rhythia-api 243.0.0 → 244.0.0

package/api/executeAdminOperation.ts

@@ -1,1030 +1,1291 @@
-import { NextResponse } from "../utils/response";
-import z from "zod";
-import { Database } from "../types/database";
-import { protectedApi } from "../utils/requestUtils";
-import { supabase } from "../utils/supabase";
-import { getUserBySession } from "../utils/getUserBySession";
-import { User } from "@supabase/supabase-js";
-import { invalidateCachePrefix } from "../utils/cache";
-import { normalizeProfileUpdateData } from "../utils/profileUpdateValidation";
-import { getRedis } from "../utils/redis";
-import { parseReplaySubmitData } from "../utils/rhrReplay";
-import { submitScoreForUser } from "./submitScoreInternal";
-
-type AdminProfileSummary = Pick<
-  Database["public"]["Tables"]["profiles"]["Row"],
-  "id" | "username" | "avatar_url" | "flag" | "badges" | "ban"
->;
-
-type InvestigationDateRange = {
-  firstSeenAt: string | null;
-  lastSeenAt: string | null;
-};
-
-type LinkedAccountAggregate = AdminProfileSummary &
-  InvestigationDateRange & {
-    occurrences: number;
-    sharedHwids: Set<string>;
-  };
-
-type LinkedProfileAggregate = AdminProfileSummary &
-  InvestigationDateRange & {
-    occurrences: number;
-  };
-
-const MULTIACCOUNT_PROFILE_SELECT =
-  "id, username, avatar_url, flag, badges, ban";
-
-const ADMIN_READ_OPERATIONS = new Set([
-  "searchUsers",
-  "getScoresPaginated",
-  "getFriendLinks",
-  "getMultiaccountInvestigation",
-  "getModeratedUsersPaginated",
-]);
-
-function clampWebhookText(value: string, maxLength: number) {
-  const sanitized = value.replace(/[\u0000-\u001F\u007F]/g, "");
-  return sanitized.length <= maxLength
-    ? sanitized
-    : `${sanitized.slice(0, maxLength - 3)}...`;
-}
-
-function getAdminActionDetails(operation: string, params: any) {
-  return operation === "addScoreViaReplay"
-    ? { userId: params.userId, replayBytes: "<Long>" }
-    : params;
-}
-
-async function postStaffAdminWebhook({
-  admin,
-  operation,
-  targetUserId,
-  details,
-  error,
-}: {
-  admin: Database["public"]["Tables"]["profiles"]["Row"];
-  operation: string;
-  targetUserId: number | null;
-  details: any;
-  error?: string;
-}) {
-  const webhookUrl = process.env.WEBHOOK_STAFF_DISCORD;
-  if (!webhookUrl) {
-    console.log("WEBHOOK_STAFF_DISCORD is not configured");
-    return;
-  }
-
-  try {
-    const adminName = admin.username || `User #${admin.id}`;
-    const payload = {
-      content: `Admin action: ${operation}`,
-      embeds: [
-        {
-          title: "Admin Action",
-          color: error ? 0xe74c3c : 0x3498db,
-          fields: [
-            {
-              name: "Moderator",
-              value: clampWebhookText(`${adminName} (#${admin.id})`, 1024),
-              inline: true,
-            },
-            {
-              name: "Action",
-              value: clampWebhookText(operation, 1024),
-              inline: true,
-            },
-            {
-              name: "Target",
-              value: targetUserId === null ? "-" : `#${targetUserId}`,
-              inline: true,
-            },
-            {
-              name: "Status",
-              value: error ? `Failed: ${clampWebhookText(error, 900)}` : "Succeeded",
-            },
-            {
-              name: "Details",
-              value: clampWebhookText(JSON.stringify(details), 1024) || "-",
-            },
-          ],
-          footer: {
-            text: new Date().toUTCString(),
-          },
-        },
-      ],
-    };
-
-    const response = await fetch(webhookUrl, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-      },
-      body: JSON.stringify(payload),
-    });
-
-    if (!response.ok) {
-      const responseBody = await response.text();
-      console.log("Staff admin webhook failed", {
-        operation,
-        status: response.status,
-        statusText: response.statusText,
-        responseBody: clampWebhookText(responseBody || "-", 4000),
-      });
-    }
-  } catch (error) {
-    console.log("Failed to post staff admin webhook", error);
-  }
-}
-
-function timestampOrZero(value: string | null) {
-  return value ? new Date(value).getTime() : 0;
-}
-
-function updateDateRange(
-  range: InvestigationDateRange,
-  createdAt: string | null
-) {
-  if (!createdAt) {
-    return;
-  }
-
-  if (!range.firstSeenAt || createdAt < range.firstSeenAt) {
-    range.firstSeenAt = createdAt;
-  }
-
-  if (!range.lastSeenAt || createdAt > range.lastSeenAt) {
-    range.lastSeenAt = createdAt;
-  }
-}
-
-// Define supported admin operations and their parameter types
-const adminOperations = {
-  deleteUser: z.object({ userId: z.number() }),
-  updateProfile: z.object({
-    userId: z.number(),
-    avatar_url: z.string().optional(),
-    flag: z.string().optional(),
-    profile_image: z.string().optional(),
-    username: z.string().optional(),
-    verified: z.boolean().optional(),
-  }),
-  changeFlag: z.object({ userId: z.number(), flag: z.string() }),
-  changeBadges: z.object({ userId: z.number(), badges: z.array(z.string()) }),
-  addBadge: z.object({ userId: z.number(), badge: z.string() }),
-  removeBadge: z.object({ userId: z.number(), badge: z.string() }),
-  excludeUser: z.object({ userId: z.number(), reason: z.string() }),
-  restrictUser: z.object({ userId: z.number(), reason: z.string() }),
-  silenceUser: z.object({ userId: z.number(), expiresAt: z.string(), reason: z.string() }),
-  profanityClear: z.object({ userId: z.number() }),
-  searchUsers: z.object({ searchText: z.string() }),
-  getFriendLinks: z.object({ userId: z.number() }),
-  removeAllScores: z.object({ userId: z.number() }),
-  removeScore: z.object({ userId: z.number(), scoreId: z.number() }),
-  addScoreViaReplay: z.object({ userId: z.number(), replayBytes: z.string() }),
-  invalidateRankedScores: z.object({ userId: z.number() }),
-  unbanUser: z.object({ userId: z.number() }),
-  getModeratedUsersPaginated: z.object({
-    page: z.number().min(1).default(1),
-    limit: z.number().min(1).max(100).default(25),
-  }),
-  getScoresPaginated: z.object({
-    page: z.number().min(1).default(1),
-    limit: z.number().min(1).max(100).default(50),
-    userId: z.number().optional(),
-    includeAdditionalData: z.boolean().default(true),
-  }),
-  getMultiaccountInvestigation: z.object({ userId: z.number() }),
-} as const;
-
-// Create a discriminated union type for operation parameters
-const OperationParam = z.discriminatedUnion("operation", [
-  z.object({
-    operation: z.literal("deleteUser"),
-    params: adminOperations.deleteUser,
-  }),
-  z.object({
-    operation: z.literal("excludeUser"),
-    params: adminOperations.excludeUser,
-  }),
-  z.object({
-    operation: z.literal("restrictUser"),
-    params: adminOperations.restrictUser,
-  }),
-  z.object({
-    operation: z.literal("silenceUser"),
-    params: adminOperations.silenceUser,
-  }),
-  z.object({
-    operation: z.literal("searchUsers"),
-    params: adminOperations.searchUsers,
-  }),
-  z.object({
-    operation: z.literal("profanityClear"),
-    params: adminOperations.profanityClear,
-  }),
-  z.object({
-    operation: z.literal("removeAllScores"),
-    params: adminOperations.removeAllScores,
-  }),
-  z.object({
-    operation: z.literal("invalidateRankedScores"),
-    params: adminOperations.invalidateRankedScores,
-  }),
-  z.object({
-    operation: z.literal("unbanUser"),
-    params: adminOperations.unbanUser,
-  }),
-  z.object({
-    operation: z.literal("updateProfile"),
-    params: adminOperations.updateProfile,
-  }),
-  z.object({
-    operation: z.literal("changeFlag"),
-    params: adminOperations.changeFlag,
-  }),
-  z.object({
-    operation: z.literal("changeBadges"),
-    params: adminOperations.changeBadges,
-  }),
-  z.object({
-    operation: z.literal("addBadge"),
-    params: adminOperations.addBadge,
-  }),
-  z.object({
-    operation: z.literal("removeBadge"),
-    params: adminOperations.removeBadge,
-  }),
-  z.object({
-    operation: z.literal("getFriendLinks"),
-    params: adminOperations.getFriendLinks,
-  }),
-  z.object({
-    operation: z.literal("removeScore"),
-    params: adminOperations.removeScore,
-  }),
-  z.object({
-    operation: z.literal("addScoreViaReplay"),
-    params: adminOperations.addScoreViaReplay,
-  }),
-  z.object({
-    operation: z.literal("getModeratedUsersPaginated"),
-    params: adminOperations.getModeratedUsersPaginated,
-  }),
-  z.object({
-    operation: z.literal("getScoresPaginated"),
-    params: adminOperations.getScoresPaginated,
-  }),
-  z.object({
-    operation: z.literal("getMultiaccountInvestigation"),
-    params: adminOperations.getMultiaccountInvestigation,
-  }),
-]);
-
-export const Schema = {
-  input: z.strictObject({
-    session: z.string(),
-    data: OperationParam,
-  }),
-  output: z.object({
-    success: z.boolean(),
-    result: z.any().optional(),
-    error: z.string().optional(),
-  }),
-};
-
-export const ExpiresNever = new Date(99999999999999).toISOString();
-
-async function publishUserAction(userId: number, reason: string, type: string, expiresAt: string, moderatedBy: number) {
-  try {
-    const redis = await getRedis();
-    await redis.publish("user_actions", JSON.stringify({
-      userId,
-      reason,
-      type,
-      expiresAt,
-      moderatedBy
-    }));
-  }
-  catch (e) {
-    console.error("Failed to publish user action: " + e);
-  }
-}
-
-export async function POST(request: Request): Promise<NextResponse> {
-  return protectedApi({
-    request,
-    schema: Schema,
-    authorization: () => { },
-    activity: handler,
-  });
-}
-
-export async function handler(
-  data: (typeof Schema)["input"]["_type"]
-): Promise<NextResponse<(typeof Schema)["output"]["_type"]>> {
-  // Get user from session
-  const user = (await getUserBySession(data.session)) as User;
-
-  // Get user's profile data
-  const { data: queryUserData, error: userError } = await supabase
-    .from("profiles")
-    .select("*")
-    .eq("uid", user.id)
-    .single();
-
-  if (userError || !queryUserData) {
-    return NextResponse.json(
-      {
-        success: false,
-        error: "User cannot be retrieved from session",
-      },
-      { status: 404 }
-    );
-  }
-  const tags = (queryUserData?.badges || []) as string[];
-  // Check if user has "Global Moderator" badge
-  const isGlobalModerator = tags.includes("Global Moderator");
-
-  if (!isGlobalModerator) {
-    return NextResponse.json(
-      {
-        success: false,
-        error: "Unauthorized. Only Global Moderators can perform this action.",
-      },
-      { status: 403 }
-    );
-  }
-
-  // Execute the requested admin operation
-  try {
-    let result: { data?: any; error?: any } | null = null;
-    const operation = data.data.operation;
-    const params = data.data.params as any;
-
-    const targetUserId =
-      "userId" in params && typeof params.userId === "number"
-        ? params.userId
-        : null;
-
-    switch (operation) {
-      case "deleteUser":
-        result = await supabase.rpc("admin_delete_user", {
-          user_id: params.userId,
-        });
-        break;
-
-      case "excludeUser":
-        await publishUserAction(params.userId, params.reason, "excluded", ExpiresNever, queryUserData.id);
-        result = await supabase.rpc("admin_exclude_user", {
-          user_id: params.userId,
-        });
-        break;
-
-      case "restrictUser":
-        await publishUserAction(params.userId, params.reason, "restricted", ExpiresNever, queryUserData.id);
-        result = await supabase.rpc("admin_restrict_user", {
-          user_id: params.userId,
-        });
-        break;
-
-      case "silenceUser":
-        await publishUserAction(params.userId, params.reason, "silenced", params.expiresAt, queryUserData.id);
-        result = await supabase.rpc("admin_silence_user", {
-          user_id: params.userId,
-        });
-        break;
-
-      case "searchUsers":
-        result = await supabase.rpc("admin_search_users", {
-          search_text: params.searchText,
-        });
-        break;
-
-      case "profanityClear":
-        result = await supabase.rpc("admin_profanity_clear", {
-          user_id: params.userId,
-        });
-        break;
-
-      case "removeAllScores":
-        result = await supabase.rpc("admin_remove_all_scores", {
-          user_id: params.userId,
-        });
-        break;
-
-      case "invalidateRankedScores":
-        result = await supabase.rpc("admin_invalidate_ranked_scores", {
-          user_id: params.userId,
-        });
-        break;
-
-      case "unbanUser":
-        result = await supabase.rpc("admin_unban_user", {
-          user_id: params.userId,
-        });
-        break;
-
-      case "updateProfile":
-        const profileData: {
-          avatar_url?: string;
-          flag?: string;
-          profile_image?: string;
-          username?: string;
-          verified?: boolean;
-        } = {};
-
-        if (params.avatar_url !== undefined) profileData.avatar_url = params.avatar_url;
-        if (params.flag !== undefined) profileData.flag = params.flag;
-        if (params.profile_image !== undefined) {
-          profileData.profile_image = params.profile_image;
-        }
-        if (params.username !== undefined) profileData.username = params.username;
-        if (params.verified !== undefined) profileData.verified = params.verified;
-
-        const profileValidationError = normalizeProfileUpdateData(profileData);
-
-        if (profileValidationError) {
-          result = {
-            data: null,
-            error: { message: profileValidationError },
-          };
-          break;
-        }
-
-        result = await supabase.rpc("admin_update_profile", {
-          user_id: params.userId,
-          profile_data: profileData,
-        });
-        break;
-
-      case "changeFlag":
-        const flagData = { flag: params.flag };
-        const flagValidationError = normalizeProfileUpdateData(flagData);
-
-        if (flagValidationError) {
-          result = { data: null, error: { message: flagValidationError } };
-          break;
-        }
-
-        result = await supabase.rpc("admin_update_profile", {
-          user_id: params.userId,
-          profile_data: flagData,
-        });
-        break;
-      case "changeBadges":
-        // Allow only developers to modify badges.
-        if ((queryUserData.badges as string[]).includes("Developer")) {
-          result = await supabase
-            .from("profiles")
-            .upsert({
-              id: params.userId,
-              badges: params.badges,
-            })
-            .select();
-        } else {
-          result = { data: null, error: { message: "Unauthorized" } };
-        }
-        break;
-
-      case "addBadge":
-        // Allow only developers to modify badges.
-        if ((queryUserData.badges as string[]).includes("Developer")) {
-          // Get current badges
-          const { data: targetUser } = await supabase
-            .from("profiles")
-            .select("badges")
-            .eq("id", params.userId)
-            .single();
-
-          const currentBadges = (targetUser?.badges || []) as string[];
-          if (!currentBadges.includes(params.badge)) {
-            currentBadges.push(params.badge);
-            result = await supabase
-              .from("profiles")
-              .upsert({
-                id: params.userId,
-                badges: currentBadges,
-              })
-              .select();
-          } else {
-            result = { data: targetUser, error: null };
-          }
-        } else {
-          result = { data: null, error: { message: "Unauthorized" } };
-        }
-        break;
-
-      case "removeBadge":
-        // Allow only developers to modify badges.
-        if ((queryUserData.badges as string[]).includes("Developer")) {
-          // Get current badges
-          const { data: targetUser } = await supabase
-            .from("profiles")
-            .select("badges")
-            .eq("id", params.userId)
-            .single();
-
-          const currentBadges = (targetUser?.badges || []) as string[];
-          const updatedBadges = currentBadges.filter(b => b !== params.badge);
-
-          result = await supabase
-            .from("profiles")
-            .upsert({
-              id: params.userId,
-              badges: updatedBadges,
-            })
-            .select();
-        } else {
-          result = { data: null, error: { message: "Unauthorized" } };
-        }
-        break;
-
-      case "getFriendLinks":
-        const [
-          { data: outgoingRows, error: outgoingError },
-          { data: incomingRows, error: incomingError },
-        ] = await Promise.all([
-          supabase
-            .from("profileFriends")
-            .select("profile_id,friend_id,created_at")
-            .eq("profile_id", params.userId)
-            .order("created_at", { ascending: false }),
-          supabase
-            .from("profileFriends")
-            .select("profile_id,friend_id,created_at")
-            .eq("friend_id", params.userId)
-            .order("created_at", { ascending: false }),
-        ]);
-
-        if (outgoingError || incomingError) {
-          result = { data: null, error: outgoingError || incomingError };
-          break;
-        }
-
-        const friendProfileIds = Array.from(
-          new Set([
-            ...((outgoingRows || []).map((row) => row.friend_id) || []),
-            ...((incomingRows || []).map((row) => row.profile_id) || []),
-          ])
-        );
-
-        const { data: friendProfiles, error: friendProfilesError } =
-          friendProfileIds.length > 0
-            ? await supabase
-              .from("profiles")
-              .select("id,username,avatar_url,flag")
-              .in("id", friendProfileIds)
-            : { data: [], error: null };
-
-        if (friendProfilesError) {
-          result = { data: null, error: friendProfilesError };
-          break;
-        }
-
-        const friendProfileMap = new Map(
-          (friendProfiles || []).map((profile) => [profile.id, profile])
-        );
-        const mapFriendLink = (profileId: number, createdAt: string) => {
-          const profile = friendProfileMap.get(profileId);
-          return profile ? { ...profile, created_at: createdAt } : null;
-        };
-
-        result = {
-          data: {
-            friends: (outgoingRows || [])
-              .map((row) => mapFriendLink(row.friend_id, row.created_at))
-              .filter(Boolean),
-            friendedBy: (incomingRows || [])
-              .map((row) => mapFriendLink(row.profile_id, row.created_at))
-              .filter(Boolean),
-          },
-          error: null,
-        };
-        break;
-
-      case "removeScore":
-        result = await supabase.rpc("admin_remove_score", {
-          user_id: params.userId,
-          score_id: params.scoreId,
-        });
-
-        if (!result.error && result.data !== true) {
-          result = { data: null, error: { message: "Score not found" } };
-        }
-        break;
-
-      case "addScoreViaReplay":
-        const { data: scoreUser, error: scoreUserError } = await supabase
-          .from("profiles")
-          .select("*")
-          .eq("id", params.userId)
-          .single();
-
-        if (scoreUserError || !scoreUser) {
-          result = {
-            data: null,
-            error: { message: "User not found" },
-          };
-          break;
-        }
-
-        const scoreResponse = await submitScoreForUser(
-          parseReplaySubmitData(Buffer.from(params.replayBytes, "base64")),
-          scoreUser,
-          scoreUser.uid || String(scoreUser.id),
-          null
-        );
-        const scoreResult = (await scoreResponse.json()) as { error?: string };
-        result =
-          scoreResponse.status >= 400 || scoreResult.error
-            ? {
-              data: null,
-              error: { message: scoreResult.error || "Failed to add score" },
-            }
-            : { data: scoreResult, error: null };
-        break;
-
-      case "getModeratedUsersPaginated":
-        const moderatedOffset = (params.page - 1) * params.limit;
-        const {
-          data: moderatedUsers,
-          error: moderatedUsersError,
-          count: moderatedUsersCount,
-        } = await supabase
-          .from("profiles")
-          .select(
-            "id,username,avatar_url,flag,ban,bannedAt,skill_points,play_count,created_at",
-            { count: "exact" }
-          )
-          .in("ban", ["excluded", "restricted", "silenced"])
-          .order("bannedAt", { ascending: false, nullsFirst: false })
-          .order("id", { ascending: false })
-          .range(moderatedOffset, moderatedOffset + params.limit - 1);
-
-        result = moderatedUsersError
-          ? { error: moderatedUsersError, data: null }
-          : {
-            data: {
-              users: moderatedUsers || [],
-              pagination: {
-                page: params.page,
-                limit: params.limit,
-                total: moderatedUsersCount || 0,
-                totalPages: Math.ceil(
-                  (moderatedUsersCount || 0) / params.limit
-                ),
-              },
-            },
-            error: null,
-          };
-        break;
-
-      case "getScoresPaginated":
-        const offset = (params.page - 1) * params.limit;
-        let query = supabase
-          .from("scores")
-          .select(
-            `
-            id,
-            awarded_sp,
-            userId,
-            additional_data,
-            profiles (
-              username
-            )
-          `,
-            { count: "exact" }
-          )
-          .eq("passed", true)
-          .order("created_at", { ascending: false })
-          .range(offset, offset + params.limit - 1);
-
-        if (params.userId) {
-          query = query.eq("userId", params.userId);
-        }
-
-        const { data: scoresData, error: scoresError, count } = await query;
-
-        if (scoresError) {
-          result = { error: scoresError, data: null };
-        } else {
-          const transformedScores = scoresData?.map((score) => {
-            const transformed: any = {
-              id: score.id,
-              awarded_sp: score.awarded_sp,
-              userId: score.userId,
-              username: score.profiles?.username || null,
-            };
-
-            if (params.includeAdditionalData) {
-              transformed.additional_data = score.additional_data;
-            }
-
-            return transformed;
-          });
-
-          result = {
-            data: {
-              scores: transformedScores,
-              pagination: {
-                page: params.page,
-                limit: params.limit,
-                total: count || 0,
-                totalPages: Math.ceil((count || 0) / params.limit),
-              },
-            },
-            error: null,
-          };
-        }
-        break;
-
-      case "getMultiaccountInvestigation":
-        const { data: investigatedUser, error: investigatedUserError } =
-          await supabase
-            .from("profiles")
-            .select(MULTIACCOUNT_PROFILE_SELECT)
-            .eq("id", params.userId)
-            .maybeSingle();
-
-        if (investigatedUserError) {
-          result = { error: investigatedUserError, data: null };
-          break;
-        }
-
-        if (!investigatedUser) {
-          result = {
-            error: { message: "User not found" },
-            data: null,
-          };
-          break;
-        }
-
-        const { data: investigatedUserHwids, error: investigatedUserHwidsError } =
-          await supabase
-            .from("user_hwids")
-            .select("id, hwid, created_at")
-            .eq("id", params.userId)
-            .order("created_at", { ascending: false });
-
-        if (investigatedUserHwidsError) {
-          result = { error: investigatedUserHwidsError, data: null };
-          break;
-        }
-
-        const targetRows = investigatedUserHwids || [];
-        const uniqueHwids = Array.from(
-          new Set(targetRows.map((row) => row.hwid).filter(Boolean))
-        );
-
-        const dateRange: InvestigationDateRange = {
-          firstSeenAt: null,
-          lastSeenAt: null,
-        };
-
-        const hwidAggregates = new Map<
-          string,
-          InvestigationDateRange & {
-            hwid: string;
-            occurrences: number;
-            linkedProfiles: Map<number, LinkedProfileAggregate>;
-          }
-        >();
-
-        for (const row of targetRows) {
-          updateDateRange(dateRange, row.created_at);
-
-          const existing = hwidAggregates.get(row.hwid) || {
-            hwid: row.hwid,
-            occurrences: 0,
-            firstSeenAt: null,
-            lastSeenAt: null,
-            linkedProfiles: new Map<number, LinkedProfileAggregate>(),
-          };
-
-          existing.occurrences += 1;
-          updateDateRange(existing, row.created_at);
-          hwidAggregates.set(row.hwid, existing);
-        }
-
-        if (uniqueHwids.length === 0) {
-          result = {
-            data: {
-              user: investigatedUser,
-              summary: {
-                totalRows: 0,
-                uniqueHwids: 0,
-                sharedHwids: 0,
-                linkedAccounts: 0,
-                firstSeenAt: null,
-                lastSeenAt: null,
-              },
-              accounts: [],
-              hwids: [],
-            },
-            error: null,
-          };
-          break;
-        }
-
-        const { data: relatedRows, error: relatedRowsError } = await supabase
-          .from("user_hwids")
-          .select("id, hwid, created_at")
-          .in("hwid", uniqueHwids)
-          .order("created_at", { ascending: false });
-
-        if (relatedRowsError) {
-          result = { error: relatedRowsError, data: null };
-          break;
-        }
-
-        const relatedProfileIds = Array.from(
-          new Set(
-            (relatedRows || [])
-              .map((row) => row.id)
-              .filter((id) => id !== params.userId)
-          )
-        );
-
-        const { data: relatedProfiles, error: relatedProfilesError } =
-          relatedProfileIds.length > 0
-            ? await supabase
-              .from("profiles")
-              .select(MULTIACCOUNT_PROFILE_SELECT)
-              .in("id", relatedProfileIds)
-            : { data: [], error: null };
-
-        if (relatedProfilesError) {
-          result = { error: relatedProfilesError, data: null };
-          break;
-        }
-
-        const profileMap = new Map<number, AdminProfileSummary>([
-          [investigatedUser.id, investigatedUser],
-          ...((relatedProfiles || []) as AdminProfileSummary[]).map((profile) => [
-            profile.id,
-            profile,
-          ]),
-        ]);
-
-        const linkedAccountAggregates = new Map<number, LinkedAccountAggregate>();
-
-        for (const row of relatedRows || []) {
-          if (row.id === params.userId) {
-            continue;
-          }
-
-          const hwidAggregate = hwidAggregates.get(row.hwid);
-          const relatedProfile = profileMap.get(row.id);
-
-          if (!hwidAggregate || !relatedProfile) {
-            continue;
-          }
-
-          const linkedProfile =
-            hwidAggregate.linkedProfiles.get(row.id) || {
-              ...relatedProfile,
-              occurrences: 0,
-              firstSeenAt: null,
-              lastSeenAt: null,
-            };
-
-          linkedProfile.occurrences += 1;
-          updateDateRange(linkedProfile, row.created_at);
-          hwidAggregate.linkedProfiles.set(row.id, linkedProfile);
-
-          const linkedAccount = linkedAccountAggregates.get(row.id) || {
-            ...relatedProfile,
-            occurrences: 0,
-            sharedHwids: new Set<string>(),
-            firstSeenAt: null,
-            lastSeenAt: null,
-          };
-
-          linkedAccount.occurrences += 1;
-          linkedAccount.sharedHwids.add(row.hwid);
-          updateDateRange(linkedAccount, row.created_at);
-          linkedAccountAggregates.set(row.id, linkedAccount);
-        }
-
-        const accounts = Array.from(linkedAccountAggregates.values())
-          .map((account) => ({
-            ...account,
-            sharedHwids: Array.from(account.sharedHwids).sort(),
-            sharedHwidCount: account.sharedHwids.size,
-          }))
-          .sort((a, b) => {
-            if (b.sharedHwidCount !== a.sharedHwidCount) {
-              return b.sharedHwidCount - a.sharedHwidCount;
-            }
-
-            if (b.occurrences !== a.occurrences) {
-              return b.occurrences - a.occurrences;
-            }
-
-            return timestampOrZero(b.lastSeenAt) - timestampOrZero(a.lastSeenAt);
-          });
-
-        const hwids = Array.from(hwidAggregates.values())
-          .map((aggregate) => ({
-            hwid: aggregate.hwid,
-            occurrences: aggregate.occurrences,
-            firstSeenAt: aggregate.firstSeenAt,
-            lastSeenAt: aggregate.lastSeenAt,
-            linkedAccountCount: aggregate.linkedProfiles.size,
-            linkedProfiles: Array.from(aggregate.linkedProfiles.values()).sort(
-              (a, b) => {
-                if (b.occurrences !== a.occurrences) {
-                  return b.occurrences - a.occurrences;
-                }
-
-                return (
-                  timestampOrZero(b.lastSeenAt) - timestampOrZero(a.lastSeenAt)
-                );
-              }
-            ),
-          }))
-          .sort((a, b) => {
-            if (b.linkedAccountCount !== a.linkedAccountCount) {
-              return b.linkedAccountCount - a.linkedAccountCount;
-            }
-
-            if (b.occurrences !== a.occurrences) {
-              return b.occurrences - a.occurrences;
-            }
-
-            return timestampOrZero(b.lastSeenAt) - timestampOrZero(a.lastSeenAt);
-          });
-
-        result = {
-          data: {
-            user: investigatedUser,
-            summary: {
-              totalRows: targetRows.length,
-              uniqueHwids: uniqueHwids.length,
-              sharedHwids: hwids.filter((hwid) => hwid.linkedAccountCount > 0)
-                .length,
-              linkedAccounts: accounts.length,
-              firstSeenAt: dateRange.firstSeenAt,
-              lastSeenAt: dateRange.lastSeenAt,
-            },
-            accounts,
-            hwids,
-          },
-          error: null,
-        };
-        break;
-    }
-
-    const adminActionDetails = getAdminActionDetails(operation, params);
-
-    if (!ADMIN_READ_OPERATIONS.has(operation)) {
-      await postStaffAdminWebhook({
-        admin: queryUserData,
-        operation,
-        targetUserId,
-        details: adminActionDetails,
-        error: result?.error?.message,
-      });
-
-      // Log the admin action
-      await supabase.rpc("admin_log_action", {
-        admin_id: queryUserData.id,
-        action_type: operation,
-        target_id: "userId" in params ? params.userId : null,
-        details: { params: adminActionDetails },
-      });
-    }
-
-    if (result?.error) {
-      return NextResponse.json(
-        {
-          success: false,
-          error: result.error.message,
-        },
-        { status: 500 }
-      );
-    }
-
-    if (
-      targetUserId !== null &&
-      !result?.error &&
-      !ADMIN_READ_OPERATIONS.has(operation)
-    ) {
-      await invalidateCachePrefix(`userscore:${targetUserId}`);
-    }
-
-    return NextResponse.json({
-      success: true,
-      result: result?.data,
-    });
-  } catch (err: any) {
-    return NextResponse.json(
-      {
-        success: false,
-        error: err.message || "An error occurred during the operation",
-      },
-      { status: 500 }
-    );
-  }
-}
+import { NextResponse } from "../utils/response";
+import z from "zod";
+import { Database } from "../types/database";
+import { protectedApi } from "../utils/requestUtils";
+import { supabase } from "../utils/supabase";
+import { getUserBySession } from "../utils/getUserBySession";
+import { User } from "@supabase/supabase-js";
+import { invalidateCachePrefix } from "../utils/cache";
+import { normalizeProfileUpdateData } from "../utils/profileUpdateValidation";
+import { getModerationState } from "../utils/moderation";
+import {
+  GetObjectCommand,
+  PutObjectCommand,
+  S3Client,
+} from "@aws-sdk/client-s3";
+import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
+import { getRedis } from "../utils/redis";
+import { parseReplaySubmitData } from "../utils/rhrReplay";
+import { submitScoreForUser } from "./submitScoreInternal";
+
+type AdminProfileSummary = Pick<
+  Database["public"]["Tables"]["profiles"]["Row"],
+  "id" | "username" | "avatar_url" | "flag" | "badges" | "ban"
+>;
+
+type InvestigationDateRange = {
+  firstSeenAt: string | null;
+  lastSeenAt: string | null;
+};
+
+type LinkedAccountAggregate = AdminProfileSummary &
+  InvestigationDateRange & {
+    occurrences: number;
+    sharedHwids: Set<string>;
+  };
+
+type LinkedProfileAggregate = AdminProfileSummary &
+  InvestigationDateRange & {
+    occurrences: number;
+  };
+
+const MULTIACCOUNT_PROFILE_SELECT =
+  "id, username, avatar_url, flag, badges, ban";
+
+const ADMIN_READ_OPERATIONS = new Set([
+  "searchUsers",
+  "getScoresPaginated",
+  "getFriendLinks",
+  "getMultiaccountInvestigation",
+  "getModeratedUsersPaginated",
+  "getUserViolationState",
+  "downloadACBuild",
+  "retrieveACBuilds",
+]);
+
+const AC_BUILD_ADMIN_IDS = new Set([0, 13]);
+const AC_BUILD_OPERATIONS = new Set([
+  "uploadACBuild",
+  "downloadACBuild",
+  "retrieveACBuilds",
+  "makeACBuildPrimary",
+  "setACBuildActive",
+]);
+
+const acBuildBucket = "ac-builds";
+const acBuildS3Endpoint = "https://s3.eu-central-003.backblazeb2.com";
+const acBuildS3Client = new S3Client({
+  region: "eu-central-003",
+  endpoint: acBuildS3Endpoint,
+  credentials: {
+    secretAccessKey: process.env.B2_AC_SECRET_BUCKET || "",
+    accessKeyId: process.env.B2_AC_ACCESS_BUCKET || "",
+  },
+  requestChecksumCalculation: "WHEN_REQUIRED",
+});
+
+const acBuildGameBranch = z.enum(["test", "main"]);
+const changelogType = z.enum(["public", "testing", "web"]);
+function clampWebhookText(value: string, maxLength: number) {
+  const sanitized = value.replace(/[\u0000-\u001F\u007F]/g, "");
+  return sanitized.length <= maxLength
+    ? sanitized
+    : `${sanitized.slice(0, maxLength - 3)}...`;
+}
+
+function getAdminActionDetails(operation: string, params: any) {
+  return operation === "addScoreViaReplay"
+    ? { userId: params.userId, replayBytes: "<Long>" }
+    : params;
+}
+
+async function postStaffAdminWebhook({
+  admin,
+  operation,
+  targetUserId,
+  details,
+  error,
+}: {
+  admin: Database["public"]["Tables"]["profiles"]["Row"];
+  operation: string;
+  targetUserId: number | null;
+  details: any;
+  error?: string;
+}) {
+  const webhookUrl = process.env.WEBHOOK_STAFF_DISCORD;
+  if (!webhookUrl) {
+    console.log("WEBHOOK_STAFF_DISCORD is not configured");
+    return;
+  }
+
+  try {
+    const adminName = admin.username || `User #${admin.id}`;
+    const payload = {
+      content: `Admin action: ${operation}`,
+      embeds: [
+        {
+          title: "Admin Action",
+          color: error ? 0xe74c3c : 0x3498db,
+          fields: [
+            {
+              name: "Moderator",
+              value: clampWebhookText(`${adminName} (#${admin.id})`, 1024),
+              inline: true,
+            },
+            {
+              name: "Action",
+              value: clampWebhookText(operation, 1024),
+              inline: true,
+            },
+            {
+              name: "Target",
+              value: targetUserId === null ? "-" : `#${targetUserId}`,
+              inline: true,
+            },
+            {
+              name: "Status",
+              value: error ? `Failed: ${clampWebhookText(error, 900)}` : "Succeeded",
+            },
+            {
+              name: "Details",
+              value: clampWebhookText(JSON.stringify(details), 1024) || "-",
+            },
+          ],
+          footer: {
+            text: new Date().toUTCString(),
+          },
+        },
+      ],
+    };
+
+    const response = await fetch(webhookUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify(payload),
+    });
+
+    if (!response.ok) {
+      const responseBody = await response.text();
+      console.log("Staff admin webhook failed", {
+        operation,
+        status: response.status,
+        statusText: response.statusText,
+        responseBody: clampWebhookText(responseBody || "-", 4000),
+      });
+    }
+  } catch (error) {
+    console.log("Failed to post staff admin webhook", error);
+  }
+}
+
+function timestampOrZero(value: string | null) {
+  return value ? new Date(value).getTime() : 0;
+}
+
+function updateDateRange(
+  range: InvestigationDateRange,
+  createdAt: string | null
+) {
+  if (!createdAt) {
+    return;
+  }
+
+  if (!range.firstSeenAt || createdAt < range.firstSeenAt) {
+    range.firstSeenAt = createdAt;
+  }
+
+  if (!range.lastSeenAt || createdAt > range.lastSeenAt) {
+    range.lastSeenAt = createdAt;
+  }
+}
+
+async function setPrimaryACBuild(buildId: number) {
+  const { data: build, error: buildError } = await supabase
+    .from("ac_builds")
+    .select("id,platform,game_branch")
+    .eq("id", buildId)
+    .single();
+
+  if (buildError) {
+    return { data: null, error: buildError };
+  }
+
+  const inactiveBuilds = await supabase
+    .from("ac_builds")
+    .update({ active: false })
+    .eq("platform", build.platform)
+    .eq("game_branch", build.game_branch);
+
+  return inactiveBuilds.error
+    ? inactiveBuilds
+    : supabase
+      .from("ac_builds")
+      .update({ active: true })
+      .eq("id", buildId)
+      .select("*")
+      .single();
+}
+
+// Define supported admin operations and their parameter types
+const adminOperations = {
+  deleteUser: z.object({ userId: z.number() }),
+  updateProfile: z.object({
+    userId: z.number(),
+    avatar_url: z.string().optional(),
+    flag: z.string().optional(),
+    profile_image: z.string().optional(),
+    username: z.string().optional(),
+    verified: z.boolean().optional(),
+  }),
+  changeFlag: z.object({ userId: z.number(), flag: z.string() }),
+  changeBadges: z.object({ userId: z.number(), badges: z.array(z.string()) }),
+  addBadge: z.object({ userId: z.number(), badge: z.string() }),
+  removeBadge: z.object({ userId: z.number(), badge: z.string() }),
+  excludeUser: z.object({ userId: z.number(), reason: z.string() }),
+  restrictUser: z.object({ userId: z.number(), reason: z.string() }),
+  silenceUser: z.object({
+    userId: z.number(),
+    expiresAt: z.string().nullable().optional(),
+    reason: z.string(),
+  }),
+  profanityClear: z.object({ userId: z.number() }),
+  searchUsers: z.object({ searchText: z.string() }),
+  getFriendLinks: z.object({ userId: z.number() }),
+  removeAllScores: z.object({ userId: z.number() }),
+  removeScore: z.object({ userId: z.number(), scoreId: z.number() }),
+  addScoreViaReplay: z.object({ userId: z.number(), replayBytes: z.string() }),
+  invalidateRankedScores: z.object({ userId: z.number() }),
+  unbanUser: z.object({ userId: z.number() }),
+  revokeViolation: z.object({
+    violationId: z.number(),
+    reason: z.string().optional(),
+  }),
+  getModeratedUsersPaginated: z.object({
+    page: z.number().min(1).default(1),
+    limit: z.number().min(1).max(100).default(25),
+  }),
+  getScoresPaginated: z.object({
+    page: z.number().min(1).default(1),
+    limit: z.number().min(1).max(100).default(50),
+    userId: z.number().optional(),
+    includeAdditionalData: z.boolean().default(true),
+  }),
+  getMultiaccountInvestigation: z.object({ userId: z.number() }),
+  getUserViolationState: z.object({ userId: z.number() }),
+  uploadACBuild: z.object({
+    contentLength: z.number(),
+    contentType: z.string().default("application/octet-stream"),
+    gameBranch: acBuildGameBranch,
+    hash: z.string(),
+    platform: z.string(),
+  }),
+  retrieveACBuilds: z.object({
+    gameBranch: acBuildGameBranch.optional(),
+    platform: z.string().optional(),
+  }),
+  downloadACBuild: z.object({ buildId: z.number() }),
+  makeACBuildPrimary: z.object({ buildId: z.number() }),
+  setACBuildActive: z.object({ buildId: z.number(), active: z.boolean() }),
+  addChangelog: z.object({
+    type: changelogType,
+    date: z.string(),
+    markdown: z.string(),
+  }),
+  removeChangelog: z.object({
+    type: changelogType,
+    date: z.string(),
+  }),
+} as const;
+
+// Create a discriminated union type for operation parameters
+const OperationParam = z.discriminatedUnion("operation", [
+  z.object({
+    operation: z.literal("deleteUser"),
+    params: adminOperations.deleteUser,
+  }),
+  z.object({
+    operation: z.literal("excludeUser"),
+    params: adminOperations.excludeUser,
+  }),
+  z.object({
+    operation: z.literal("restrictUser"),
+    params: adminOperations.restrictUser,
+  }),
+  z.object({
+    operation: z.literal("silenceUser"),
+    params: adminOperations.silenceUser,
+  }),
+  z.object({
+    operation: z.literal("searchUsers"),
+    params: adminOperations.searchUsers,
+  }),
+  z.object({
+    operation: z.literal("profanityClear"),
+    params: adminOperations.profanityClear,
+  }),
+  z.object({
+    operation: z.literal("removeAllScores"),
+    params: adminOperations.removeAllScores,
+  }),
+  z.object({
+    operation: z.literal("invalidateRankedScores"),
+    params: adminOperations.invalidateRankedScores,
+  }),
+  z.object({
+    operation: z.literal("unbanUser"),
+    params: adminOperations.unbanUser,
+  }),
+  z.object({
+    operation: z.literal("revokeViolation"),
+    params: adminOperations.revokeViolation,
+  }),
+  z.object({
+    operation: z.literal("updateProfile"),
+    params: adminOperations.updateProfile,
+  }),
+  z.object({
+    operation: z.literal("changeFlag"),
+    params: adminOperations.changeFlag,
+  }),
+  z.object({
+    operation: z.literal("changeBadges"),
+    params: adminOperations.changeBadges,
+  }),
+  z.object({
+    operation: z.literal("addBadge"),
+    params: adminOperations.addBadge,
+  }),
+  z.object({
+    operation: z.literal("removeBadge"),
+    params: adminOperations.removeBadge,
+  }),
+  z.object({
+    operation: z.literal("getFriendLinks"),
+    params: adminOperations.getFriendLinks,
+  }),
+  z.object({
+    operation: z.literal("removeScore"),
+    params: adminOperations.removeScore,
+  }),
+  z.object({
+    operation: z.literal("addScoreViaReplay"),
+    params: adminOperations.addScoreViaReplay,
+  }),
+  z.object({
+    operation: z.literal("getModeratedUsersPaginated"),
+    params: adminOperations.getModeratedUsersPaginated,
+  }),
+  z.object({
+    operation: z.literal("getScoresPaginated"),
+    params: adminOperations.getScoresPaginated,
+  }),
+  z.object({
+    operation: z.literal("getMultiaccountInvestigation"),
+    params: adminOperations.getMultiaccountInvestigation,
+  }),
+  z.object({
+    operation: z.literal("getUserViolationState"),
+    params: adminOperations.getUserViolationState,
+  }),
+  z.object({
+    operation: z.literal("uploadACBuild"),
+    params: adminOperations.uploadACBuild,
+  }),
+  z.object({
+    operation: z.literal("retrieveACBuilds"),
+    params: adminOperations.retrieveACBuilds,
+  }),
+  z.object({
+    operation: z.literal("downloadACBuild"),
+    params: adminOperations.downloadACBuild,
+  }),
+  z.object({
+    operation: z.literal("makeACBuildPrimary"),
+    params: adminOperations.makeACBuildPrimary,
+  }),
+  z.object({
+    operation: z.literal("setACBuildActive"),
+    params: adminOperations.setACBuildActive,
+  }),
+  z.object({
+    operation: z.literal("addChangelog"),
+    params: adminOperations.addChangelog,
+  }),
+  z.object({
+    operation: z.literal("removeChangelog"),
+    params: adminOperations.removeChangelog,
+  }),
+]);
+
+export const Schema = {
+  input: z.strictObject({
+    session: z.string(),
+    data: OperationParam,
+  }),
+  output: z.object({
+    success: z.boolean(),
+    result: z.any().optional(),
+    error: z.string().optional(),
+  }),
+};
+
+export async function POST(request: Request): Promise<NextResponse> {
+  return protectedApi({
+    request,
+    schema: Schema,
+    authorization: () => { },
+    activity: handler,
+  });
+}
+
+export async function handler(
+  data: (typeof Schema)["input"]["_type"]
+): Promise<NextResponse<(typeof Schema)["output"]["_type"]>> {
+  // Get user from session
+  const user = (await getUserBySession(data.session)) as User;
+
+  // Get user's profile data
+  const { data: queryUserData, error: userError } = await supabase
+    .from("profiles")
+    .select("*")
+    .eq("uid", user.id)
+    .single();
+
+  if (userError || !queryUserData) {
+    return NextResponse.json(
+      {
+        success: false,
+        error: "User cannot be retrieved from session",
+      },
+      { status: 404 }
+    );
+  }
+  const operation = data.data.operation;
+  const tags = (queryUserData?.badges || []) as string[];
+  // Check if user has "Global Moderator" badge
+  const isGlobalModerator = tags.includes("Global Moderator");
+  const isACBuildOperation = AC_BUILD_OPERATIONS.has(operation);
+
+  if (isACBuildOperation && !AC_BUILD_ADMIN_IDS.has(queryUserData.id)) {
+    return NextResponse.json(
+      {
+        success: false,
+        error: "Access denied.",
+      },
+      { status: 403 }
+    );
+  }
+
+  if (!isACBuildOperation && !isGlobalModerator) {
+    return NextResponse.json(
+      {
+        success: false,
+        error: "Unauthorized. Only Global Moderators can perform this action.",
+      },
+      { status: 403 }
+    );
+  }
+
+  // Execute the requested admin operation
+  try {
+    let result: { data?: any; error?: any } | null = null;
+    const params = data.data.params as any;
+
+    const targetUserId =
+      "userId" in params && typeof params.userId === "number"
+        ? params.userId
+        : null;
+
+    switch (operation) {
+      case "deleteUser":
+        result = await supabase.rpc("admin_delete_user", {
+          user_id: params.userId,
+        });
+        break;
+
+      case "excludeUser":
+        result = await supabase.rpc("admin_exclude_user", {
+          user_id: params.userId,
+        });
+        break;
+
+      case "restrictUser":
+        result = await supabase.rpc("admin_restrict_user", {
+          user_id: params.userId,
+        });
+        break;
+
+      case "silenceUser":
+        result = await supabase.rpc("admin_silence_user", {
+          user_id: params.userId,
+        });
+        break;
+
+      case "searchUsers":
+        result = await supabase.rpc("admin_search_users", {
+          search_text: params.searchText,
+        });
+        break;
+
+      case "profanityClear":
+        result = await supabase.rpc("admin_profanity_clear", {
+          user_id: params.userId,
+        });
+        break;
+
+      case "removeAllScores":
+        result = await supabase.rpc("admin_remove_all_scores", {
+          user_id: params.userId,
+        });
+        break;
+
+      case "invalidateRankedScores":
+        result = await supabase.rpc("admin_invalidate_ranked_scores", {
+          user_id: params.userId,
+        });
+        break;
+
+      case "unbanUser":
+        result = await supabase.rpc("admin_unban_user", {
+          user_id: params.userId,
+        });
+        break;
+
+      case "updateProfile":
+        const profileData: {
+          avatar_url?: string;
+          flag?: string;
+          profile_image?: string;
+          username?: string;
+          verified?: boolean;
+        } = {};
+
+        if (params.avatar_url !== undefined) profileData.avatar_url = params.avatar_url;
+        if (params.flag !== undefined) profileData.flag = params.flag;
+        if (params.profile_image !== undefined) {
+          profileData.profile_image = params.profile_image;
+        }
+        if (params.username !== undefined) profileData.username = params.username;
+        if (params.verified !== undefined) profileData.verified = params.verified;
+
+        const profileValidationError = normalizeProfileUpdateData(profileData);
+
+        if (profileValidationError) {
+          result = {
+            data: null,
+            error: { message: profileValidationError },
+          };
+          break;
+        }
+
+        result = await supabase.rpc("admin_update_profile", {
+          user_id: params.userId,
+          profile_data: profileData,
+        });
+        break;
+
+      case "changeFlag":
+        const flagData = { flag: params.flag };
+        const flagValidationError = normalizeProfileUpdateData(flagData);
+
+        if (flagValidationError) {
+          result = { data: null, error: { message: flagValidationError } };
+          break;
+        }
+
+        result = await supabase.rpc("admin_update_profile", {
+          user_id: params.userId,
+          profile_data: flagData,
+        });
+        break;
+      case "changeBadges":
+        // Allow only developers to modify badges.
+        if ((queryUserData.badges as string[]).includes("Developer")) {
+          result = await supabase
+            .from("profiles")
+            .upsert({
+              id: params.userId,
+              badges: params.badges,
+            })
+            .select();
+        } else {
+          result = { data: null, error: { message: "Unauthorized" } };
+        }
+        break;
+
+      case "addBadge":
+        // Allow only developers to modify badges.
+        if ((queryUserData.badges as string[]).includes("Developer")) {
+          // Get current badges
+          const { data: targetUser } = await supabase
+            .from("profiles")
+            .select("badges")
+            .eq("id", params.userId)
+            .single();
+
+          const currentBadges = (targetUser?.badges || []) as string[];
+          if (!currentBadges.includes(params.badge)) {
+            currentBadges.push(params.badge);
+            result = await supabase
+              .from("profiles")
+              .upsert({
+                id: params.userId,
+                badges: currentBadges,
+              })
+              .select();
+          } else {
+            result = { data: targetUser, error: null };
+          }
+        } else {
+          result = { data: null, error: { message: "Unauthorized" } };
+        }
+        break;
+
+      case "removeBadge":
+        // Allow only developers to modify badges.
+        if ((queryUserData.badges as string[]).includes("Developer")) {
+          // Get current badges
+          const { data: targetUser } = await supabase
+            .from("profiles")
+            .select("badges")
+            .eq("id", params.userId)
+            .single();
+
+          const currentBadges = (targetUser?.badges || []) as string[];
+          const updatedBadges = currentBadges.filter(b => b !== params.badge);
+
+          result = await supabase
+            .from("profiles")
+            .upsert({
+              id: params.userId,
+              badges: updatedBadges,
+            })
+            .select();
+        } else {
+          result = { data: null, error: { message: "Unauthorized" } };
+        }
+        break;
+
+      case "getFriendLinks":
+        const [
+          { data: outgoingRows, error: outgoingError },
+          { data: incomingRows, error: incomingError },
+        ] = await Promise.all([
+          supabase
+            .from("profileFriends")
+            .select("profile_id,friend_id,created_at")
+            .eq("profile_id", params.userId)
+            .order("created_at", { ascending: false }),
+          supabase
+            .from("profileFriends")
+            .select("profile_id,friend_id,created_at")
+            .eq("friend_id", params.userId)
+            .order("created_at", { ascending: false }),
+        ]);
+
+        if (outgoingError || incomingError) {
+          result = { data: null, error: outgoingError || incomingError };
+          break;
+        }
+
+        const friendProfileIds = Array.from(
+          new Set([
+            ...((outgoingRows || []).map((row) => row.friend_id) || []),
+            ...((incomingRows || []).map((row) => row.profile_id) || []),
+          ])
+        );
+
+        const { data: friendProfiles, error: friendProfilesError } =
+          friendProfileIds.length > 0
+            ? await supabase
+              .from("profiles")
+              .select("id,username,avatar_url,flag")
+              .in("id", friendProfileIds)
+            : { data: [], error: null };
+
+        if (friendProfilesError) {
+          result = { data: null, error: friendProfilesError };
+          break;
+        }
+
+        const friendProfileMap = new Map(
+          (friendProfiles || []).map((profile) => [profile.id, profile])
+        );
+        const mapFriendLink = (profileId: number, createdAt: string) => {
+          const profile = friendProfileMap.get(profileId);
+          return profile ? { ...profile, created_at: createdAt } : null;
+        };
+
+        result = {
+          data: {
+            friends: (outgoingRows || [])
+              .map((row) => mapFriendLink(row.friend_id, row.created_at))
+              .filter(Boolean),
+            friendedBy: (incomingRows || [])
+              .map((row) => mapFriendLink(row.profile_id, row.created_at))
+              .filter(Boolean),
+          },
+          error: null,
+        };
+        break;
+
+      case "removeScore":
+        result = await supabase.rpc("admin_remove_score", {
+          user_id: params.userId,
+          score_id: params.scoreId,
+        });
+
+        if (!result.error && result.data !== true) {
+          result = { data: null, error: { message: "Score not found" } };
+        }
+        break;
+
+      case "addScoreViaReplay":
+        const { data: scoreUser, error: scoreUserError } = await supabase
+          .from("profiles")
+          .select("*")
+          .eq("id", params.userId)
+          .single();
+
+        if (scoreUserError || !scoreUser) {
+          result = {
+            data: null,
+            error: { message: "User not found" },
+          };
+          break;
+        }
+
+        const scoreResponse = await submitScoreForUser(
+          parseReplaySubmitData(Buffer.from(params.replayBytes, "base64")),
+          scoreUser,
+          scoreUser.uid || String(scoreUser.id),
+          null
+        );
+        const scoreResult = (await scoreResponse.json()) as { error?: string };
+        result =
+          scoreResponse.status >= 400 || scoreResult.error
+            ? {
+              data: null,
+              error: { message: scoreResult.error || "Failed to add score" },
+            }
+            : { data: scoreResult, error: null };
+        break;
+
+      case "getModeratedUsersPaginated":
+        const moderatedOffset = (params.page - 1) * params.limit;
+        const {
+          data: moderatedUsers,
+          error: moderatedUsersError,
+          count: moderatedUsersCount,
+        } = await supabase
+          .from("profiles")
+          .select(
+            "id,username,avatar_url,flag,ban,bannedAt,skill_points,play_count,created_at",
+            { count: "exact" }
+          )
+          .in("ban", ["excluded", "restricted", "silenced"])
+          .order("bannedAt", { ascending: false, nullsFirst: false })
+          .order("id", { ascending: false })
+          .range(moderatedOffset, moderatedOffset + params.limit - 1);
+
+        result = moderatedUsersError
+          ? { error: moderatedUsersError, data: null }
+          : {
+            data: {
+              users: moderatedUsers || [],
+              pagination: {
+                page: params.page,
+                limit: params.limit,
+                total: moderatedUsersCount || 0,
+                totalPages: Math.ceil(
+                  (moderatedUsersCount || 0) / params.limit
+                ),
+              },
+            },
+            error: null,
+          };
+        break;
+
+      case "getScoresPaginated":
+        const offset = (params.page - 1) * params.limit;
+        let query = supabase
+          .from("scores")
+          .select(
+            `
+            id,
+            awarded_sp,
+            userId,
+            additional_data,
+            profiles (
+              username
+            )
+          `,
+            { count: "exact" }
+          )
+          .eq("passed", true)
+          .order("created_at", { ascending: false })
+          .range(offset, offset + params.limit - 1);
+
+        if (params.userId) {
+          query = query.eq("userId", params.userId);
+        }
+
+        const { data: scoresData, error: scoresError, count } = await query;
+
+        if (scoresError) {
+          result = { error: scoresError, data: null };
+        } else {
+          const transformedScores = scoresData?.map((score) => {
+            const transformed: any = {
+              id: score.id,
+              awarded_sp: score.awarded_sp,
+              userId: score.userId,
+              username: score.profiles?.username || null,
+            };
+
+            if (params.includeAdditionalData) {
+              transformed.additional_data = score.additional_data;
+            }
+
+            return transformed;
+          });
+
+          result = {
+            data: {
+              scores: transformedScores,
+              pagination: {
+                page: params.page,
+                limit: params.limit,
+                total: count || 0,
+                totalPages: Math.ceil((count || 0) / params.limit),
+              },
+            },
+            error: null,
+          };
+        }
+        break;
+
+      case "getMultiaccountInvestigation":
+        const { data: investigatedUser, error: investigatedUserError } =
+          await supabase
+            .from("profiles")
+            .select(MULTIACCOUNT_PROFILE_SELECT)
+            .eq("id", params.userId)
+            .maybeSingle();
+
+        if (investigatedUserError) {
+          result = { error: investigatedUserError, data: null };
+          break;
+        }
+
+        if (!investigatedUser) {
+          result = {
+            error: { message: "User not found" },
+            data: null,
+          };
+          break;
+        }
+
+        const { data: investigatedUserHwids, error: investigatedUserHwidsError } =
+          await supabase
+            .from("user_hwids")
+            .select("id, hwid, created_at")
+            .eq("id", params.userId)
+            .order("created_at", { ascending: false });
+
+        if (investigatedUserHwidsError) {
+          result = { error: investigatedUserHwidsError, data: null };
+          break;
+        }
+
+        const targetRows = investigatedUserHwids || [];
+        const uniqueHwids = Array.from(
+          new Set(targetRows.map((row) => row.hwid).filter(Boolean))
+        );
+
+        const dateRange: InvestigationDateRange = {
+          firstSeenAt: null,
+          lastSeenAt: null,
+        };
+
+        const hwidAggregates = new Map<
+          string,
+          InvestigationDateRange & {
+            hwid: string;
+            occurrences: number;
+            linkedProfiles: Map<number, LinkedProfileAggregate>;
+          }
+        >();
+
+        for (const row of targetRows) {
+          updateDateRange(dateRange, row.created_at);
+
+          const existing = hwidAggregates.get(row.hwid) || {
+            hwid: row.hwid,
+            occurrences: 0,
+            firstSeenAt: null,
+            lastSeenAt: null,
+            linkedProfiles: new Map<number, LinkedProfileAggregate>(),
+          };
+
+          existing.occurrences += 1;
+          updateDateRange(existing, row.created_at);
+          hwidAggregates.set(row.hwid, existing);
+        }
+
+        if (uniqueHwids.length === 0) {
+          result = {
+            data: {
+              user: investigatedUser,
+              summary: {
+                totalRows: 0,
+                uniqueHwids: 0,
+                sharedHwids: 0,
+                linkedAccounts: 0,
+                firstSeenAt: null,
+                lastSeenAt: null,
+              },
+              accounts: [],
+              hwids: [],
+            },
+            error: null,
+          };
+          break;
+        }
+
+        const { data: relatedRows, error: relatedRowsError } = await supabase
+          .from("user_hwids")
+          .select("id, hwid, created_at")
+          .in("hwid", uniqueHwids)
+          .order("created_at", { ascending: false });
+
+        if (relatedRowsError) {
+          result = { error: relatedRowsError, data: null };
+          break;
+        }
+
+        const relatedProfileIds = Array.from(
+          new Set(
+            (relatedRows || [])
+              .map((row) => row.id)
+              .filter((id) => id !== params.userId)
+          )
+        );
+
+        const { data: relatedProfiles, error: relatedProfilesError } =
+          relatedProfileIds.length > 0
+            ? await supabase
+              .from("profiles")
+              .select(MULTIACCOUNT_PROFILE_SELECT)
+              .in("id", relatedProfileIds)
+            : { data: [], error: null };
+
+        if (relatedProfilesError) {
+          result = { error: relatedProfilesError, data: null };
+          break;
+        }
+
+        const profileMap = new Map<number, AdminProfileSummary>([
+          [investigatedUser.id, investigatedUser],
+          ...((relatedProfiles || []) as AdminProfileSummary[]).map((profile) => [
+            profile.id,
+            profile,
+          ]),
+        ]);
+
+        const linkedAccountAggregates = new Map<number, LinkedAccountAggregate>();
+
+        for (const row of relatedRows || []) {
+          if (row.id === params.userId) {
+            continue;
+          }
+
+          const hwidAggregate = hwidAggregates.get(row.hwid);
+          const relatedProfile = profileMap.get(row.id);
+
+          if (!hwidAggregate || !relatedProfile) {
+            continue;
+          }
+
+          const linkedProfile =
+            hwidAggregate.linkedProfiles.get(row.id) || {
+              ...relatedProfile,
+              occurrences: 0,
+              firstSeenAt: null,
+              lastSeenAt: null,
+            };
+
+          linkedProfile.occurrences += 1;
+          updateDateRange(linkedProfile, row.created_at);
+          hwidAggregate.linkedProfiles.set(row.id, linkedProfile);
+
+          const linkedAccount = linkedAccountAggregates.get(row.id) || {
+            ...relatedProfile,
+            occurrences: 0,
+            sharedHwids: new Set<string>(),
+            firstSeenAt: null,
+            lastSeenAt: null,
+          };
+
+          linkedAccount.occurrences += 1;
+          linkedAccount.sharedHwids.add(row.hwid);
+          updateDateRange(linkedAccount, row.created_at);
+          linkedAccountAggregates.set(row.id, linkedAccount);
+        }
+
+        const accounts = Array.from(linkedAccountAggregates.values())
+          .map((account) => ({
+            ...account,
+            sharedHwids: Array.from(account.sharedHwids).sort(),
+            sharedHwidCount: account.sharedHwids.size,
+          }))
+          .sort((a, b) => {
+            if (b.sharedHwidCount !== a.sharedHwidCount) {
+              return b.sharedHwidCount - a.sharedHwidCount;
+            }
+
+            if (b.occurrences !== a.occurrences) {
+              return b.occurrences - a.occurrences;
+            }
+
+            return timestampOrZero(b.lastSeenAt) - timestampOrZero(a.lastSeenAt);
+          });
+
+        const hwids = Array.from(hwidAggregates.values())
+          .map((aggregate) => ({
+            hwid: aggregate.hwid,
+            occurrences: aggregate.occurrences,
+            firstSeenAt: aggregate.firstSeenAt,
+            lastSeenAt: aggregate.lastSeenAt,
+            linkedAccountCount: aggregate.linkedProfiles.size,
+            linkedProfiles: Array.from(aggregate.linkedProfiles.values()).sort(
+              (a, b) => {
+                if (b.occurrences !== a.occurrences) {
+                  return b.occurrences - a.occurrences;
+                }
+
+                return (
+                  timestampOrZero(b.lastSeenAt) - timestampOrZero(a.lastSeenAt)
+                );
+              }
+            ),
+          }))
+          .sort((a, b) => {
+            if (b.linkedAccountCount !== a.linkedAccountCount) {
+              return b.linkedAccountCount - a.linkedAccountCount;
+            }
+
+            if (b.occurrences !== a.occurrences) {
+              return b.occurrences - a.occurrences;
+            }
+
+            return timestampOrZero(b.lastSeenAt) - timestampOrZero(a.lastSeenAt);
+          });
+
+        result = {
+          data: {
+            user: investigatedUser,
+            summary: {
+              totalRows: targetRows.length,
+              uniqueHwids: uniqueHwids.length,
+              sharedHwids: hwids.filter((hwid) => hwid.linkedAccountCount > 0)
+                .length,
+              linkedAccounts: accounts.length,
+              firstSeenAt: dateRange.firstSeenAt,
+              lastSeenAt: dateRange.lastSeenAt,
+            },
+            accounts,
+            hwids,
+          },
+          error: null,
+        };
+        break;
+
+      case "getUserViolationState":
+        result = await getModerationState(params.userId);
+        break;
+
+      case "uploadACBuild":
+        const acBuildKey = `rsign-${params.gameBranch}-${params.platform}-${Date.now()}`;
+        const acBuildUrl = `${acBuildS3Endpoint}/${acBuildBucket}/${acBuildKey}`;
+        const uploadUrl = await getSignedUrl(
+          acBuildS3Client,
+          new PutObjectCommand({
+            Bucket: acBuildBucket,
+            Key: acBuildKey,
+            ContentType: params.contentType,
+          }),
+          {
+            expiresIn: 3600,
+            signableHeaders: new Set(["content-type"]),
+          }
+        );
+        const insertedACBuild = await supabase
+          .from("ac_builds")
+          .insert({
+            active: false,
+            game_branch: params.gameBranch,
+            hash: params.hash,
+            platform: params.platform,
+            url: acBuildUrl,
+          })
+          .select("*")
+          .single();
+
+        result = insertedACBuild.error
+          ? insertedACBuild
+          : {
+            data: {
+              build: insertedACBuild.data,
+              objectKey: acBuildKey,
+              url: uploadUrl,
+            },
+            error: null,
+          };
+        break;
+
+      case "retrieveACBuilds":
+        let acBuildsQuery = supabase
+          .from("ac_builds")
+          .select("*")
+          .order("game_branch")
+          .order("platform")
+          .order("created_at", { ascending: false });
+
+        if (params.gameBranch) {
+          acBuildsQuery = acBuildsQuery.eq("game_branch", params.gameBranch);
+        }
+
+        if (params.platform) {
+          acBuildsQuery = acBuildsQuery.eq("platform", params.platform);
+        }
+
+        result = await acBuildsQuery;
+        break;
+
+      case "downloadACBuild":
+        const { data: build, error: buildError } = await supabase
+          .from("ac_builds")
+          .select("*")
+          .eq("id", params.buildId)
+          .single();
+
+        if (buildError) {
+          result = { data: null, error: buildError };
+          break;
+        }
+
+        const objectKey = new URL(build.url).pathname.replace(
+          `/${acBuildBucket}/`,
+          ""
+        );
+        result = {
+          data: {
+            build,
+            url: await getSignedUrl(
+              acBuildS3Client,
+              new GetObjectCommand({
+                Bucket: acBuildBucket,
+                Key: objectKey,
+              }),
+              { expiresIn: 3600 }
+            ),
+          },
+          error: null,
+        };
+        break;
+
+      case "makeACBuildPrimary":
+        result = await setPrimaryACBuild(params.buildId);
+        break;
+
+      case "setACBuildActive":
+        result = params.active
+          ? await setPrimaryACBuild(params.buildId)
+          : await supabase
+            .from("ac_builds")
+            .update({ active: false })
+            .eq("id", params.buildId)
+            .select("*")
+            .single();
+        break;
+
+      case "addChangelog":
+        result = await supabase
+          .from("changelogs")
+          .insert({
+            date: params.date,
+            markdown: decodeURIComponent(params.markdown),
+            name: params.date,
+            type: params.type,
+          })
+          .select("*")
+          .single();
+        break;
+
+      case "removeChangelog":
+        result = await supabase
+          .from("changelogs")
+          .delete()
+          .eq("type", params.type)
+          .eq("date", params.date)
+          .select("*");
+        break;
+    }
+
+    // Log the admin action
+    await supabase.rpc("admin_log_action", {
+      admin_id: queryUserData.id,
+      action_type: operation,
+      target_id: "userId" in params ? params.userId : null,
+      details: {
+        params:
+          operation === "addScoreViaReplay"
+            ? { ...params, replayBytes: "<Long>" }
+            : params,
+      },
+    });
+    const adminActionDetails = getAdminActionDetails(operation, params);
+
+    if (!ADMIN_READ_OPERATIONS.has(operation)) {
+      await postStaffAdminWebhook({
+        admin: queryUserData,
+        operation,
+        targetUserId,
+        details: adminActionDetails,
+        error: result?.error?.message,
+      });
+
+      // Log the admin action
+      await supabase.rpc("admin_log_action", {
+        admin_id: queryUserData.id,
+        action_type: operation,
+        target_id: "userId" in params ? params.userId : null,
+        details: { params: adminActionDetails },
+      });
+    }
+
+    if (result?.error) {
+      return NextResponse.json(
+        {
+          success: false,
+          error: result.error.message,
+        },
+        { status: 500 }
+      );
+    }
+
+    if (
+      targetUserId !== null &&
+      !result?.error &&
+      !ADMIN_READ_OPERATIONS.has(operation)
+    ) {
+      await invalidateCachePrefix(`userscore:${targetUserId}`);
+    }
+
+    return NextResponse.json({
+      success: true,
+      result: result?.data,
+    });
+  } catch (err: any) {
+    return NextResponse.json(
+      {
+        success: false,
+        error: err.message || "An error occurred during the operation",
+      },
+      { status: 500 }
+    );
+  }
+}