@de-otio/trellis 0.4.0

package/dist/lib/routes/admin.js

@@ -0,0 +1,1450 @@
+"use strict";
+/**
+ * Admin Routes
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.adminRoutes = void 0;
+const zod_1 = require("zod");
+const db_1 = require("../../db");
+const worker_1 = require("../../worker");
+const data_router_1 = require("../data-router");
+const database_connection_manager_1 = require("../database-connection-manager");
+const db_query_helper_1 = require("../db-query-helper");
+const domain_reputation_service_1 = require("../domain-reputation-service");
+const feature_toggle_service_1 = require("../feature-toggle-service");
+const logger_1 = require("../logger");
+const middleware_1 = require("../middleware");
+const feature_toggle_rate_limit_1 = require("../middleware/feature-toggle-rate-limit");
+const region_detection_1 = require("../region-detection");
+const secret_resolver_1 = require("../secret-resolver");
+const security_headers_1 = require("../security-headers");
+const session_manager_1 = require("../session-manager");
+const feature_toggle_schemas_1 = require("../validation/feature-toggle-schemas");
+const validate_request_1 = require("../validation/validate-request");
+const version_1 = require("../version");
+exports.adminRoutes = [
+    // Test-only endpoints (must be before wildcard routes)
+    // Test-only endpoint: Create test user (dev environment only, no auth required for tests)
+    {
+        path: "/api/admin/test/users",
+        method: "POST",
+        handler: async (request, env) => {
+            const securityHeaders = new security_headers_1.SecurityHeaders(env);
+            const logger = logger_1.Logger.getInstance(env);
+            // SECURITY: Only allow in dev/test environments
+            // Note: env.ENVIRONMENT falls back to NODE_ENV (which is "production" in Docker),
+            // so prefer env.STAGE which is explicitly set by CDK to the deployment stage.
+            const environment = (env.STAGE ||
+                env.DEPLOY_ENV ||
+                "dev").toLowerCase();
+            if (environment === "prod" || environment === "production") {
+                const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({
+                    error: "Forbidden: Test endpoints not available in production",
+                }), { status: 403, headers: { "content-type": "application/json" } });
+                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+            }
+            try {
+                const body = (await request.json());
+                const userId = body.id || crypto.randomUUID();
+                const email = body.email ||
+                    `test-${Date.now()}-${Math.random().toString(36).substring(7)}@test.example.com`;
+                const role = (body.role || "END_USER");
+                // OPTIMIZATION: Detect test users and skip authentication check for speed
+                // Test users are identified by email pattern (@test.example.com or test- prefix)
+                const isTestUser = email.includes("@test.example.com") || email.includes("test-");
+                const isCI = env.CI === "true" || env.GITHUB_ACTIONS === "true";
+                // FAST PATH: For test users, use default region from env (skip region detection)
+                // This avoids any region detection overhead and uses the fastest default
+                const defaultRegion = (env.DEFAULT_REGION || "US");
+                const region = body.region || (isTestUser ? defaultRegion : "US");
+                const dataRegion = body.dataRegion || region;
+                // SECURITY: For non-test users or non-CI environments, check authentication
+                // This is safe because:
+                // 1. Only works in dev/test environments (checked above)
+                // 2. Test users are identified by email pattern
+                // 3. Tests need fast user creation without authentication overhead
+                if (!isTestUser && !isCI) {
+                    const sessionManager = new session_manager_1.SessionManager();
+                    const sessionSecret = secret_resolver_1.Secrets.getSessionSecret(env);
+                    const session = await sessionManager.getSession(request, sessionSecret, env);
+                    if (session) {
+                        // Use fast query with timeout for role check (non-blocking for test user creation)
+                        const detectedRegion = (0, region_detection_1.detectRegionSync)(request, env);
+                        const user = await (0, db_query_helper_1.withQueryTimeoutAndRetry)(database_connection_manager_1.sharedDatabaseConnectionManager, detectedRegion, env, async (db) => {
+                            return await db.user.findUnique({
+                                where: { id: session.userId },
+                                select: { role: true },
+                            });
+                        }, {
+                            ...db_query_helper_1.QueryTimeoutPresets.USER_FACING, // Fast timeout (1s + 1s retry)
+                            defaultValue: null, // Return null on timeout (allow test user creation)
+                            context: {
+                                operation: "checkUserRoleForTestEndpoint",
+                                userId: session.userId,
+                            },
+                        });
+                        if (!user || user.role !== "SUPER_ADMIN") {
+                            const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({
+                                error: "Forbidden: Super-admin access required",
+                            }), {
+                                status: 403,
+                                headers: { "content-type": "application/json" },
+                            });
+                            return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                        }
+                    }
+                }
+                // OPTIMIZATION: For test users, don't pass request object to avoid any overhead
+                // This ensures the fastest possible path for test user creation
+                const userCreationStartTime = Date.now();
+                // ✅ BEST PRACTICE: Defense-in-depth timeout wrapper
+                // The database query timeout (2-3s) should be sufficient, but we add a safety net
+                // to catch cases where the entire operation hangs (e.g., connection acquisition issues).
+                // Calculate based on actual database timeout configuration:
+                // - Local: 2s timeout, 0 retries = 2s max
+                // - CI: 3s timeout, 1 retry (1s) = 4s max
+                // Add 50% buffer for connection acquisition and overhead
+                const dbTimeoutMs = isCI ? 3000 : 2000;
+                const dbRetryTimeoutMs = isCI ? 1000 : 500;
+                const dbMaxRetries = isCI ? 1 : 0;
+                const maxExpectedDbTime = dbTimeoutMs + dbRetryTimeoutMs * dbMaxRetries;
+                const safetyBufferMs = Math.ceil(maxExpectedDbTime * 0.5); // 50% buffer
+                const TEST_USER_CREATION_TIMEOUT_MS = maxExpectedDbTime + safetyBufferMs;
+                const userCreationPromise = data_router_1.DataRouter.createUser({
+                    id: userId,
+                    email,
+                    role,
+                }, region, env, isTestUser ? undefined : request);
+                const timeoutPromise = new Promise((_, reject) => {
+                    setTimeout(() => {
+                        reject(new Error(`Test user creation timed out after ${TEST_USER_CREATION_TIMEOUT_MS}ms. ` +
+                            `Database query timeout (${dbTimeoutMs}ms) should have triggered first at <${maxExpectedDbTime}ms. ` +
+                            `This indicates the database timeout mechanism may not be working correctly, ` +
+                            `or there's a connection acquisition issue outside the query timeout scope.`));
+                    }, TEST_USER_CREATION_TIMEOUT_MS);
+                });
+                const createdUser = await Promise.race([
+                    userCreationPromise,
+                    timeoutPromise,
+                ]);
+                const userCreationDuration = Date.now() - userCreationStartTime;
+                logger.debug("[UserCreation] User creation completed", {
+                    duration: userCreationDuration,
+                    userId: createdUser.id,
+                    region,
+                    isTestUser,
+                });
+                // Create a session for the test user so tests don't need to know SESSION_SECRET
+                const sessionManager = new session_manager_1.SessionManager();
+                const sessionSecret = secret_resolver_1.Secrets.getSessionSecret(env);
+                const testSession = {
+                    userId: createdUser.id,
+                    email: createdUser.email,
+                    role: role,
+                    expiresAt: Date.now() + 3600000, // 1 hour
+                    dataRegion: createdUser.dataRegion || region,
+                    sessionType: "user",
+                    lastActivityAt: Date.now(),
+                    profileContext: "primary",
+                };
+                let response = securityHeaders.createSecureResponse(JSON.stringify({
+                    success: true,
+                    user: {
+                        id: createdUser.id,
+                        email: createdUser.email,
+                        role: role,
+                        region: createdUser.region,
+                        dataRegion: createdUser.dataRegion,
+                    },
+                }), { status: 201, headers: { "content-type": "application/json" } });
+                // Set session cookie on the response
+                response = await sessionManager.setSession(response, testSession, sessionSecret, undefined, env);
+                return (0, worker_1.addCorsHeaders)(response, request, env);
+            }
+            catch (error) {
+                logger.error("[Admin Test] Error creating test user:", error);
+                const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({
+                    error: error.message || "Failed to create test user",
+                }), { status: 500, headers: { "content-type": "application/json" } });
+                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+            }
+        },
+        middleware: [(0, middleware_1.corsMiddleware)()], // No CSRF for test endpoints (unauthenticated in CI)
+        description: "Create test user (dev environment only)",
+    },
+    // Test-only endpoint: Delete test user (dev environment only)
+    {
+        path: "/api/admin/test/users/:userId",
+        method: "DELETE",
+        handler: async (request, env, { pathname }) => {
+            const sessionManager = new session_manager_1.SessionManager();
+            const securityHeaders = new security_headers_1.SecurityHeaders(env);
+            const logger = logger_1.Logger.getInstance(env);
+            // SECURITY: Only allow in dev/test environments
+            // Note: env.ENVIRONMENT falls back to NODE_ENV (which is "production" in Docker),
+            // so prefer env.STAGE which is explicitly set by CDK to the deployment stage.
+            const environment = (env.STAGE ||
+                env.DEPLOY_ENV ||
+                "dev").toLowerCase();
+            if (environment === "prod" || environment === "production") {
+                const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({
+                    error: "Forbidden: Test endpoints not available in production",
+                }), { status: 403, headers: { "content-type": "application/json" } });
+                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+            }
+            // SECURITY: In test mode (CI), allow unauthenticated access for test user deletion
+            const isCI = env.CI === "true" || env.GITHUB_ACTIONS === "true";
+            // Optionally check for SUPER_ADMIN in local dev (but allow unauthenticated in CI)
+            if (!isCI) {
+                const sessionSecret = secret_resolver_1.Secrets.getSessionSecret(env);
+                const session = await sessionManager.getSession(request, sessionSecret, env);
+                if (session) {
+                    const db = (0, db_1.createPrisma)(env);
+                    const user = await db.user.findUnique({
+                        where: { id: session.userId },
+                        select: { role: true },
+                    });
+                    if (!user || user.role !== "SUPER_ADMIN") {
+                        const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({
+                            error: "Forbidden: Super-admin access required",
+                        }), { status: 403, headers: { "content-type": "application/json" } });
+                        return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                    }
+                }
+                // If no session in local dev, still allow (for test convenience)
+            }
+            // Extract userId from pathname (outside try block for error handler access)
+            const userIdMatch = pathname.match(/\/api\/admin\/test\/users\/([^/]+)/);
+            if (!userIdMatch) {
+                const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Invalid user ID" }), { status: 400, headers: { "content-type": "application/json" } });
+                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+            }
+            const userId = userIdMatch[1];
+            try {
+                // Delete user via DataRouter (uses API's database connection)
+                const region = (0, region_detection_1.detectRegionSync)(request, env);
+                const dbManager = database_connection_manager_1.sharedDatabaseConnectionManager;
+                await (0, db_query_helper_1.withQueryTimeoutAndRetry)(dbManager, region, env, async (db) => {
+                    const { deleteUserData } = await Promise.resolve().then(() => __importStar(require("../services/user-data-deletion")));
+                    await deleteUserData(db, userId);
+                }, {
+                    ...db_query_helper_1.QueryTimeoutPresets.STANDARD,
+                    timeoutMs: 5000, // 5 seconds for cleanup (more time for multiple deletes)
+                    retryTimeoutMs: 2000, // 2 seconds for retry
+                    maxRetries: 1, // Allow 1 retry for cleanup operations
+                });
+                const response = securityHeaders.createSecureResponse(JSON.stringify({
+                    success: true,
+                    message: "Test user deleted successfully",
+                }), { status: 200, headers: { "content-type": "application/json" } });
+                return (0, worker_1.addCorsHeaders)(response, request, env);
+            }
+            catch (error) {
+                // Ignore "Record to delete does not exist" errors
+                if (error.message?.includes("Record to delete does not exist")) {
+                    const response = securityHeaders.createSecureResponse(JSON.stringify({
+                        success: true,
+                        message: "User already deleted or does not exist",
+                    }), { status: 200, headers: { "content-type": "application/json" } });
+                    return (0, worker_1.addCorsHeaders)(response, request, env);
+                }
+                // Ignore foreign key constraint violations - user may have already been deleted
+                // or related records may have been cleaned up by cascade deletes
+                if (error.message?.includes("Foreign key constraint") ||
+                    error.message?.includes("foreign key constraint violated")) {
+                    // Try to verify if user still exists
+                    try {
+                        const verifyRegion = (0, region_detection_1.detectRegionSync)(request, env);
+                        const verifyDbManager = database_connection_manager_1.sharedDatabaseConnectionManager;
+                        const userExists = await (0, db_query_helper_1.withQueryTimeoutAndRetry)(verifyDbManager, verifyRegion, env, async (db) => {
+                            const user = await db.user.findUnique({
+                                where: { id: userId },
+                                select: { id: true },
+                            });
+                            return !!user;
+                        }, {
+                            ...db_query_helper_1.QueryTimeoutPresets.STANDARD,
+                            defaultValue: false, // Assume deleted if query fails
+                        });
+                        if (!userExists) {
+                            // User is already deleted, return success
+                            const response = securityHeaders.createSecureResponse(JSON.stringify({
+                                success: true,
+                                message: "User already deleted (foreign key constraint handled)",
+                            }), {
+                                status: 200,
+                                headers: { "content-type": "application/json" },
+                            });
+                            return (0, worker_1.addCorsHeaders)(response, request, env);
+                        }
+                    }
+                    catch (verifyError) {
+                        // If verification fails, log and continue with error response
+                        logger.warn("[Admin Test] Error verifying user deletion:", verifyError);
+                    }
+                }
+                logger.error("[Admin Test] Error deleting test user:", error);
+                const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({
+                    error: error.message || "Failed to delete test user",
+                }), { status: 500, headers: { "content-type": "application/json" } });
+                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+            }
+        },
+        middleware: [(0, middleware_1.corsMiddleware)()], // No CSRF for test endpoints (unauthenticated in CI)
+        description: "Delete test user (dev environment only)",
+    },
+    {
+        path: "/api/admin/super-admin/*",
+        method: "*",
+        handler: async (request, env, { pathname }) => {
+            const sessionManager = new session_manager_1.SessionManager();
+            const securityHeaders = new security_headers_1.SecurityHeaders(env);
+            const logger = logger_1.Logger.getInstance(env);
+            // Get session secret with error handling
+            let sessionSecret;
+            try {
+                logger.debug("[Admin] Getting session secret...");
+                sessionSecret = secret_resolver_1.Secrets.getSessionSecret(env);
+                logger.debug(`[Admin] Session secret retrieved, type: ${typeof sessionSecret}, length: ${sessionSecret?.length ?? "N/A"}`);
+                if (!sessionSecret || typeof sessionSecret !== "string") {
+                    logger.error(`[Admin] Invalid session secret from Secrets.getSessionSecret: ${typeof sessionSecret}, ${sessionSecret ? "present but invalid" : "missing"}`);
+                    const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Server configuration error" }), { status: 500, headers: { "content-type": "application/json" } });
+                    return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                }
+                logger.debug("[Admin] Session secret is valid, length:", sessionSecret.length);
+            }
+            catch (error) {
+                logger.error("[Admin] Error getting session secret:", error);
+                const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Server configuration error" }), { status: 500, headers: { "content-type": "application/json" } });
+                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+            }
+            logger.debug("[Admin] Calling getSession with secret length:", sessionSecret.length);
+            const session = await sessionManager.getSession(request, sessionSecret, env);
+            logger.debug("[Admin] getSession returned:", session ? "session found" : "null (unauthorized)");
+            if (!session) {
+                const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
+                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+            }
+            const db = (0, db_1.createPrisma)(env);
+            const user = await db.user.findUnique({
+                where: { id: session.userId },
+                select: { role: true, email: true },
+            });
+            if (!user) {
+                const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Forbidden: User not found" }), { status: 403, headers: { "content-type": "application/json" } });
+                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+            }
+            const isSuperAdmin = user.role === "SUPER_ADMIN";
+            if (pathname === "/api/admin/super-admin/check" &&
+                request.method === "GET") {
+                logger.debug("[SuperAdmin] Check request", {
+                    userEmail: user.email,
+                    userRole: user.role,
+                    isSuperAdmin,
+                });
+                const response = securityHeaders.createSecureResponse(JSON.stringify({ isSuperAdmin }), { status: 200, headers: { "content-type": "application/json" } });
+                return (0, worker_1.addCorsHeaders)(response, request, env);
+            }
+            if (!isSuperAdmin) {
+                const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Forbidden: Super-admin access required" }), { status: 403, headers: { "content-type": "application/json" } });
+                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+            }
+            const toggleService = new feature_toggle_service_1.FeatureToggleService(db);
+            // Get all feature toggles
+            if (pathname === "/api/admin/super-admin/feature-toggles" &&
+                request.method === "GET") {
+                try {
+                    // Use standard timeout presets (consistent with other endpoints)
+                    // DatabaseConnectionManager handles connection health and stale connection cleanup
+                    const dbManager = database_connection_manager_1.sharedDatabaseConnectionManager;
+                    const region = (0, region_detection_1.detectRegionSync)(request, env);
+                    // Use STANDARD preset (3s initial + 2s retry = 5s total)
+                    // This is consistent with other user-facing endpoints and well below Worker limits
+                    // Use defaultValue to return empty array on timeout/error (graceful degradation)
+                    let toggles = [];
+                    try {
+                        toggles = await (0, db_query_helper_1.withQueryTimeoutAndRetry)(dbManager, region, env, async (client) => {
+                            const service = new feature_toggle_service_1.FeatureToggleService(client);
+                            return await service.getAllToggles();
+                        }, {
+                            ...db_query_helper_1.QueryTimeoutPresets.STANDARD, // 1s initial, 0.5s retry (optimized)
+                            defaultValue: [], // Return empty array on timeout/error (graceful degradation)
+                            maxRetries: 1, // Only 1 retry to keep total time under 2s
+                            context: {
+                                operation: "getAllFeatureToggles",
+                                userEmail: user.email,
+                            },
+                        });
+                        // Ensure toggles is always an array (defensive check)
+                        if (!Array.isArray(toggles)) {
+                            logger.warn("[SuperAdmin] getAllToggles returned non-array, using empty array", { togglesType: typeof toggles });
+                            toggles = [];
+                        }
+                    }
+                    catch (error) {
+                        // Defensive: If defaultValue wasn't returned (shouldn't happen, but be safe)
+                        // Log the error and use empty array as fallback
+                        // This should never happen if executeWithRetry is working correctly,
+                        // but we handle it defensively to ensure we always return a valid response
+                        logger.warn("[SuperAdmin] Error in getAllToggles, using empty array fallback", {
+                            error: error?.message || String(error),
+                            errorCode: error?.code,
+                            errorName: error?.name,
+                            hasDefaultValue: true,
+                            // This indicates executeWithRetry didn't return defaultValue as expected
+                            // This is a defensive fallback to ensure graceful degradation
+                        });
+                        toggles = []; // Fallback to empty array
+                    }
+                    const response = securityHeaders.createSecureResponse(JSON.stringify({
+                        toggles: toggles.map((toggle) => ({
+                            key: toggle.key,
+                            enabled: toggle.enabled,
+                            lastChanged: toggle.lastChanged?.toISOString(),
+                            changedBy: toggle.changedBy,
+                            description: toggle.description,
+                        })),
+                    }), { status: 200, headers: { "content-type": "application/json" } });
+                    return (0, worker_1.addCorsHeaders)(response, request, env);
+                }
+                catch (error) {
+                    logger.error("[SuperAdmin] Error getting all feature toggles:", error);
+                    logger.error("[SuperAdmin] Error stack:", error instanceof Error ? error.stack : "No stack trace");
+                    // Extract error details once
+                    const errorMessage = error instanceof Error ? error.message : String(error);
+                    const errorString = String(error).toLowerCase();
+                    logger.error("[SuperAdmin] Error type and message:", {
+                        type: typeof error,
+                        isError: error instanceof Error,
+                        message: errorMessage,
+                        string: errorString,
+                        errorCode: error?.code,
+                        errorName: error?.name,
+                    });
+                    // Check if it's a timeout error (including connection timeouts)
+                    // Also check for memory errors which can occur with stale connections
+                    // Also check for prepared statement errors (PgBouncer transaction mode limitation)
+                    // Be very permissive - if defaultValue was set, we should return it for ANY error
+                    // Since we configured defaultValue: [], treat ANY error as a timeout/connection issue
+                    // This provides graceful degradation - if the database is having issues, return empty array
+                    const isTimeout = errorMessage.includes("timeout") ||
+                        errorMessage.includes("exceeded") ||
+                        errorMessage.includes("Database query timeout") ||
+                        errorMessage.includes("timeout exceeded when trying to connect") ||
+                        errorMessage.includes("Database query failed after") ||
+                        errorMessage.includes("memory access out of bounds") || // PrismaPg adapter error from stale connections
+                        errorMessage.includes("ECONNREFUSED") ||
+                        errorMessage.includes("ETIMEDOUT") ||
+                        errorMessage.includes("ENOTFOUND") ||
+                        errorMessage.includes("ECONNRESET") ||
+                        errorMessage.includes("ENETUNREACH") ||
+                        errorString.includes("timeout") ||
+                        errorString.includes("exceeded") ||
+                        errorString.includes("database query failed") ||
+                        errorString.includes("memory access") ||
+                        errorString.includes("connection");
+                    // Check for prepared statement errors (PgBouncer transaction mode doesn't support prepared statements)
+                    const isPreparedStatementError = errorMessage.includes("prepared statement") ||
+                        errorMessage.includes("does not exist") ||
+                        errorMessage.includes("already exists") ||
+                        errorString.includes("prepared statement") ||
+                        error?.code === "26000" || // PostgreSQL error code for invalid prepared statement
+                        error?.code === "42P05"; // PostgreSQL error code for duplicate prepared statement
+                    // If it's a timeout/connection error OR any database-related error OR prepared statement error,
+                    // return empty array (graceful degradation)
+                    // This matches the defaultValue: [] behavior we configured in withQueryTimeoutAndRetry
+                    // The executeWithRetry should have returned defaultValue, but if it still throws,
+                    // we handle it here as a fallback
+                    // Be very permissive - ANY error from database operations should return empty array
+                    // Since we configured defaultValue: [], any error means the database query failed
+                    // Check error message, error string, and error code
+                    const isDatabaseError = isTimeout ||
+                        isPreparedStatementError ||
+                        errorMessage.includes("Database") ||
+                        errorMessage.includes("Prisma") ||
+                        errorMessage.includes("query") ||
+                        errorMessage.includes("connection") ||
+                        errorMessage.includes("timeout") ||
+                        errorMessage.includes("exceeded") ||
+                        errorMessage.includes("failed after") || // "Database query failed after X retries"
+                        errorString.includes("database") ||
+                        errorString.includes("prisma") ||
+                        errorString.includes("query") ||
+                        errorString.includes("connection") ||
+                        errorString.includes("timeout") ||
+                        errorString.includes("failed after") ||
+                        error?.code?.startsWith("P") || // Prisma error codes (P1001, P2021, etc.)
+                        error?.code?.startsWith("08") || // PostgreSQL connection error codes (08P01, etc.)
+                        error?.code?.startsWith("42") || // PostgreSQL syntax/state error codes (42P05, etc.)
+                        true; // Catch ALL errors - if defaultValue was set, any error should return it
+                    // Since we configured defaultValue: [] in withQueryTimeoutAndRetry,
+                    // ANY error from database operations should return empty array
+                    // This provides graceful degradation - if database is having issues, return empty array
+                    // The isDatabaseError check includes `true` at the end to catch ALL errors
+                    logger.warn("[SuperAdmin] Error detected in feature toggle query, returning empty array (graceful degradation)", {
+                        errorMessage,
+                        isTimeout,
+                        isPreparedStatementError,
+                        isDatabaseError,
+                        errorCode: error?.code,
+                        errorName: error?.name,
+                    });
+                    const response = securityHeaders.createSecureResponse(JSON.stringify({
+                        toggles: [],
+                    }), { status: 200, headers: { "content-type": "application/json" } });
+                    return (0, worker_1.addCorsHeaders)(response, request, env);
+                }
+            }
+            // Create a new feature toggle
+            if (pathname === "/api/admin/super-admin/feature-toggles" &&
+                request.method === "POST") {
+                try {
+                    // Rate limit admin API
+                    const rateLimitResult = await (0, feature_toggle_rate_limit_1.rateLimitAdminFeatureToggleAPI)(request, env, user.email);
+                    if (!rateLimitResult || !rateLimitResult.allowed) {
+                        const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({
+                            error: {
+                                code: "RATE_LIMIT_EXCEEDED",
+                                message: "Rate limit exceeded. Please try again later.",
+                                retryAfter: rateLimitResult
+                                    ? Math.ceil((rateLimitResult.resetAt - Date.now()) / 1000)
+                                    : 60,
+                            },
+                        }), {
+                            status: 429,
+                            headers: {
+                                "content-type": "application/json",
+                                ...(rateLimitResult?.headers || {}),
+                            },
+                        });
+                        return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                    }
+                    // Validate request body
+                    const CreateToggleSchema = zod_1.z.object({
+                        key: feature_toggle_schemas_1.FeatureToggleKeySchema,
+                        enabled: zod_1.z.boolean().default(false),
+                        description: zod_1.z.string().max(1000).optional(),
+                    });
+                    const { key, enabled, description } = (0, validate_request_1.validateBody)(CreateToggleSchema, await request.json());
+                    // Check if toggle already exists
+                    const existing = await toggleService.getToggle(key);
+                    if (existing) {
+                        const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Feature toggle already exists" }), { status: 409, headers: { "content-type": "application/json" } });
+                        return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                    }
+                    // Create the toggle
+                    const toggle = await toggleService.setToggle(key, enabled, user.email, description);
+                    const responseHeaders = {
+                        "content-type": "application/json",
+                        ...rateLimitResult.headers,
+                    };
+                    const response = securityHeaders.createSecureResponse(JSON.stringify({
+                        success: true,
+                        toggle: {
+                            key: toggle.key,
+                            enabled: toggle.enabled,
+                            lastChanged: toggle.lastChanged.toISOString(),
+                            changedBy: toggle.changedBy,
+                            description: description,
+                        },
+                    }), { status: 201, headers: responseHeaders });
+                    return (0, worker_1.addCorsHeaders)(response, request, env);
+                }
+                catch (error) {
+                    if (error instanceof validate_request_1.ValidationError) {
+                        const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: error.message }), { status: 400, headers: { "content-type": "application/json" } });
+                        return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                    }
+                    logger.error("[SuperAdmin] Error creating feature toggle:", error);
+                    const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Failed to create feature toggle" }), { status: 500, headers: { "content-type": "application/json" } });
+                    return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                }
+            }
+            if (pathname === "/api/admin/super-admin/settings" &&
+                request.method === "GET") {
+                try {
+                    const globalPublicPosting = await toggleService.getToggle("global_public_posting_enabled");
+                    const signupToggle = await toggleService.getToggle("user_signup_mode");
+                    let signupMode = "open";
+                    if (signupToggle?.description) {
+                        const modeMatch = signupToggle.description.match(/user_signup_mode:(open|invitation_only|disabled)/);
+                        if (modeMatch) {
+                            signupMode = modeMatch[1];
+                        }
+                    }
+                    else if (signupToggle?.enabled === false) {
+                        signupMode = "disabled";
+                    }
+                    const superAdminCount = await db.user.count({
+                        where: { role: "SUPER_ADMIN" },
+                    });
+                    const settings = {
+                        featureToggles: {
+                            global_public_posting_enabled: {
+                                enabled: globalPublicPosting?.enabled ?? false,
+                                lastChanged: globalPublicPosting?.lastChanged?.toISOString(),
+                                changedBy: globalPublicPosting?.changedBy,
+                            },
+                        },
+                        signupSettings: {
+                            mode: signupMode,
+                            lastChanged: signupToggle?.lastChanged?.toISOString(),
+                            changedBy: signupToggle?.changedBy,
+                        },
+                        systemInfo: {
+                            environment: env.ENVIRONMENT || "unknown",
+                            version: (0, version_1.getAppVersion)(env),
+                            superAdminCount,
+                        },
+                    };
+                    const response = securityHeaders.createSecureResponse(JSON.stringify(settings), { status: 200, headers: { "content-type": "application/json" } });
+                    return (0, worker_1.addCorsHeaders)(response, request, env);
+                }
+                catch (error) {
+                    logger.error("[SuperAdmin] Error getting settings:", error);
+                    const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Failed to get settings" }), { status: 500, headers: { "content-type": "application/json" } });
+                    return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                }
+            }
+            const toggleUpdateMatch = pathname.match(/^\/api\/admin\/super-admin\/feature-toggles\/(.+)$/);
+            if (toggleUpdateMatch && request.method === "PUT") {
+                try {
+                    logger.debug(`[Admin] PUT request for feature toggle, pathname: ${pathname}`);
+                    logger.debug(`[Admin] toggleUpdateMatch: ${JSON.stringify(toggleUpdateMatch)}`);
+                    logger.debug(`[Admin] user.email: ${user.email}, type: ${typeof user.email}`);
+                    // Rate limit admin API (1000 requests/minute per user)
+                    // Ensure user.email is defined and is a string for rate limiting
+                    if (!user.email || typeof user.email !== "string") {
+                        const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "User email not found or invalid" }), { status: 500, headers: { "content-type": "application/json" } });
+                        return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                    }
+                    const rateLimitResult = await (0, feature_toggle_rate_limit_1.rateLimitAdminFeatureToggleAPI)(request, env, user.email);
+                    if (!rateLimitResult || !rateLimitResult.allowed) {
+                        const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({
+                            error: {
+                                code: "RATE_LIMIT_EXCEEDED",
+                                message: "Rate limit exceeded. Please try again later.",
+                                retryAfter: rateLimitResult
+                                    ? Math.ceil((rateLimitResult.resetAt - Date.now()) / 1000)
+                                    : 60,
+                            },
+                        }), {
+                            status: 429,
+                            headers: {
+                                "content-type": "application/json",
+                                ...(rateLimitResult?.headers || {}),
+                            },
+                        });
+                        return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                    }
+                    // Validate path parameter (toggle key)
+                    const pathParam = toggleUpdateMatch?.[1];
+                    if (!pathParam || typeof pathParam !== "string") {
+                        const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({
+                            error: "Invalid path parameter: toggle key is required",
+                        }), { status: 400, headers: { "content-type": "application/json" } });
+                        return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                    }
+                    let toggleKey;
+                    try {
+                        toggleKey = (0, validate_request_1.validatePathParam)(feature_toggle_schemas_1.FeatureToggleKeySchema, pathParam);
+                    }
+                    catch (error) {
+                        if (error instanceof validate_request_1.ValidationError) {
+                            const errorResponse = securityHeaders.createSecureResponse(JSON.stringify(error.toResponse()), {
+                                status: 400,
+                                headers: { "content-type": "application/json" },
+                            });
+                            return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                        }
+                        throw error;
+                    }
+                    // Validate request body
+                    let body;
+                    try {
+                        body = await request.json();
+                    }
+                    catch (error) {
+                        const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Invalid JSON in request body" }), { status: 400, headers: { "content-type": "application/json" } });
+                        return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                    }
+                    // Ensure body is an object
+                    if (!body || typeof body !== "object" || Array.isArray(body)) {
+                        const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Request body must be an object" }), { status: 400, headers: { "content-type": "application/json" } });
+                        return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                    }
+                    const UpdateToggleEnabledSchema = zod_1.z.object({
+                        enabled: zod_1.z.boolean({
+                            required_error: "enabled is required",
+                            invalid_type_error: "enabled must be a boolean",
+                        }),
+                    });
+                    let enabled;
+                    try {
+                        const validated = (0, validate_request_1.validateBody)(UpdateToggleEnabledSchema, body);
+                        enabled = validated.enabled;
+                    }
+                    catch (error) {
+                        if (error instanceof validate_request_1.ValidationError) {
+                            const errorResponse = securityHeaders.createSecureResponse(JSON.stringify(error.toResponse()), {
+                                status: 400,
+                                headers: { "content-type": "application/json" },
+                            });
+                            return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                        }
+                        // Log unexpected errors for debugging
+                        logger.error("[Admin] Unexpected error in body validation:", error);
+                        throw error;
+                    }
+                    // Use improved database connection manager with aggressive timeout handling
+                    const dbManager = database_connection_manager_1.sharedDatabaseConnectionManager;
+                    const region = (0, region_detection_1.detectRegionSync)(request, env);
+                    // Top-level timeout wrapper to ensure we never hang for more than 3 seconds
+                    // This is well below Cloudflare's 30-second limit and ensures we always return a response
+                    // Aggressive timeout to fail fast if database is slow
+                    const MAX_TOTAL_TIMEOUT_MS = 3000; // 3 seconds total - fail fast
+                    let timeoutId = null;
+                    const timeoutPromise = new Promise((_, reject) => {
+                        timeoutId = setTimeout(() => {
+                            reject(new Error("Request timeout: Database operation exceeded maximum time limit"));
+                        }, MAX_TOTAL_TIMEOUT_MS);
+                    });
+                    let toggle;
+                    try {
+                        // Wrap the entire operation in a timeout-safe wrapper
+                        const dbOperation = (async () => {
+                            try {
+                                return await dbManager.executeWithRetry(region, env, async (client) => {
+                                    // Create a temporary service instance with the client from timeout helper
+                                    const service = new feature_toggle_service_1.FeatureToggleService(client);
+                                    // Ensure user.email is still defined (double-check before DB operation)
+                                    if (!user.email || typeof user.email !== "string") {
+                                        throw new Error("User email is required for toggle update");
+                                    }
+                                    return await service.setToggle(toggleKey, enabled, user.email, toggleKey === "global_public_posting_enabled"
+                                        ? "Globally enable public posting for all users"
+                                        : undefined);
+                                }, {
+                                    timeoutMs: 1000, // 1 second initial timeout - fail fast
+                                    retryTimeoutMs: 500, // 0.5 seconds retry timeout - very fast retry
+                                    maxRetries: 1, // Only 1 retry to keep total time under 2s
+                                    context: {
+                                        operation: "updateFeatureToggle",
+                                        userEmail: user.email,
+                                        toggleKey: toggleKey,
+                                    },
+                                });
+                            }
+                            catch (error) {
+                                // Re-throw with more context
+                                throw new Error(`Database operation failed: ${error.message || String(error)}`);
+                            }
+                        })();
+                        // Race the database operation against the top-level timeout
+                        // This ensures we ALWAYS return a response within 6 seconds
+                        toggle = await Promise.race([dbOperation, timeoutPromise]);
+                        // Clear timeout if operation succeeded
+                        if (timeoutId) {
+                            clearTimeout(timeoutId);
+                        }
+                    }
+                    catch (dbError) {
+                        // Clear timeout on error
+                        if (timeoutId) {
+                            clearTimeout(timeoutId);
+                        }
+                        logger.error("[SuperAdmin] Database error updating feature toggle:", {
+                            error: dbError.message,
+                            stack: dbError.stack,
+                            toggleKey,
+                            userEmail: user.email,
+                            isTimeout: dbError.message?.includes("timeout") ||
+                                dbError.message?.includes("exceeded"),
+                        });
+                        // Return a user-friendly error response instead of letting it bubble up
+                        const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({
+                            error: "Database operation timed out. Please try again in a moment.",
+                            details: "The database connection is experiencing issues. This usually resolves quickly.",
+                        }), { status: 503, headers: { "content-type": "application/json" } });
+                        return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                    }
+                    // Add rate limit headers to successful response
+                    const responseHeaders = {
+                        "content-type": "application/json",
+                        ...rateLimitResult.headers,
+                    };
+                    const response = securityHeaders.createSecureResponse(JSON.stringify({
+                        success: true,
+                        toggle: {
+                            key: toggle.key,
+                            enabled: toggle.enabled,
+                            lastChanged: toggle.lastChanged.toISOString(),
+                            changedBy: toggle.changedBy,
+                        },
+                    }), { status: 200, headers: responseHeaders });
+                    return (0, worker_1.addCorsHeaders)(response, request, env);
+                }
+                catch (error) {
+                    // Handle validation errors
+                    if (error instanceof validate_request_1.ValidationError) {
+                        const errorResponse = securityHeaders.createSecureResponse(JSON.stringify(error.toResponse()), {
+                            status: error.getStatusCode(),
+                            headers: { "content-type": "application/json" },
+                        });
+                        return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                    }
+                    logger.error("[SuperAdmin] Error updating feature toggle:", error);
+                    const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Failed to update feature toggle" }), { status: 500, headers: { "content-type": "application/json" } });
+                    return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                }
+            }
+            if (pathname === "/api/admin/super-admin/signup-settings" &&
+                request.method === "PUT") {
+                try {
+                    const body = (await request.json());
+                    const { mode } = body;
+                    if (!mode ||
+                        !["open", "invitation_only", "disabled"].includes(mode)) {
+                        const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({
+                            error: 'Invalid request: mode must be "open", "invitation_only", or "disabled"',
+                        }), { status: 400, headers: { "content-type": "application/json" } });
+                        return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                    }
+                    const enabled = mode !== "disabled";
+                    const description = `user_signup_mode:${mode}`;
+                    const toggle = await toggleService.setToggle("user_signup_mode", enabled, user.email, description);
+                    const response = securityHeaders.createSecureResponse(JSON.stringify({
+                        success: true,
+                        signupSettings: {
+                            mode: mode,
+                            lastChanged: toggle.lastChanged.toISOString(),
+                            changedBy: toggle.changedBy,
+                        },
+                    }), { status: 200, headers: { "content-type": "application/json" } });
+                    return (0, worker_1.addCorsHeaders)(response, request, env);
+                }
+                catch (error) {
+                    logger.error("[SuperAdmin] Error updating sign-up settings:", error);
+                    const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Failed to update sign-up settings" }), { status: 500, headers: { "content-type": "application/json" } });
+                    return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                }
+            }
+            const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Not found" }), { status: 404, headers: { "content-type": "application/json" } });
+            return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+        },
+        middleware: [(0, middleware_1.corsMiddleware)(), (0, middleware_1.csrfMiddleware)()],
+        description: "Super-admin routes",
+    },
+    {
+        path: /^\/api\/feature-toggles\/(.+)$/,
+        method: "GET",
+        handler: async (request, env, { pathname }) => {
+            const logger = logger_1.Logger.getInstance(env);
+            const securityHeaders = new security_headers_1.SecurityHeaders(env);
+            const toggleKeyMatch = pathname.match(/^\/api\/feature-toggles\/(.+)$/);
+            if (!toggleKeyMatch) {
+                const response = securityHeaders.createSecureResponse(JSON.stringify({ enabled: false }), { status: 200, headers: { "content-type": "application/json" } });
+                return (0, worker_1.addCorsHeaders)(response, request, env);
+            }
+            try {
+                // Rate limit public API (100 requests/minute per IP)
+                const rateLimitResult = await (0, feature_toggle_rate_limit_1.rateLimitFeatureToggleAPI)(request, env);
+                if (!rateLimitResult || !rateLimitResult.allowed) {
+                    const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({
+                        error: {
+                            code: "RATE_LIMIT_EXCEEDED",
+                            message: "Rate limit exceeded. Please try again later.",
+                            retryAfter: rateLimitResult
+                                ? Math.ceil((rateLimitResult.resetAt - Date.now()) / 1000)
+                                : 60,
+                        },
+                    }), {
+                        status: 429,
+                        headers: {
+                            "content-type": "application/json",
+                            ...(rateLimitResult?.headers || {}),
+                        },
+                    });
+                    return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                }
+                // Validate path parameter (toggle key)
+                const toggleKey = (0, validate_request_1.validatePathParam)(feature_toggle_schemas_1.FeatureToggleKeySchema, toggleKeyMatch[1]);
+                // Validate query parameters
+                const url = new URL(request.url);
+                const queryParams = {};
+                url.searchParams.forEach((value, key) => {
+                    queryParams[key] = value;
+                });
+                const validatedQuery = (0, validate_request_1.validateQuery)(feature_toggle_schemas_1.PublicAPIQuerySchema, queryParams);
+                const db = (0, db_1.createPrisma)(env);
+                const toggleService = new feature_toggle_service_1.FeatureToggleService(db);
+                const toggle = await toggleService.getToggle(toggleKey);
+                if (!toggle) {
+                    // Add rate limit headers even for not found responses
+                    const responseHeaders = {
+                        "content-type": "application/json",
+                        ...rateLimitResult.headers,
+                    };
+                    const response = securityHeaders.createSecureResponse(JSON.stringify({ key: toggleKey, enabled: false }), { status: 200, headers: responseHeaders });
+                    return (0, worker_1.addCorsHeaders)(response, request, env);
+                }
+                // Add rate limit headers to successful response
+                const responseHeaders = {
+                    "content-type": "application/json",
+                    ...rateLimitResult.headers,
+                };
+                const response = securityHeaders.createSecureResponse(JSON.stringify({
+                    enabled: toggle.enabled,
+                    key: toggle.key,
+                    lastChanged: toggle.lastChanged?.toISOString(),
+                    changedBy: toggle.changedBy,
+                }), { status: 200, headers: responseHeaders });
+                return (0, worker_1.addCorsHeaders)(response, request, env);
+            }
+            catch (error) {
+                logger.error(`[Admin] GET handler error: ${error instanceof Error ? error.message : String(error)}`, {
+                    errorType: error?.constructor?.name,
+                    stack: error instanceof Error ? error.stack : "No stack",
+                });
+                // Handle validation errors
+                if (error instanceof validate_request_1.ValidationError) {
+                    const errorResponse = securityHeaders.createSecureResponse(JSON.stringify(error.toResponse()), {
+                        status: error.getStatusCode(),
+                        headers: { "content-type": "application/json" },
+                    });
+                    return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                }
+                // For other errors, return 500
+                const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({
+                    error: "Internal server error",
+                    message: error instanceof Error ? error.message : "Unknown error",
+                }), { status: 500, headers: { "content-type": "application/json" } });
+                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+            }
+        },
+        middleware: [(0, middleware_1.corsMiddleware)()],
+        description: "Get feature toggle status",
+    },
+    {
+        path: "/api/roles/metadata",
+        method: "GET",
+        handler: async (request, env) => {
+            const logger = logger_1.Logger.getInstance(env);
+            const securityHeaders = new security_headers_1.SecurityHeaders(env);
+            try {
+                const db = (0, db_1.createPrisma)(env);
+                const roleMetadata = await db.roleMetadata.findMany({
+                    where: { isActive: true },
+                    orderBy: { role: "asc" },
+                });
+                const response = securityHeaders.createSecureResponse(JSON.stringify({ roles: roleMetadata }), { status: 200, headers: { "content-type": "application/json" } });
+                return (0, worker_1.addCorsHeaders)(response, request, env);
+            }
+            catch (error) {
+                logger.error("Error fetching role metadata:", error);
+                const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Failed to fetch role metadata" }), { status: 500, headers: { "content-type": "application/json" } });
+                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+            }
+        },
+        middleware: [(0, middleware_1.corsMiddleware)()],
+        description: "Get role metadata",
+    },
+    // Domain Management Endpoints
+    {
+        path: "/api/admin/domains",
+        method: "GET",
+        handler: async (request, env, { url, requestContext }) => {
+            const sessionManager = new session_manager_1.SessionManager();
+            const securityHeaders = new security_headers_1.SecurityHeaders(env);
+            const logger = logger_1.Logger.getInstance(env);
+            // Check authentication and authorization
+            const session = await sessionManager.getSession(request, secret_resolver_1.Secrets.getSessionSecret(env), env);
+            if (!session) {
+                const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
+                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+            }
+            // Check if user is admin
+            const region = requestContext?.region || env.DEFAULT_REGION || "EU";
+            const db = data_router_1.DataRouter.getDatabaseForRegion(region, env);
+            const user = await db.user.findUnique({
+                where: { id: session.userId },
+                select: { role: true },
+            });
+            if (!user || (user.role !== "SUPER_ADMIN" && user.role !== "INTERNAL")) {
+                const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Forbidden: Admin access required" }), { status: 403, headers: { "content-type": "application/json" } });
+                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+            }
+            try {
+                // Parse query parameters
+                const queryParams = new URL(url).searchParams;
+                const limit = Math.min(parseInt(queryParams.get("limit") || "50", 10), 100);
+                const cursor = queryParams.get("cursor") || undefined;
+                const status = queryParams.get("status") || undefined;
+                const domainFilter = queryParams.get("domain") || undefined;
+                const sortBy = queryParams.get("sortBy") || "createdAt";
+                const sortOrder = queryParams.get("sortOrder") || "desc";
+                // Build query
+                const where = {};
+                if (cursor) {
+                    where.id = { gt: cursor };
+                }
+                if (status) {
+                    where.status = status;
+                }
+                if (domainFilter) {
+                    where.domain = { contains: domainFilter, mode: "insensitive" };
+                }
+                // Build orderBy
+                const orderBy = {};
+                if (sortBy === "createdAt" ||
+                    sortBy === "domain" ||
+                    sortBy === "reputation" ||
+                    sortBy === "status") {
+                    orderBy[sortBy] = sortOrder === "asc" ? "asc" : "desc";
+                }
+                else {
+                    orderBy.createdAt = "desc"; // Default
+                }
+                // Get domains with pagination
+                const domains = await db.domainReputation.findMany({
+                    where,
+                    take: limit + 1,
+                    orderBy,
+                });
+                const hasMore = domains.length > limit;
+                const result = hasMore ? domains.slice(0, limit) : domains;
+                const nextCursor = hasMore ? result[result.length - 1].id : undefined;
+                const response = securityHeaders.createSecureResponse(JSON.stringify({
+                    domains: result.map((d) => ({
+                        id: d.id,
+                        domain: d.domain,
+                        reputation: d.reputation,
+                        status: d.status,
+                        lastChecked: d.lastChecked.toISOString(),
+                        createdAt: d.createdAt.toISOString(),
+                        updatedAt: d.updatedAt.toISOString(),
+                    })),
+                    hasMore,
+                    nextCursor,
+                }), { status: 200, headers: { "content-type": "application/json" } });
+                return (0, worker_1.addCorsHeaders)(response, request, env);
+            }
+            catch (error) {
+                logger.error("[Admin] Error fetching domains:", error);
+                const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Failed to fetch domains" }), { status: 500, headers: { "content-type": "application/json" } });
+                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+            }
+        },
+        middleware: [(0, middleware_1.corsMiddleware)()],
+        description: "List domains with reputation",
+    },
+    {
+        path: /^\/api\/admin\/domains\/([^/]+)\/block$/,
+        method: "POST",
+        handler: async (request, env, { pathname, requestContext }) => {
+            const sessionManager = new session_manager_1.SessionManager();
+            const securityHeaders = new security_headers_1.SecurityHeaders(env);
+            const logger = logger_1.Logger.getInstance(env);
+            // Check authentication and authorization
+            const session = await sessionManager.getSession(request, secret_resolver_1.Secrets.getSessionSecret(env), env);
+            if (!session) {
+                const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
+                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+            }
+            // Check if user is admin
+            const region = requestContext?.region || env.DEFAULT_REGION || "EU";
+            const db = data_router_1.DataRouter.getDatabaseForRegion(region, env);
+            const user = await db.user.findUnique({
+                where: { id: session.userId },
+                select: { role: true },
+            });
+            if (!user || (user.role !== "SUPER_ADMIN" && user.role !== "INTERNAL")) {
+                const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Forbidden: Admin access required" }), { status: 403, headers: { "content-type": "application/json" } });
+                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+            }
+            try {
+                // Extract domain from path
+                const match = pathname.match(/^\/api\/admin\/domains\/([^/]+)\/block$/);
+                if (!match) {
+                    const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Invalid URL format" }), { status: 400, headers: { "content-type": "application/json" } });
+                    return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                }
+                const domain = decodeURIComponent(match[1]);
+                // Block domain
+                const reputationService = new domain_reputation_service_1.DomainReputationService(env);
+                await reputationService.blockDomain(domain, region, env);
+                logger.info(`[Admin] Domain blocked: ${domain} by user ${session.userId}`);
+                const response = securityHeaders.createSecureResponse(JSON.stringify({
+                    success: true,
+                    message: `Domain ${domain} has been blocked`,
+                }), { status: 200, headers: { "content-type": "application/json" } });
+                return (0, worker_1.addCorsHeaders)(response, request, env);
+            }
+            catch (error) {
+                logger.error("[Admin] Error blocking domain:", error);
+                const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Failed to block domain" }), { status: 500, headers: { "content-type": "application/json" } });
+                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+            }
+        },
+        middleware: [(0, middleware_1.corsMiddleware)(), (0, middleware_1.csrfMiddleware)()],
+        description: "Block a domain",
+    },
+    {
+        path: /^\/api\/admin\/domains\/([^/]+)\/unblock$/,
+        method: "POST",
+        handler: async (request, env, { pathname, requestContext }) => {
+            const sessionManager = new session_manager_1.SessionManager();
+            const securityHeaders = new security_headers_1.SecurityHeaders(env);
+            const logger = logger_1.Logger.getInstance(env);
+            // Check authentication and authorization
+            const session = await sessionManager.getSession(request, secret_resolver_1.Secrets.getSessionSecret(env), env);
+            if (!session) {
+                const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
+                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+            }
+            // Check if user is admin
+            const region = requestContext?.region || env.DEFAULT_REGION || "EU";
+            const db = data_router_1.DataRouter.getDatabaseForRegion(region, env);
+            const user = await db.user.findUnique({
+                where: { id: session.userId },
+                select: { role: true },
+            });
+            if (!user || (user.role !== "SUPER_ADMIN" && user.role !== "INTERNAL")) {
+                const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Forbidden: Admin access required" }), { status: 403, headers: { "content-type": "application/json" } });
+                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+            }
+            try {
+                // Extract domain from path
+                const match = pathname.match(/^\/api\/admin\/domains\/([^/]+)\/unblock$/);
+                if (!match) {
+                    const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Invalid URL format" }), { status: 400, headers: { "content-type": "application/json" } });
+                    return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                }
+                const domain = decodeURIComponent(match[1]);
+                // Unblock domain
+                const reputationService = new domain_reputation_service_1.DomainReputationService(env);
+                await reputationService.unblockDomain(domain, region, env);
+                logger.info(`[Admin] Domain unblocked: ${domain} by user ${session.userId}`);
+                const response = securityHeaders.createSecureResponse(JSON.stringify({
+                    success: true,
+                    message: `Domain ${domain} has been unblocked`,
+                }), { status: 200, headers: { "content-type": "application/json" } });
+                return (0, worker_1.addCorsHeaders)(response, request, env);
+            }
+            catch (error) {
+                logger.error("[Admin] Error unblocking domain:", error);
+                const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Failed to unblock domain" }), { status: 500, headers: { "content-type": "application/json" } });
+                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+            }
+        },
+        middleware: [(0, middleware_1.corsMiddleware)(), (0, middleware_1.csrfMiddleware)()],
+        description: "Unblock a domain",
+    },
+    {
+        path: "/api/admin/reports",
+        method: "GET",
+        handler: async (request, env, { url, requestContext }) => {
+            const sessionManager = new session_manager_1.SessionManager();
+            const securityHeaders = new security_headers_1.SecurityHeaders(env);
+            const logger = logger_1.Logger.getInstance(env);
+            // Check authentication and authorization
+            const session = await sessionManager.getSession(request, secret_resolver_1.Secrets.getSessionSecret(env), env);
+            if (!session) {
+                const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
+                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+            }
+            // Check if user is admin
+            const region = requestContext?.region || env.DEFAULT_REGION || "EU";
+            const db = data_router_1.DataRouter.getDatabaseForRegion(region, env);
+            const user = await db.user.findUnique({
+                where: { id: session.userId },
+                select: { role: true },
+            });
+            if (!user || (user.role !== "SUPER_ADMIN" && user.role !== "INTERNAL")) {
+                const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Forbidden: Admin access required" }), { status: 403, headers: { "content-type": "application/json" } });
+                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+            }
+            try {
+                // Parse query parameters
+                const queryParams = new URL(url).searchParams;
+                const limit = Math.min(parseInt(queryParams.get("limit") || "50", 10), 100);
+                const cursor = queryParams.get("cursor") || undefined;
+                const status = queryParams.get("status") || undefined;
+                const domain = queryParams.get("domain") || undefined;
+                const sortBy = queryParams.get("sortBy") || "createdAt";
+                const sortOrder = queryParams.get("sortOrder") || "desc";
+                // Build query
+                const where = {};
+                if (cursor) {
+                    where.id = { gt: cursor };
+                }
+                if (status) {
+                    where.status = status;
+                }
+                if (domain) {
+                    where.domain = { contains: domain, mode: "insensitive" };
+                }
+                // Build orderBy
+                const orderBy = {};
+                if (sortBy === "createdAt" ||
+                    sortBy === "domain" ||
+                    sortBy === "status") {
+                    orderBy[sortBy] = sortOrder === "asc" ? "asc" : "desc";
+                }
+                else {
+                    orderBy.createdAt = "desc"; // Default
+                }
+                // Get reports with pagination
+                const reports = await db.linkReport.findMany({
+                    where,
+                    take: limit + 1,
+                    orderBy,
+                    include: {
+                        user: {
+                            select: {
+                                id: true,
+                                email: true,
+                            },
+                        },
+                    },
+                });
+                const hasMore = reports.length > limit;
+                const result = hasMore ? reports.slice(0, limit) : reports;
+                const nextCursor = hasMore ? result[result.length - 1].id : undefined;
+                const response = securityHeaders.createSecureResponse(JSON.stringify({
+                    reports: result.map((r) => ({
+                        id: r.id,
+                        userId: r.userId,
+                        userEmail: r.user.email,
+                        linkUrl: r.linkUrl,
+                        domain: r.domain,
+                        reason: r.reason,
+                        status: r.status,
+                        createdAt: r.createdAt.toISOString(),
+                    })),
+                    hasMore,
+                    nextCursor,
+                }), { status: 200, headers: { "content-type": "application/json" } });
+                return (0, worker_1.addCorsHeaders)(response, request, env);
+            }
+            catch (error) {
+                logger.error("[Admin] Error fetching reports:", error);
+                const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Failed to fetch reports" }), { status: 500, headers: { "content-type": "application/json" } });
+                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+            }
+        },
+        middleware: [(0, middleware_1.corsMiddleware)()],
+        description: "List link reports",
+    },
+    {
+        path: /^\/api\/admin\/reports\/([^/]+)\/review$/,
+        method: "POST",
+        handler: async (request, env, { pathname, requestContext }) => {
+            const sessionManager = new session_manager_1.SessionManager();
+            const securityHeaders = new security_headers_1.SecurityHeaders(env);
+            const logger = logger_1.Logger.getInstance(env);
+            // Check authentication and authorization
+            const session = await sessionManager.getSession(request, secret_resolver_1.Secrets.getSessionSecret(env), env);
+            if (!session) {
+                const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
+                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+            }
+            // Check if user is admin
+            const region = requestContext?.region || env.DEFAULT_REGION || "EU";
+            const db = data_router_1.DataRouter.getDatabaseForRegion(region, env);
+            const user = await db.user.findUnique({
+                where: { id: session.userId },
+                select: { role: true },
+            });
+            if (!user || (user.role !== "SUPER_ADMIN" && user.role !== "INTERNAL")) {
+                const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Forbidden: Admin access required" }), { status: 403, headers: { "content-type": "application/json" } });
+                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+            }
+            try {
+                // Extract reportId from path
+                const match = pathname.match(/^\/api\/admin\/reports\/([^/]+)\/review$/);
+                if (!match) {
+                    const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Invalid URL format" }), { status: 400, headers: { "content-type": "application/json" } });
+                    return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                }
+                const reportId = match[1];
+                // Parse request body
+                const body = (await request.json().catch(() => ({})));
+                if (!body.action ||
+                    !["approve", "reject", "dismiss"].includes(body.action)) {
+                    const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({
+                        error: "Invalid action. Must be approve, reject, or dismiss",
+                    }), { status: 400, headers: { "content-type": "application/json" } });
+                    return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                }
+                // Get report
+                const report = await db.linkReport.findUnique({
+                    where: { id: reportId },
+                });
+                if (!report) {
+                    const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Report not found" }), { status: 404, headers: { "content-type": "application/json" } });
+                    return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                }
+                // Update report status
+                let newStatus;
+                if (body.action === "approve") {
+                    newStatus = "approved";
+                    // If approved, update domain reputation (negative signal)
+                    const reputationService = new domain_reputation_service_1.DomainReputationService(env);
+                    await reputationService.updateReputation(report.domain, "user_report", region, env);
+                }
+                else if (body.action === "reject") {
+                    newStatus = "rejected";
+                }
+                else {
+                    newStatus = "dismissed";
+                }
+                const updatedReport = await db.linkReport.update({
+                    where: { id: reportId },
+                    data: {
+                        status: newStatus,
+                    },
+                });
+                logger.info(`[Admin] Report ${reportId} reviewed: ${body.action} by user ${session.userId}`);
+                const response = securityHeaders.createSecureResponse(JSON.stringify({
+                    success: true,
+                    report: {
+                        id: updatedReport.id,
+                        status: updatedReport.status,
+                    },
+                }), { status: 200, headers: { "content-type": "application/json" } });
+                return (0, worker_1.addCorsHeaders)(response, request, env);
+            }
+            catch (error) {
+                logger.error("[Admin] Error reviewing report:", error);
+                const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Failed to review report" }), { status: 500, headers: { "content-type": "application/json" } });
+                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+            }
+        },
+        middleware: [(0, middleware_1.corsMiddleware)(), (0, middleware_1.csrfMiddleware)()],
+        description: "Review a link report",
+    },
+    {
+        path: "/api/admin/domains/bulk",
+        method: "POST",
+        handler: async (request, env, { requestContext }) => {
+            const sessionManager = new session_manager_1.SessionManager();
+            const securityHeaders = new security_headers_1.SecurityHeaders(env);
+            const logger = logger_1.Logger.getInstance(env);
+            // Check authentication and authorization
+            const session = await sessionManager.getSession(request, secret_resolver_1.Secrets.getSessionSecret(env), env);
+            if (!session) {
+                const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Unauthorized" }), { status: 401, headers: { "content-type": "application/json" } });
+                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+            }
+            // Check if user is admin
+            const region = requestContext?.region || env.DEFAULT_REGION || "EU";
+            const db = data_router_1.DataRouter.getDatabaseForRegion(region, env);
+            const user = await db.user.findUnique({
+                where: { id: session.userId },
+                select: { role: true },
+            });
+            if (!user || (user.role !== "SUPER_ADMIN" && user.role !== "INTERNAL")) {
+                const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Forbidden: Admin access required" }), { status: 403, headers: { "content-type": "application/json" } });
+                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+            }
+            try {
+                // Parse request body
+                const body = (await request.json());
+                if (!body.action ||
+                    !["block", "unblock", "allowlist"].includes(body.action)) {
+                    const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({
+                        error: "Invalid action. Must be block, unblock, or allowlist",
+                    }), { status: 400, headers: { "content-type": "application/json" } });
+                    return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                }
+                if (!Array.isArray(body.domains) || body.domains.length === 0) {
+                    const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "domains must be a non-empty array" }), { status: 400, headers: { "content-type": "application/json" } });
+                    return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                }
+                // Limit bulk operations to prevent abuse
+                if (body.domains.length > 100) {
+                    const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Maximum 100 domains per bulk operation" }), { status: 400, headers: { "content-type": "application/json" } });
+                    return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+                }
+                const reputationService = new domain_reputation_service_1.DomainReputationService(env);
+                const results = [];
+                // Process each domain
+                for (const domain of body.domains) {
+                    try {
+                        if (body.action === "block") {
+                            await reputationService.blockDomain(domain, region, env);
+                        }
+                        else if (body.action === "unblock") {
+                            await reputationService.unblockDomain(domain, region, env);
+                        }
+                        else {
+                            await reputationService.addToAllowlist(domain, region, env);
+                        }
+                        results.push({ domain, success: true });
+                    }
+                    catch (error) {
+                        logger.warn(`[Admin] Failed to ${body.action} domain ${domain}:`, error);
+                        results.push({
+                            domain,
+                            success: false,
+                            error: error.message || "Unknown error",
+                        });
+                    }
+                }
+                const successCount = results.filter((r) => r.success).length;
+                logger.info(`[Admin] Bulk ${body.action} operation: ${successCount}/${body.domains.length} successful`);
+                const response = securityHeaders.createSecureResponse(JSON.stringify({
+                    success: true,
+                    action: body.action,
+                    total: body.domains.length,
+                    successful: successCount,
+                    failed: body.domains.length - successCount,
+                    results,
+                }), { status: 200, headers: { "content-type": "application/json" } });
+                return (0, worker_1.addCorsHeaders)(response, request, env);
+            }
+            catch (error) {
+                logger.error("[Admin] Error performing bulk operation:", error);
+                const errorResponse = securityHeaders.createSecureResponse(JSON.stringify({ error: "Failed to perform bulk operation" }), { status: 500, headers: { "content-type": "application/json" } });
+                return (0, worker_1.addCorsHeaders)(errorResponse, request, env);
+            }
+        },
+        middleware: [(0, middleware_1.corsMiddleware)(), (0, middleware_1.csrfMiddleware)()],
+        description: "Bulk domain operations (block/unblock/allowlist)",
+    },
+];
+//# sourceMappingURL=admin.js.map