rhythia-api 241.0.0 → 243.0.0

package/api/executeAdminOperation.ts

@@ -1,681 +1,1030 @@
-import { NextResponse } from "../utils/response";
-import z from "zod";
-import { Database } from "../types/database";
-import { protectedApi, validUser } from "../utils/requestUtils";
-import { supabase } from "../utils/supabase";
-import { getUserBySession } from "../utils/getUserBySession";
-import { User } from "@supabase/supabase-js";
-import { invalidateCache, invalidateCachePrefix } from "../utils/cache";
-
-type AdminProfileSummary = Pick<
-  Database["public"]["Tables"]["profiles"]["Row"],
-  "id" | "username" | "avatar_url" | "flag" | "badges" | "ban"
->;
-
-type InvestigationDateRange = {
-  firstSeenAt: string | null;
-  lastSeenAt: string | null;
-};
-
-type LinkedAccountAggregate = AdminProfileSummary &
-  InvestigationDateRange & {
-    occurrences: number;
-    sharedHwids: Set<string>;
-  };
-
-type LinkedProfileAggregate = AdminProfileSummary &
-  InvestigationDateRange & {
-    occurrences: number;
-  };
-
-const MULTIACCOUNT_PROFILE_SELECT =
-  "id, username, avatar_url, flag, badges, ban";
-
-const SCORE_CACHE_READ_OPERATIONS = new Set([
-  "getScoresPaginated",
-  "getMultiaccountInvestigation",
-]);
-
-function timestampOrZero(value: string | null) {
-  return value ? new Date(value).getTime() : 0;
-}
-
-function updateDateRange(
-  range: InvestigationDateRange,
-  createdAt: string | null
-) {
-  if (!createdAt) {
-    return;
-  }
-
-  if (!range.firstSeenAt || createdAt < range.firstSeenAt) {
-    range.firstSeenAt = createdAt;
-  }
-
-  if (!range.lastSeenAt || createdAt > range.lastSeenAt) {
-    range.lastSeenAt = createdAt;
-  }
-}
-
-// Define supported admin operations and their parameter types
-const adminOperations = {
-  deleteUser: z.object({ userId: z.number() }),
-  changeFlag: z.object({ userId: z.number(), flag: z.string() }),
-  changeBadges: z.object({ userId: z.number(), badges: z.string() }),
-  addBadge: z.object({ userId: z.number(), badge: z.string() }),
-  removeBadge: z.object({ userId: z.number(), badge: z.string() }),
-  excludeUser: z.object({ userId: z.number() }),
-  restrictUser: z.object({ userId: z.number() }),
-  silenceUser: z.object({ userId: z.number() }),
-  profanityClear: z.object({ userId: z.number() }),
-  searchUsers: z.object({ searchText: z.string() }),
-  removeAllScores: z.object({ userId: z.number() }),
-  invalidateRankedScores: z.object({ userId: z.number() }),
-  unbanUser: z.object({ userId: z.number() }),
-  getScoresPaginated: z.object({
-    page: z.number().min(1).default(1),
-    limit: z.number().min(1).max(100).default(50),
-    userId: z.number().optional(),
-    includeAdditionalData: z.boolean().default(true),
-  }),
-  getMultiaccountInvestigation: z.object({ userId: z.number() }),
-} as const;
-
-// Create a discriminated union type for operation parameters
-const OperationParam = z.discriminatedUnion("operation", [
-  z.object({
-    operation: z.literal("deleteUser"),
-    params: adminOperations.deleteUser,
-  }),
-  z.object({
-    operation: z.literal("excludeUser"),
-    params: adminOperations.excludeUser,
-  }),
-  z.object({
-    operation: z.literal("restrictUser"),
-    params: adminOperations.restrictUser,
-  }),
-  z.object({
-    operation: z.literal("silenceUser"),
-    params: adminOperations.silenceUser,
-  }),
-  z.object({
-    operation: z.literal("searchUsers"),
-    params: adminOperations.searchUsers,
-  }),
-  z.object({
-    operation: z.literal("profanityClear"),
-    params: adminOperations.profanityClear,
-  }),
-  z.object({
-    operation: z.literal("removeAllScores"),
-    params: adminOperations.removeAllScores,
-  }),
-  z.object({
-    operation: z.literal("invalidateRankedScores"),
-    params: adminOperations.invalidateRankedScores,
-  }),
-  z.object({
-    operation: z.literal("unbanUser"),
-    params: adminOperations.unbanUser,
-  }),
-  z.object({
-    operation: z.literal("changeFlag"),
-    params: adminOperations.changeFlag,
-  }),
-  z.object({
-    operation: z.literal("changeBadges"),
-    params: adminOperations.changeBadges,
-  }),
-  z.object({
-    operation: z.literal("addBadge"),
-    params: adminOperations.addBadge,
-  }),
-  z.object({
-    operation: z.literal("removeBadge"),
-    params: adminOperations.removeBadge,
-  }),
-  z.object({
-    operation: z.literal("getScoresPaginated"),
-    params: adminOperations.getScoresPaginated,
-  }),
-  z.object({
-    operation: z.literal("getMultiaccountInvestigation"),
-    params: adminOperations.getMultiaccountInvestigation,
-  }),
-]);
-
-export const Schema = {
-  input: z.strictObject({
-    session: z.string(),
-    data: OperationParam,
-  }),
-  output: z.object({
-    success: z.boolean(),
-    result: z.any().optional(),
-    error: z.string().optional(),
-  }),
-};
-
-export async function POST(request: Request): Promise<NextResponse> {
-  return protectedApi({
-    request,
-    schema: Schema,
-    authorization: () => {},
-    activity: handler,
-  });
-}
-
-export async function handler(
-  data: (typeof Schema)["input"]["_type"]
-): Promise<NextResponse<(typeof Schema)["output"]["_type"]>> {
-  // Get user from session
-  const user = (await getUserBySession(data.session)) as User;
-
-  // Get user's profile data
-  const { data: queryUserData, error: userError } = await supabase
-    .from("profiles")
-    .select("*")
-    .eq("uid", user.id)
-    .single();
-
-  if (userError || !queryUserData) {
-    return NextResponse.json(
-      {
-        success: false,
-        error: "User cannot be retrieved from session",
-      },
-      { status: 404 }
-    );
-  }
-  const tags = (queryUserData?.badges || []) as string[];
-  // Check if user has "Global Moderator" badge
-  const isGlobalModerator = tags.includes("Global Moderator");
-
-  if (!isGlobalModerator) {
-    return NextResponse.json(
-      {
-        success: false,
-        error: "Unauthorized. Only Global Moderators can perform this action.",
-      },
-      { status: 403 }
-    );
-  }
-
-  // Execute the requested admin operation
-  try {
-    let result: { data?: any; error?: any } | null = null;
-    const operation = data.data.operation;
-    const params = data.data.params as any;
-    const targetUserId =
-      "userId" in params && typeof params.userId === "number"
-        ? params.userId
-        : null;
-
-    switch (operation) {
-      case "deleteUser":
-        result = await supabase.rpc("admin_delete_user", {
-          user_id: params.userId,
-        });
-        break;
-
-      case "excludeUser":
-        result = await supabase.rpc("admin_exclude_user", {
-          user_id: params.userId,
-        });
-        break;
-
-      case "restrictUser":
-        result = await supabase.rpc("admin_restrict_user", {
-          user_id: params.userId,
-        });
-        break;
-
-      case "silenceUser":
-        result = await supabase.rpc("admin_silence_user", {
-          user_id: params.userId,
-        });
-        break;
-
-      case "searchUsers":
-        result = await supabase.rpc("admin_search_users", {
-          search_text: params.searchText,
-        });
-        break;
-
-      case "profanityClear":
-        result = await supabase.rpc("admin_profanity_clear", {
-          user_id: params.userId,
-        });
-        break;
-
-      case "removeAllScores":
-        result = await supabase.rpc("admin_remove_all_scores", {
-          user_id: params.userId,
-        });
-        break;
-
-      case "invalidateRankedScores":
-        result = await supabase.rpc("admin_invalidate_ranked_scores", {
-          user_id: params.userId,
-        });
-        break;
-
-      case "unbanUser":
-        result = await supabase.rpc("admin_unban_user", {
-          user_id: params.userId,
-        });
-        break;
-
-      case "changeFlag":
-        result = await supabase
-          .from("profiles")
-          .upsert({
-            id: params.userId,
-            flag: params.flag,
-          })
-          .select();
-        break;
-      case "changeBadges":
-        // Allow only developers to modify badges.
-        if ((queryUserData.badges as string[]).includes("Developer")) {
-          result = await supabase
-            .from("profiles")
-            .upsert({
-              id: params.userId,
-              badges: JSON.parse(params.badges),
-            })
-            .select();
-        } else {
-          result = { data: null, error: { message: "Unauthorized" } };
-        }
-        break;
-
-      case "addBadge":
-        // Allow only developers to modify badges.
-        if ((queryUserData.badges as string[]).includes("Developer")) {
-          // Get current badges
-          const { data: targetUser } = await supabase
-            .from("profiles")
-            .select("badges")
-            .eq("id", params.userId)
-            .single();
-          
-          const currentBadges = (targetUser?.badges || []) as string[];
-          if (!currentBadges.includes(params.badge)) {
-            currentBadges.push(params.badge);
-            result = await supabase
-              .from("profiles")
-              .upsert({
-                id: params.userId,
-                badges: currentBadges,
-              })
-              .select();
-          } else {
-            result = { data: targetUser, error: null };
-          }
-        } else {
-          result = { data: null, error: { message: "Unauthorized" } };
-        }
-        break;
-
-      case "removeBadge":
-        // Allow only developers to modify badges.
-        if ((queryUserData.badges as string[]).includes("Developer")) {
-          // Get current badges
-          const { data: targetUser } = await supabase
-            .from("profiles")
-            .select("badges")
-            .eq("id", params.userId)
-            .single();
-          
-          const currentBadges = (targetUser?.badges || []) as string[];
-          const updatedBadges = currentBadges.filter(b => b !== params.badge);
-          
-          result = await supabase
-            .from("profiles")
-            .upsert({
-              id: params.userId,
-              badges: updatedBadges,
-            })
-            .select();
-        } else {
-          result = { data: null, error: { message: "Unauthorized" } };
-        }
-        break;
-
-      case "getScoresPaginated":
-        const offset = (params.page - 1) * params.limit;
-        let query = supabase
-          .from("scores")
-          .select(
-            `
-            id,
-            awarded_sp,
-            userId,
-            additional_data,
-            profiles (
-              username
-            )
-          `
-          )
-          .eq("passed", true)
-          .order("created_at", { ascending: false })
-          .range(offset, offset + params.limit - 1);
-
-        if (params.userId) {
-          query = query.eq("userId", params.userId);
-        }
-
-        const { data: scoresData, error: scoresError, count } = await query;
-
-        if (scoresError) {
-          result = { error: scoresError, data: null };
-        } else {
-          const transformedScores = scoresData?.map((score) => {
-            const transformed: any = {
-              id: score.id,
-              awarded_sp: score.awarded_sp,
-              userId: score.userId,
-              username: score.profiles?.username || null,
-            };
-
-            if (params.includeAdditionalData) {
-              transformed.additional_data = score.additional_data;
-            }
-
-            return transformed;
-          });
-
-          result = {
-            data: {
-              scores: transformedScores,
-              pagination: {
-                page: params.page,
-                limit: params.limit,
-                total: count || 0,
-                totalPages: Math.ceil((count || 0) / params.limit),
-              },
-            },
-            error: null,
-          };
-        }
-        break;
-
-      case "getMultiaccountInvestigation":
-        const { data: investigatedUser, error: investigatedUserError } =
-          await supabase
-            .from("profiles")
-            .select(MULTIACCOUNT_PROFILE_SELECT)
-            .eq("id", params.userId)
-            .maybeSingle();
-
-        if (investigatedUserError) {
-          result = { error: investigatedUserError, data: null };
-          break;
-        }
-
-        if (!investigatedUser) {
-          result = {
-            error: { message: "User not found" },
-            data: null,
-          };
-          break;
-        }
-
-        const { data: investigatedUserHwids, error: investigatedUserHwidsError } =
-          await supabase
-            .from("user_hwids")
-            .select("id, hwid, created_at")
-            .eq("id", params.userId)
-            .order("created_at", { ascending: false });
-
-        if (investigatedUserHwidsError) {
-          result = { error: investigatedUserHwidsError, data: null };
-          break;
-        }
-
-        const targetRows = investigatedUserHwids || [];
-        const uniqueHwids = Array.from(
-          new Set(targetRows.map((row) => row.hwid).filter(Boolean))
-        );
-
-        const dateRange: InvestigationDateRange = {
-          firstSeenAt: null,
-          lastSeenAt: null,
-        };
-
-        const hwidAggregates = new Map<
-          string,
-          InvestigationDateRange & {
-            hwid: string;
-            occurrences: number;
-            linkedProfiles: Map<number, LinkedProfileAggregate>;
-          }
-        >();
-
-        for (const row of targetRows) {
-          updateDateRange(dateRange, row.created_at);
-
-          const existing = hwidAggregates.get(row.hwid) || {
-            hwid: row.hwid,
-            occurrences: 0,
-            firstSeenAt: null,
-            lastSeenAt: null,
-            linkedProfiles: new Map<number, LinkedProfileAggregate>(),
-          };
-
-          existing.occurrences += 1;
-          updateDateRange(existing, row.created_at);
-          hwidAggregates.set(row.hwid, existing);
-        }
-
-        if (uniqueHwids.length === 0) {
-          result = {
-            data: {
-              user: investigatedUser,
-              summary: {
-                totalRows: 0,
-                uniqueHwids: 0,
-                sharedHwids: 0,
-                linkedAccounts: 0,
-                firstSeenAt: null,
-                lastSeenAt: null,
-              },
-              accounts: [],
-              hwids: [],
-            },
-            error: null,
-          };
-          break;
-        }
-
-        const { data: relatedRows, error: relatedRowsError } = await supabase
-          .from("user_hwids")
-          .select("id, hwid, created_at")
-          .in("hwid", uniqueHwids)
-          .order("created_at", { ascending: false });
-
-        if (relatedRowsError) {
-          result = { error: relatedRowsError, data: null };
-          break;
-        }
-
-        const relatedProfileIds = Array.from(
-          new Set(
-            (relatedRows || [])
-              .map((row) => row.id)
-              .filter((id) => id !== params.userId)
-          )
-        );
-
-        const { data: relatedProfiles, error: relatedProfilesError } =
-          relatedProfileIds.length > 0
-            ? await supabase
-                .from("profiles")
-                .select(MULTIACCOUNT_PROFILE_SELECT)
-                .in("id", relatedProfileIds)
-            : { data: [], error: null };
-
-        if (relatedProfilesError) {
-          result = { error: relatedProfilesError, data: null };
-          break;
-        }
-
-        const profileMap = new Map<number, AdminProfileSummary>([
-          [investigatedUser.id, investigatedUser],
-          ...((relatedProfiles || []) as AdminProfileSummary[]).map((profile) => [
-            profile.id,
-            profile,
-          ]),
-        ]);
-
-        const linkedAccountAggregates = new Map<number, LinkedAccountAggregate>();
-
-        for (const row of relatedRows || []) {
-          if (row.id === params.userId) {
-            continue;
-          }
-
-          const hwidAggregate = hwidAggregates.get(row.hwid);
-          const relatedProfile = profileMap.get(row.id);
-
-          if (!hwidAggregate || !relatedProfile) {
-            continue;
-          }
-
-          const linkedProfile =
-            hwidAggregate.linkedProfiles.get(row.id) || {
-              ...relatedProfile,
-              occurrences: 0,
-              firstSeenAt: null,
-              lastSeenAt: null,
-            };
-
-          linkedProfile.occurrences += 1;
-          updateDateRange(linkedProfile, row.created_at);
-          hwidAggregate.linkedProfiles.set(row.id, linkedProfile);
-
-          const linkedAccount = linkedAccountAggregates.get(row.id) || {
-            ...relatedProfile,
-            occurrences: 0,
-            sharedHwids: new Set<string>(),
-            firstSeenAt: null,
-            lastSeenAt: null,
-          };
-
-          linkedAccount.occurrences += 1;
-          linkedAccount.sharedHwids.add(row.hwid);
-          updateDateRange(linkedAccount, row.created_at);
-          linkedAccountAggregates.set(row.id, linkedAccount);
-        }
-
-        const accounts = Array.from(linkedAccountAggregates.values())
-          .map((account) => ({
-            ...account,
-            sharedHwids: Array.from(account.sharedHwids).sort(),
-            sharedHwidCount: account.sharedHwids.size,
-          }))
-          .sort((a, b) => {
-            if (b.sharedHwidCount !== a.sharedHwidCount) {
-              return b.sharedHwidCount - a.sharedHwidCount;
-            }
-
-            if (b.occurrences !== a.occurrences) {
-              return b.occurrences - a.occurrences;
-            }
-
-            return timestampOrZero(b.lastSeenAt) - timestampOrZero(a.lastSeenAt);
-          });
-
-        const hwids = Array.from(hwidAggregates.values())
-          .map((aggregate) => ({
-            hwid: aggregate.hwid,
-            occurrences: aggregate.occurrences,
-            firstSeenAt: aggregate.firstSeenAt,
-            lastSeenAt: aggregate.lastSeenAt,
-            linkedAccountCount: aggregate.linkedProfiles.size,
-            linkedProfiles: Array.from(aggregate.linkedProfiles.values()).sort(
-              (a, b) => {
-                if (b.occurrences !== a.occurrences) {
-                  return b.occurrences - a.occurrences;
-                }
-
-                return (
-                  timestampOrZero(b.lastSeenAt) - timestampOrZero(a.lastSeenAt)
-                );
-              }
-            ),
-          }))
-          .sort((a, b) => {
-            if (b.linkedAccountCount !== a.linkedAccountCount) {
-              return b.linkedAccountCount - a.linkedAccountCount;
-            }
-
-            if (b.occurrences !== a.occurrences) {
-              return b.occurrences - a.occurrences;
-            }
-
-            return timestampOrZero(b.lastSeenAt) - timestampOrZero(a.lastSeenAt);
-          });
-
-        result = {
-          data: {
-            user: investigatedUser,
-            summary: {
-              totalRows: targetRows.length,
-              uniqueHwids: uniqueHwids.length,
-              sharedHwids: hwids.filter((hwid) => hwid.linkedAccountCount > 0)
-                .length,
-              linkedAccounts: accounts.length,
-              firstSeenAt: dateRange.firstSeenAt,
-              lastSeenAt: dateRange.lastSeenAt,
-            },
-            accounts,
-            hwids,
-          },
-          error: null,
-        };
-        break;
-    }
-
-    // Log the admin action
-    await supabase.rpc("admin_log_action", {
-      admin_id: queryUserData.id,
-      action_type: operation,
-      target_id: "userId" in params ? params.userId : null,
-      details: { params },
-    });
-
-    if (result?.error) {
-      return NextResponse.json(
-        {
-          success: false,
-          error: result.error.message,
-        },
-        { status: 500 }
-      );
-    }
-
-    if (
-      targetUserId !== null &&
-      !result?.error &&
-      !SCORE_CACHE_READ_OPERATIONS.has(operation)
-    ) {
-      await invalidateCachePrefix(`userscore:${targetUserId}`);
-    }
-
-    return NextResponse.json({
-      success: true,
-      result: result?.data,
-    });
-  } catch (err: any) {
-    return NextResponse.json(
-      {
-        success: false,
-        error: err.message || "An error occurred during the operation",
-      },
-      { status: 500 }
-    );
-  }
-}
+import { NextResponse } from "../utils/response";
+import z from "zod";
+import { Database } from "../types/database";
+import { protectedApi } from "../utils/requestUtils";
+import { supabase } from "../utils/supabase";
+import { getUserBySession } from "../utils/getUserBySession";
+import { User } from "@supabase/supabase-js";
+import { invalidateCachePrefix } from "../utils/cache";
+import { normalizeProfileUpdateData } from "../utils/profileUpdateValidation";
+import { getRedis } from "../utils/redis";
+import { parseReplaySubmitData } from "../utils/rhrReplay";
+import { submitScoreForUser } from "./submitScoreInternal";
+
+type AdminProfileSummary = Pick<
+  Database["public"]["Tables"]["profiles"]["Row"],
+  "id" | "username" | "avatar_url" | "flag" | "badges" | "ban"
+>;
+
+type InvestigationDateRange = {
+  firstSeenAt: string | null;
+  lastSeenAt: string | null;
+};
+
+type LinkedAccountAggregate = AdminProfileSummary &
+  InvestigationDateRange & {
+    occurrences: number;
+    sharedHwids: Set<string>;
+  };
+
+type LinkedProfileAggregate = AdminProfileSummary &
+  InvestigationDateRange & {
+    occurrences: number;
+  };
+
+const MULTIACCOUNT_PROFILE_SELECT =
+  "id, username, avatar_url, flag, badges, ban";
+
+const ADMIN_READ_OPERATIONS = new Set([
+  "searchUsers",
+  "getScoresPaginated",
+  "getFriendLinks",
+  "getMultiaccountInvestigation",
+  "getModeratedUsersPaginated",
+]);
+
+function clampWebhookText(value: string, maxLength: number) {
+  const sanitized = value.replace(/[\u0000-\u001F\u007F]/g, "");
+  return sanitized.length <= maxLength
+    ? sanitized
+    : `${sanitized.slice(0, maxLength - 3)}...`;
+}
+
+function getAdminActionDetails(operation: string, params: any) {
+  return operation === "addScoreViaReplay"
+    ? { userId: params.userId, replayBytes: "<Long>" }
+    : params;
+}
+
+async function postStaffAdminWebhook({
+  admin,
+  operation,
+  targetUserId,
+  details,
+  error,
+}: {
+  admin: Database["public"]["Tables"]["profiles"]["Row"];
+  operation: string;
+  targetUserId: number | null;
+  details: any;
+  error?: string;
+}) {
+  const webhookUrl = process.env.WEBHOOK_STAFF_DISCORD;
+  if (!webhookUrl) {
+    console.log("WEBHOOK_STAFF_DISCORD is not configured");
+    return;
+  }
+
+  try {
+    const adminName = admin.username || `User #${admin.id}`;
+    const payload = {
+      content: `Admin action: ${operation}`,
+      embeds: [
+        {
+          title: "Admin Action",
+          color: error ? 0xe74c3c : 0x3498db,
+          fields: [
+            {
+              name: "Moderator",
+              value: clampWebhookText(`${adminName} (#${admin.id})`, 1024),
+              inline: true,
+            },
+            {
+              name: "Action",
+              value: clampWebhookText(operation, 1024),
+              inline: true,
+            },
+            {
+              name: "Target",
+              value: targetUserId === null ? "-" : `#${targetUserId}`,
+              inline: true,
+            },
+            {
+              name: "Status",
+              value: error ? `Failed: ${clampWebhookText(error, 900)}` : "Succeeded",
+            },
+            {
+              name: "Details",
+              value: clampWebhookText(JSON.stringify(details), 1024) || "-",
+            },
+          ],
+          footer: {
+            text: new Date().toUTCString(),
+          },
+        },
+      ],
+    };
+
+    const response = await fetch(webhookUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify(payload),
+    });
+
+    if (!response.ok) {
+      const responseBody = await response.text();
+      console.log("Staff admin webhook failed", {
+        operation,
+        status: response.status,
+        statusText: response.statusText,
+        responseBody: clampWebhookText(responseBody || "-", 4000),
+      });
+    }
+  } catch (error) {
+    console.log("Failed to post staff admin webhook", error);
+  }
+}
+
+function timestampOrZero(value: string | null) {
+  return value ? new Date(value).getTime() : 0;
+}
+
+function updateDateRange(
+  range: InvestigationDateRange,
+  createdAt: string | null
+) {
+  if (!createdAt) {
+    return;
+  }
+
+  if (!range.firstSeenAt || createdAt < range.firstSeenAt) {
+    range.firstSeenAt = createdAt;
+  }
+
+  if (!range.lastSeenAt || createdAt > range.lastSeenAt) {
+    range.lastSeenAt = createdAt;
+  }
+}
+
+// Define supported admin operations and their parameter types
+const adminOperations = {
+  deleteUser: z.object({ userId: z.number() }),
+  updateProfile: z.object({
+    userId: z.number(),
+    avatar_url: z.string().optional(),
+    flag: z.string().optional(),
+    profile_image: z.string().optional(),
+    username: z.string().optional(),
+    verified: z.boolean().optional(),
+  }),
+  changeFlag: z.object({ userId: z.number(), flag: z.string() }),
+  changeBadges: z.object({ userId: z.number(), badges: z.array(z.string()) }),
+  addBadge: z.object({ userId: z.number(), badge: z.string() }),
+  removeBadge: z.object({ userId: z.number(), badge: z.string() }),
+  excludeUser: z.object({ userId: z.number(), reason: z.string() }),
+  restrictUser: z.object({ userId: z.number(), reason: z.string() }),
+  silenceUser: z.object({ userId: z.number(), expiresAt: z.string(), reason: z.string() }),
+  profanityClear: z.object({ userId: z.number() }),
+  searchUsers: z.object({ searchText: z.string() }),
+  getFriendLinks: z.object({ userId: z.number() }),
+  removeAllScores: z.object({ userId: z.number() }),
+  removeScore: z.object({ userId: z.number(), scoreId: z.number() }),
+  addScoreViaReplay: z.object({ userId: z.number(), replayBytes: z.string() }),
+  invalidateRankedScores: z.object({ userId: z.number() }),
+  unbanUser: z.object({ userId: z.number() }),
+  getModeratedUsersPaginated: z.object({
+    page: z.number().min(1).default(1),
+    limit: z.number().min(1).max(100).default(25),
+  }),
+  getScoresPaginated: z.object({
+    page: z.number().min(1).default(1),
+    limit: z.number().min(1).max(100).default(50),
+    userId: z.number().optional(),
+    includeAdditionalData: z.boolean().default(true),
+  }),
+  getMultiaccountInvestigation: z.object({ userId: z.number() }),
+} as const;
+
+// Create a discriminated union type for operation parameters
+const OperationParam = z.discriminatedUnion("operation", [
+  z.object({
+    operation: z.literal("deleteUser"),
+    params: adminOperations.deleteUser,
+  }),
+  z.object({
+    operation: z.literal("excludeUser"),
+    params: adminOperations.excludeUser,
+  }),
+  z.object({
+    operation: z.literal("restrictUser"),
+    params: adminOperations.restrictUser,
+  }),
+  z.object({
+    operation: z.literal("silenceUser"),
+    params: adminOperations.silenceUser,
+  }),
+  z.object({
+    operation: z.literal("searchUsers"),
+    params: adminOperations.searchUsers,
+  }),
+  z.object({
+    operation: z.literal("profanityClear"),
+    params: adminOperations.profanityClear,
+  }),
+  z.object({
+    operation: z.literal("removeAllScores"),
+    params: adminOperations.removeAllScores,
+  }),
+  z.object({
+    operation: z.literal("invalidateRankedScores"),
+    params: adminOperations.invalidateRankedScores,
+  }),
+  z.object({
+    operation: z.literal("unbanUser"),
+    params: adminOperations.unbanUser,
+  }),
+  z.object({
+    operation: z.literal("updateProfile"),
+    params: adminOperations.updateProfile,
+  }),
+  z.object({
+    operation: z.literal("changeFlag"),
+    params: adminOperations.changeFlag,
+  }),
+  z.object({
+    operation: z.literal("changeBadges"),
+    params: adminOperations.changeBadges,
+  }),
+  z.object({
+    operation: z.literal("addBadge"),
+    params: adminOperations.addBadge,
+  }),
+  z.object({
+    operation: z.literal("removeBadge"),
+    params: adminOperations.removeBadge,
+  }),
+  z.object({
+    operation: z.literal("getFriendLinks"),
+    params: adminOperations.getFriendLinks,
+  }),
+  z.object({
+    operation: z.literal("removeScore"),
+    params: adminOperations.removeScore,
+  }),
+  z.object({
+    operation: z.literal("addScoreViaReplay"),
+    params: adminOperations.addScoreViaReplay,
+  }),
+  z.object({
+    operation: z.literal("getModeratedUsersPaginated"),
+    params: adminOperations.getModeratedUsersPaginated,
+  }),
+  z.object({
+    operation: z.literal("getScoresPaginated"),
+    params: adminOperations.getScoresPaginated,
+  }),
+  z.object({
+    operation: z.literal("getMultiaccountInvestigation"),
+    params: adminOperations.getMultiaccountInvestigation,
+  }),
+]);
+
+export const Schema = {
+  input: z.strictObject({
+    session: z.string(),
+    data: OperationParam,
+  }),
+  output: z.object({
+    success: z.boolean(),
+    result: z.any().optional(),
+    error: z.string().optional(),
+  }),
+};
+
+export const ExpiresNever = new Date(99999999999999).toISOString();
+
+async function publishUserAction(userId: number, reason: string, type: string, expiresAt: string, moderatedBy: number) {
+  try {
+    const redis = await getRedis();
+    await redis.publish("user_actions", JSON.stringify({
+      userId,
+      reason,
+      type,
+      expiresAt,
+      moderatedBy
+    }));
+  }
+  catch (e) {
+    console.error("Failed to publish user action: " + e);
+  }
+}
+
+export async function POST(request: Request): Promise<NextResponse> {
+  return protectedApi({
+    request,
+    schema: Schema,
+    authorization: () => { },
+    activity: handler,
+  });
+}
+
+export async function handler(
+  data: (typeof Schema)["input"]["_type"]
+): Promise<NextResponse<(typeof Schema)["output"]["_type"]>> {
+  // Get user from session
+  const user = (await getUserBySession(data.session)) as User;
+
+  // Get user's profile data
+  const { data: queryUserData, error: userError } = await supabase
+    .from("profiles")
+    .select("*")
+    .eq("uid", user.id)
+    .single();
+
+  if (userError || !queryUserData) {
+    return NextResponse.json(
+      {
+        success: false,
+        error: "User cannot be retrieved from session",
+      },
+      { status: 404 }
+    );
+  }
+  const tags = (queryUserData?.badges || []) as string[];
+  // Check if user has "Global Moderator" badge
+  const isGlobalModerator = tags.includes("Global Moderator");
+
+  if (!isGlobalModerator) {
+    return NextResponse.json(
+      {
+        success: false,
+        error: "Unauthorized. Only Global Moderators can perform this action.",
+      },
+      { status: 403 }
+    );
+  }
+
+  // Execute the requested admin operation
+  try {
+    let result: { data?: any; error?: any } | null = null;
+    const operation = data.data.operation;
+    const params = data.data.params as any;
+
+    const targetUserId =
+      "userId" in params && typeof params.userId === "number"
+        ? params.userId
+        : null;
+
+    switch (operation) {
+      case "deleteUser":
+        result = await supabase.rpc("admin_delete_user", {
+          user_id: params.userId,
+        });
+        break;
+
+      case "excludeUser":
+        await publishUserAction(params.userId, params.reason, "excluded", ExpiresNever, queryUserData.id);
+        result = await supabase.rpc("admin_exclude_user", {
+          user_id: params.userId,
+        });
+        break;
+
+      case "restrictUser":
+        await publishUserAction(params.userId, params.reason, "restricted", ExpiresNever, queryUserData.id);
+        result = await supabase.rpc("admin_restrict_user", {
+          user_id: params.userId,
+        });
+        break;
+
+      case "silenceUser":
+        await publishUserAction(params.userId, params.reason, "silenced", params.expiresAt, queryUserData.id);
+        result = await supabase.rpc("admin_silence_user", {
+          user_id: params.userId,
+        });
+        break;
+
+      case "searchUsers":
+        result = await supabase.rpc("admin_search_users", {
+          search_text: params.searchText,
+        });
+        break;
+
+      case "profanityClear":
+        result = await supabase.rpc("admin_profanity_clear", {
+          user_id: params.userId,
+        });
+        break;
+
+      case "removeAllScores":
+        result = await supabase.rpc("admin_remove_all_scores", {
+          user_id: params.userId,
+        });
+        break;
+
+      case "invalidateRankedScores":
+        result = await supabase.rpc("admin_invalidate_ranked_scores", {
+          user_id: params.userId,
+        });
+        break;
+
+      case "unbanUser":
+        result = await supabase.rpc("admin_unban_user", {
+          user_id: params.userId,
+        });
+        break;
+
+      case "updateProfile":
+        const profileData: {
+          avatar_url?: string;
+          flag?: string;
+          profile_image?: string;
+          username?: string;
+          verified?: boolean;
+        } = {};
+
+        if (params.avatar_url !== undefined) profileData.avatar_url = params.avatar_url;
+        if (params.flag !== undefined) profileData.flag = params.flag;
+        if (params.profile_image !== undefined) {
+          profileData.profile_image = params.profile_image;
+        }
+        if (params.username !== undefined) profileData.username = params.username;
+        if (params.verified !== undefined) profileData.verified = params.verified;
+
+        const profileValidationError = normalizeProfileUpdateData(profileData);
+
+        if (profileValidationError) {
+          result = {
+            data: null,
+            error: { message: profileValidationError },
+          };
+          break;
+        }
+
+        result = await supabase.rpc("admin_update_profile", {
+          user_id: params.userId,
+          profile_data: profileData,
+        });
+        break;
+
+      case "changeFlag":
+        const flagData = { flag: params.flag };
+        const flagValidationError = normalizeProfileUpdateData(flagData);
+
+        if (flagValidationError) {
+          result = { data: null, error: { message: flagValidationError } };
+          break;
+        }
+
+        result = await supabase.rpc("admin_update_profile", {
+          user_id: params.userId,
+          profile_data: flagData,
+        });
+        break;
+      case "changeBadges":
+        // Allow only developers to modify badges.
+        if ((queryUserData.badges as string[]).includes("Developer")) {
+          result = await supabase
+            .from("profiles")
+            .upsert({
+              id: params.userId,
+              badges: params.badges,
+            })
+            .select();
+        } else {
+          result = { data: null, error: { message: "Unauthorized" } };
+        }
+        break;
+
+      case "addBadge":
+        // Allow only developers to modify badges.
+        if ((queryUserData.badges as string[]).includes("Developer")) {
+          // Get current badges
+          const { data: targetUser } = await supabase
+            .from("profiles")
+            .select("badges")
+            .eq("id", params.userId)
+            .single();
+
+          const currentBadges = (targetUser?.badges || []) as string[];
+          if (!currentBadges.includes(params.badge)) {
+            currentBadges.push(params.badge);
+            result = await supabase
+              .from("profiles")
+              .upsert({
+                id: params.userId,
+                badges: currentBadges,
+              })
+              .select();
+          } else {
+            result = { data: targetUser, error: null };
+          }
+        } else {
+          result = { data: null, error: { message: "Unauthorized" } };
+        }
+        break;
+
+      case "removeBadge":
+        // Allow only developers to modify badges.
+        if ((queryUserData.badges as string[]).includes("Developer")) {
+          // Get current badges
+          const { data: targetUser } = await supabase
+            .from("profiles")
+            .select("badges")
+            .eq("id", params.userId)
+            .single();
+
+          const currentBadges = (targetUser?.badges || []) as string[];
+          const updatedBadges = currentBadges.filter(b => b !== params.badge);
+
+          result = await supabase
+            .from("profiles")
+            .upsert({
+              id: params.userId,
+              badges: updatedBadges,
+            })
+            .select();
+        } else {
+          result = { data: null, error: { message: "Unauthorized" } };
+        }
+        break;
+
+      case "getFriendLinks":
+        const [
+          { data: outgoingRows, error: outgoingError },
+          { data: incomingRows, error: incomingError },
+        ] = await Promise.all([
+          supabase
+            .from("profileFriends")
+            .select("profile_id,friend_id,created_at")
+            .eq("profile_id", params.userId)
+            .order("created_at", { ascending: false }),
+          supabase
+            .from("profileFriends")
+            .select("profile_id,friend_id,created_at")
+            .eq("friend_id", params.userId)
+            .order("created_at", { ascending: false }),
+        ]);
+
+        if (outgoingError || incomingError) {
+          result = { data: null, error: outgoingError || incomingError };
+          break;
+        }
+
+        const friendProfileIds = Array.from(
+          new Set([
+            ...((outgoingRows || []).map((row) => row.friend_id) || []),
+            ...((incomingRows || []).map((row) => row.profile_id) || []),
+          ])
+        );
+
+        const { data: friendProfiles, error: friendProfilesError } =
+          friendProfileIds.length > 0
+            ? await supabase
+              .from("profiles")
+              .select("id,username,avatar_url,flag")
+              .in("id", friendProfileIds)
+            : { data: [], error: null };
+
+        if (friendProfilesError) {
+          result = { data: null, error: friendProfilesError };
+          break;
+        }
+
+        const friendProfileMap = new Map(
+          (friendProfiles || []).map((profile) => [profile.id, profile])
+        );
+        const mapFriendLink = (profileId: number, createdAt: string) => {
+          const profile = friendProfileMap.get(profileId);
+          return profile ? { ...profile, created_at: createdAt } : null;
+        };
+
+        result = {
+          data: {
+            friends: (outgoingRows || [])
+              .map((row) => mapFriendLink(row.friend_id, row.created_at))
+              .filter(Boolean),
+            friendedBy: (incomingRows || [])
+              .map((row) => mapFriendLink(row.profile_id, row.created_at))
+              .filter(Boolean),
+          },
+          error: null,
+        };
+        break;
+
+      case "removeScore":
+        result = await supabase.rpc("admin_remove_score", {
+          user_id: params.userId,
+          score_id: params.scoreId,
+        });
+
+        if (!result.error && result.data !== true) {
+          result = { data: null, error: { message: "Score not found" } };
+        }
+        break;
+
+      case "addScoreViaReplay":
+        const { data: scoreUser, error: scoreUserError } = await supabase
+          .from("profiles")
+          .select("*")
+          .eq("id", params.userId)
+          .single();
+
+        if (scoreUserError || !scoreUser) {
+          result = {
+            data: null,
+            error: { message: "User not found" },
+          };
+          break;
+        }
+
+        const scoreResponse = await submitScoreForUser(
+          parseReplaySubmitData(Buffer.from(params.replayBytes, "base64")),
+          scoreUser,
+          scoreUser.uid || String(scoreUser.id),
+          null
+        );
+        const scoreResult = (await scoreResponse.json()) as { error?: string };
+        result =
+          scoreResponse.status >= 400 || scoreResult.error
+            ? {
+              data: null,
+              error: { message: scoreResult.error || "Failed to add score" },
+            }
+            : { data: scoreResult, error: null };
+        break;
+
+      case "getModeratedUsersPaginated":
+        const moderatedOffset = (params.page - 1) * params.limit;
+        const {
+          data: moderatedUsers,
+          error: moderatedUsersError,
+          count: moderatedUsersCount,
+        } = await supabase
+          .from("profiles")
+          .select(
+            "id,username,avatar_url,flag,ban,bannedAt,skill_points,play_count,created_at",
+            { count: "exact" }
+          )
+          .in("ban", ["excluded", "restricted", "silenced"])
+          .order("bannedAt", { ascending: false, nullsFirst: false })
+          .order("id", { ascending: false })
+          .range(moderatedOffset, moderatedOffset + params.limit - 1);
+
+        result = moderatedUsersError
+          ? { error: moderatedUsersError, data: null }
+          : {
+            data: {
+              users: moderatedUsers || [],
+              pagination: {
+                page: params.page,
+                limit: params.limit,
+                total: moderatedUsersCount || 0,
+                totalPages: Math.ceil(
+                  (moderatedUsersCount || 0) / params.limit
+                ),
+              },
+            },
+            error: null,
+          };
+        break;
+
+      case "getScoresPaginated":
+        const offset = (params.page - 1) * params.limit;
+        let query = supabase
+          .from("scores")
+          .select(
+            `
+            id,
+            awarded_sp,
+            userId,
+            additional_data,
+            profiles (
+              username
+            )
+          `,
+            { count: "exact" }
+          )
+          .eq("passed", true)
+          .order("created_at", { ascending: false })
+          .range(offset, offset + params.limit - 1);
+
+        if (params.userId) {
+          query = query.eq("userId", params.userId);
+        }
+
+        const { data: scoresData, error: scoresError, count } = await query;
+
+        if (scoresError) {
+          result = { error: scoresError, data: null };
+        } else {
+          const transformedScores = scoresData?.map((score) => {
+            const transformed: any = {
+              id: score.id,
+              awarded_sp: score.awarded_sp,
+              userId: score.userId,
+              username: score.profiles?.username || null,
+            };
+
+            if (params.includeAdditionalData) {
+              transformed.additional_data = score.additional_data;
+            }
+
+            return transformed;
+          });
+
+          result = {
+            data: {
+              scores: transformedScores,
+              pagination: {
+                page: params.page,
+                limit: params.limit,
+                total: count || 0,
+                totalPages: Math.ceil((count || 0) / params.limit),
+              },
+            },
+            error: null,
+          };
+        }
+        break;
+
+      case "getMultiaccountInvestigation":
+        const { data: investigatedUser, error: investigatedUserError } =
+          await supabase
+            .from("profiles")
+            .select(MULTIACCOUNT_PROFILE_SELECT)
+            .eq("id", params.userId)
+            .maybeSingle();
+
+        if (investigatedUserError) {
+          result = { error: investigatedUserError, data: null };
+          break;
+        }
+
+        if (!investigatedUser) {
+          result = {
+            error: { message: "User not found" },
+            data: null,
+          };
+          break;
+        }
+
+        const { data: investigatedUserHwids, error: investigatedUserHwidsError } =
+          await supabase
+            .from("user_hwids")
+            .select("id, hwid, created_at")
+            .eq("id", params.userId)
+            .order("created_at", { ascending: false });
+
+        if (investigatedUserHwidsError) {
+          result = { error: investigatedUserHwidsError, data: null };
+          break;
+        }
+
+        const targetRows = investigatedUserHwids || [];
+        const uniqueHwids = Array.from(
+          new Set(targetRows.map((row) => row.hwid).filter(Boolean))
+        );
+
+        const dateRange: InvestigationDateRange = {
+          firstSeenAt: null,
+          lastSeenAt: null,
+        };
+
+        const hwidAggregates = new Map<
+          string,
+          InvestigationDateRange & {
+            hwid: string;
+            occurrences: number;
+            linkedProfiles: Map<number, LinkedProfileAggregate>;
+          }
+        >();
+
+        for (const row of targetRows) {
+          updateDateRange(dateRange, row.created_at);
+
+          const existing = hwidAggregates.get(row.hwid) || {
+            hwid: row.hwid,
+            occurrences: 0,
+            firstSeenAt: null,
+            lastSeenAt: null,
+            linkedProfiles: new Map<number, LinkedProfileAggregate>(),
+          };
+
+          existing.occurrences += 1;
+          updateDateRange(existing, row.created_at);
+          hwidAggregates.set(row.hwid, existing);
+        }
+
+        if (uniqueHwids.length === 0) {
+          result = {
+            data: {
+              user: investigatedUser,
+              summary: {
+                totalRows: 0,
+                uniqueHwids: 0,
+                sharedHwids: 0,
+                linkedAccounts: 0,
+                firstSeenAt: null,
+                lastSeenAt: null,
+              },
+              accounts: [],
+              hwids: [],
+            },
+            error: null,
+          };
+          break;
+        }
+
+        const { data: relatedRows, error: relatedRowsError } = await supabase
+          .from("user_hwids")
+          .select("id, hwid, created_at")
+          .in("hwid", uniqueHwids)
+          .order("created_at", { ascending: false });
+
+        if (relatedRowsError) {
+          result = { error: relatedRowsError, data: null };
+          break;
+        }
+
+        const relatedProfileIds = Array.from(
+          new Set(
+            (relatedRows || [])
+              .map((row) => row.id)
+              .filter((id) => id !== params.userId)
+          )
+        );
+
+        const { data: relatedProfiles, error: relatedProfilesError } =
+          relatedProfileIds.length > 0
+            ? await supabase
+              .from("profiles")
+              .select(MULTIACCOUNT_PROFILE_SELECT)
+              .in("id", relatedProfileIds)
+            : { data: [], error: null };
+
+        if (relatedProfilesError) {
+          result = { error: relatedProfilesError, data: null };
+          break;
+        }
+
+        const profileMap = new Map<number, AdminProfileSummary>([
+          [investigatedUser.id, investigatedUser],
+          ...((relatedProfiles || []) as AdminProfileSummary[]).map((profile) => [
+            profile.id,
+            profile,
+          ]),
+        ]);
+
+        const linkedAccountAggregates = new Map<number, LinkedAccountAggregate>();
+
+        for (const row of relatedRows || []) {
+          if (row.id === params.userId) {
+            continue;
+          }
+
+          const hwidAggregate = hwidAggregates.get(row.hwid);
+          const relatedProfile = profileMap.get(row.id);
+
+          if (!hwidAggregate || !relatedProfile) {
+            continue;
+          }
+
+          const linkedProfile =
+            hwidAggregate.linkedProfiles.get(row.id) || {
+              ...relatedProfile,
+              occurrences: 0,
+              firstSeenAt: null,
+              lastSeenAt: null,
+            };
+
+          linkedProfile.occurrences += 1;
+          updateDateRange(linkedProfile, row.created_at);
+          hwidAggregate.linkedProfiles.set(row.id, linkedProfile);
+
+          const linkedAccount = linkedAccountAggregates.get(row.id) || {
+            ...relatedProfile,
+            occurrences: 0,
+            sharedHwids: new Set<string>(),
+            firstSeenAt: null,
+            lastSeenAt: null,
+          };
+
+          linkedAccount.occurrences += 1;
+          linkedAccount.sharedHwids.add(row.hwid);
+          updateDateRange(linkedAccount, row.created_at);
+          linkedAccountAggregates.set(row.id, linkedAccount);
+        }
+
+        const accounts = Array.from(linkedAccountAggregates.values())
+          .map((account) => ({
+            ...account,
+            sharedHwids: Array.from(account.sharedHwids).sort(),
+            sharedHwidCount: account.sharedHwids.size,
+          }))
+          .sort((a, b) => {
+            if (b.sharedHwidCount !== a.sharedHwidCount) {
+              return b.sharedHwidCount - a.sharedHwidCount;
+            }
+
+            if (b.occurrences !== a.occurrences) {
+              return b.occurrences - a.occurrences;
+            }
+
+            return timestampOrZero(b.lastSeenAt) - timestampOrZero(a.lastSeenAt);
+          });
+
+        const hwids = Array.from(hwidAggregates.values())
+          .map((aggregate) => ({
+            hwid: aggregate.hwid,
+            occurrences: aggregate.occurrences,
+            firstSeenAt: aggregate.firstSeenAt,
+            lastSeenAt: aggregate.lastSeenAt,
+            linkedAccountCount: aggregate.linkedProfiles.size,
+            linkedProfiles: Array.from(aggregate.linkedProfiles.values()).sort(
+              (a, b) => {
+                if (b.occurrences !== a.occurrences) {
+                  return b.occurrences - a.occurrences;
+                }
+
+                return (
+                  timestampOrZero(b.lastSeenAt) - timestampOrZero(a.lastSeenAt)
+                );
+              }
+            ),
+          }))
+          .sort((a, b) => {
+            if (b.linkedAccountCount !== a.linkedAccountCount) {
+              return b.linkedAccountCount - a.linkedAccountCount;
+            }
+
+            if (b.occurrences !== a.occurrences) {
+              return b.occurrences - a.occurrences;
+            }
+
+            return timestampOrZero(b.lastSeenAt) - timestampOrZero(a.lastSeenAt);
+          });
+
+        result = {
+          data: {
+            user: investigatedUser,
+            summary: {
+              totalRows: targetRows.length,
+              uniqueHwids: uniqueHwids.length,
+              sharedHwids: hwids.filter((hwid) => hwid.linkedAccountCount > 0)
+                .length,
+              linkedAccounts: accounts.length,
+              firstSeenAt: dateRange.firstSeenAt,
+              lastSeenAt: dateRange.lastSeenAt,
+            },
+            accounts,
+            hwids,
+          },
+          error: null,
+        };
+        break;
+    }
+
+    const adminActionDetails = getAdminActionDetails(operation, params);
+
+    if (!ADMIN_READ_OPERATIONS.has(operation)) {
+      await postStaffAdminWebhook({
+        admin: queryUserData,
+        operation,
+        targetUserId,
+        details: adminActionDetails,
+        error: result?.error?.message,
+      });
+
+      // Log the admin action
+      await supabase.rpc("admin_log_action", {
+        admin_id: queryUserData.id,
+        action_type: operation,
+        target_id: "userId" in params ? params.userId : null,
+        details: { params: adminActionDetails },
+      });
+    }
+
+    if (result?.error) {
+      return NextResponse.json(
+        {
+          success: false,
+          error: result.error.message,
+        },
+        { status: 500 }
+      );
+    }
+
+    if (
+      targetUserId !== null &&
+      !result?.error &&
+      !ADMIN_READ_OPERATIONS.has(operation)
+    ) {
+      await invalidateCachePrefix(`userscore:${targetUserId}`);
+    }
+
+    return NextResponse.json({
+      success: true,
+      result: result?.data,
+    });
+  } catch (err: any) {
+    return NextResponse.json(
+      {
+        success: false,
+        error: err.message || "An error occurred during the operation",
+      },
+      { status: 500 }
+    );
+  }
+}