings?.success).toBe(true);
+    expect(await readBankId()).toBe(ownBankId);
+  });
+});