Blame for src/admin.ts

import { readBatches } from "./read-batches.js";
import { readPages } from "./read-pages.js";
import type { Express, Request, Response, NextFunction } from "express";
import { z } from "zod";
import { env } from "./config.js";
import { supabaseAdmin } from "./supabase.js";
import { requireAdmin } from "./server.js";
import { invalidateSubscriptionCache } from "./subscriptions.js";
import { deleteStoredSession, refundAdminUsage } from "./resource-deletion.js";

const uuid = z.uuid();
const date = z.string().regex(/^\d{4}-\d{2}-\d{2}$/).refine((value) => {
  const parsed = new Date(`${value}T00:00:00.000Z`);
  return !Number.isNaN(parsed.valueOf()) && parsed.toISOString().slice(0, 10) === value;
}, "Enter a valid calendar date.");
const profileSchema = z.object({
  fname: z.string().trim().min(1).max(100), lname: z.string().trim().min(1).max(100),
  academy: z.string().trim().max(150).nullable(), role: z.string().trim().max(50).nullable(),
}).strict();
const playerSchema = z.object({
  fname: z.string().trim().min(1).max(100), lname: z.string().trim().max(100).nullable().optional().default(null),
  bdate: date.refine((value) => {
    const today = new Date();
    const [year, month, day] = value.split("-").map(Number);
    const age = today.getUTCFullYear() - year - Number(today.getUTCMonth() + 1 < month || (today.getUTCMonth() + 1 === month && today.getUTCDate() < day));
    return age >= 4 && age <= 60;
  }, "Enter a valid birth date for a player aged 4 to 60."),
  heightCm: z.number().min(100).max(230), weightKg: z.number().min(20).max(150),
  club: z.string().trim().max(150).nullable().optional(), position: z.string().trim().min(1).max(50),
  gender: z.enum(["male", "female"]), userId: uuid,
}).strict();
const playerUpdateSchema = playerSchema.omit({ userId: true });

function fail(res: Response, status: number, error: string) { return res.status(status).json({ error }); }
function asyncRoute(handler: (req: Request, res: Response) => Promise<unknown>) {
  return (req: Request, res: Response, next: NextFunction) => { void handler(req, res).catch(next); };
}
async function admin(req: Request, res: Response) { return requireAdmin(req, res); }
async function analysisRequest(path: string, userId: string, method: string, isAdmin = true, body?: unknown) {
  const response = await fetch(`${env.ANALYSIS_API_URL}/api${path}`, {
    method,
    headers: {
      "x-sporalize-proxy-secret": env.ANALYSIS_PROXY_SECRET,
      "x-sporalize-user-id": userId,
      ...(isAdmin ? { "x-sporalize-admin": "true" } : {}),
      ...(body !== undefined ? { "content-type": "application/json" } : {}),
    },
    ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
  });
  if (!response.ok) throw new Error(`Analysis storage request failed (${response.status}).`);
  return response;
}

async function removeImages(paths: Array<string | null | undefined>) {
  const safe = [...new Set(paths.filter((path): path is string => Boolean(path) && /^(players|users)\/[0-9a-f-]{36}\/[0-9a-f-]{36}\.(jpg|png|webp)$/i.test(path!)))];
  if (!safe.length) return;
  const { error } = await supabaseAdmin.storage.from("profile-images").remove(safe);
  if (error) throw new Error(`Unable to remove profile images: ${error.message}`);
}

// Count only children of the displayed records, without oversized filters or
// silently losing rows to Supabase's response cap.
async function loadRelatedCounts(table: "players" | "sessions" | "actions", key: "user_id" | "player_id" | "session_id", ids: string[]) {
  const primaryKey = table === "players" ? "player_id" : table === "sessions" ? "session_id" : "action_id";
  return readBatches<string, Record<string, string | null>>(ids, (batch) => readPages(async (from, to) => {
    const { data, error } = await supabaseAdmin.from(table).select(`${primaryKey},${key}`)
      .in(key, batch).order(primaryKey).range(from, to);
    if (error) throw new Error(`Unable to load ${table} counts: ${error.message}`);
    return (data ?? []) as unknown as Record<string, string | null>[];
  }));
}

export function registerAdminRoutes(app: Express) {
  app.get("/api/admin/users", asyncRoute(async (req, res) => {
    if (!await admin(req, res)) return;
    const search = String(req.query.search ?? "").replace(/[^\p{L}\p{N}@._ -]/gu, "").trim().slice(0, 100);
    let query = supabaseAdmin.from("users").select("user_id,fname,lname,email,academy,role,image_path,account_role").order("fname").limit(250);
    if (search) query = query.or(`fname.ilike.%${search}%,lname.ilike.%${search}%,email.ilike.%${search}%`);
    const { data, error } = await query;
    if (error) throw new Error(`Unable to load user directory: ${error.message}`);
    const ids = (data ?? []).map((row) => row.user_id);
    const [subs, counts, playerCounts] = ids.length ? await Promise.all([
      supabaseAdmin.from("users_subscriptions").select("user_id,subscription_id,startdate,enddate,num_players,num_sessions").in("user_id", ids),
      loadRelatedCounts("sessions", "user_id", ids).then((data) => ({ data, error: null })),
      loadRelatedCounts("players", "user_id", ids).then((data) => ({ data, error: null })),
    ]) : [{ data: [], error: null }, { data: [], error: null }, { data: [], error: null }];
    if (subs.error) throw new Error(`Unable to load user plans: ${subs.error.message}`);
    const planIds = [...new Set((subs.data ?? []).flatMap((row) => row.subscription_id ? [row.subscription_id] : []))];
    const { data: plans, error: plansError } = planIds.length
      ? await supabaseAdmin.from("subscriptions").select("subscription_id,plan,price,player_limit,session_limit").in("subscription_id", planIds)
      : { data: [], error: null };
    if (plansError) throw new Error(`Unable to load plan names: ${plansError.message}`);
    const planMap = new Map((plans ?? []).map((plan) => [plan.subscription_id, plan]));
    const subMap = new Map((subs.data ?? []).map((row) => [row.user_id, row]));
    const sessionCounts = new Map<string, number>();
    const playerCountByUser = new Map<string, number>();
    for (const row of counts.data ?? []) if (row.user_id) sessionCounts.set(row.user_id, (sessionCounts.get(row.user_id) ?? 0) + 1);
    for (const row of playerCounts.data ?? []) if (row.user_id) playerCountByUser.set(row.user_id, (playerCountByUser.get(row.user_id) ?? 0) + 1);
    return res.json({ users: (data ?? []).map((row) => {
      const assignment = String(row.account_role).toLowerCase() === "admin" ? null : subMap.get(row.user_id);
      const plan = assignment?.subscription_id ? planMap.get(assignment.subscription_id) : null;
      return {
        id: row.user_id, fname: row.fname, lname: row.lname, name: `${row.fname} ${row.lname}`.trim(),
        email: row.email, academy: row.academy, role: row.role, imagePath: row.image_path, accountRole: row.account_role,
        subscription: plan ? { id: plan.subscription_id, name: plan.plan, startDate: assignment?.startdate, endDate: assignment?.enddate, playerLimit: plan.player_limit, sessionLimit: plan.session_limit } : null,
        usage: {
          players: String(row.account_role).toLowerCase() === "admin" ? playerCountByUser.get(row.user_id) ?? 0 : assignment?.num_players ?? 0,
          sessions: String(row.account_role).toLowerCase() === "admin" ? sessionCounts.get(row.user_id) ?? 0 : assignment?.num_sessions ?? 0,
          totalSessions: sessionCounts.get(row.user_id) ?? 0,
        },
        dataCounts: { players: playerCountByUser.get(row.user_id) ?? 0, sessions: sessionCounts.get(row.user_id) ?? 0 },
      };
    }) });
  }));

  app.get("/api/admin/plans", asyncRoute(async (req, res) => {
    if (!await admin(req, res)) return;
    const { data, error } = await supabaseAdmin.from("subscriptions").select("subscription_id,plan,price,player_limit,session_limit").order("price");
    if (error) throw new Error(`Unable to load plans: ${error.message}`);
    return res.json({ plans: data ?? [] });
  }));

  app.get("/api/admin/users/:userId", asyncRoute(async (req, res) => {
    if (!await admin(req, res)) return;
    const id = uuid.safeParse(req.params.userId); if (!id.success) return res.sendStatus(404);
    const [{ data: user, error }, { data: assignment, error: subError }, { count: players, error: playersError }, { count: sessions, error: sessionsError }] = await Promise.all([
      supabaseAdmin.from("users").select("user_id,fname,lname,email,academy,role,image_path,account_role").eq("user_id", id.data).maybeSingle(),
      supabaseAdmin.from("users_subscriptions").select("subscription_id,startdate,enddate,num_players,num_sessions").eq("user_id", id.data).maybeSingle(),
      supabaseAdmin.from("players").select("player_id", { count: "exact", head: true }).eq("user_id", id.data),
      supabaseAdmin.from("sessions").select("session_id", { count: "exact", head: true }).eq("user_id", id.data),
    ]);
    if (error) throw new Error(`Unable to load user: ${error.message}`);
    if (subError) throw new Error(`Unable to load user plan: ${subError.message}`);
    if (playersError || sessionsError) throw new Error(`Unable to load account data counts: ${(playersError ?? sessionsError)?.message}`);
    if (!user) return res.sendStatus(404);
    return res.json({ user, subscription: assignment ?? null, counts: { players: players ?? 0, sessions: sessions ?? 0 } });
  }));

  app.patch("/api/admin/users/:userId", asyncRoute(async (req, res) => {
    if (!await admin(req, res)) return;
    const id = uuid.safeParse(req.params.userId); const input = profileSchema.safeParse(req.body);
    if (!id.success || !input.success) return fail(res, 400, "Check the profile details.");
    const { data, error } = await supabaseAdmin.from("users").update(input.data).eq("user_id", id.data)
      .select("user_id,fname,lname,email,academy,role,image_path,account_role").maybeSingle();
    if (error) throw new Error(`Unable to update profile: ${error.message}`);
    if (!data) return res.sendStatus(404);
    return res.json({ user: data });
  }));

  app.put("/api/admin/users/:userId/subscription", asyncRoute(async (req, res) => {
    if (!await admin(req, res)) return;
    const id = uuid.safeParse(req.params.userId);
    const input = z.object({ subscriptionId: uuid, startDate: date, endDate: date }).strict().safeParse(req.body);
    if (!id.success || !input.success || input.data.endDate < input.data.startDate) return fail(res, 400, "Choose a valid plan period.");
    const { data: account, error: accountError } = await supabaseAdmin.from("users").select("account_role").eq("user_id", id.data).maybeSingle();
    if (accountError) throw new Error(`Unable to verify account: ${accountError.message}`);
    if (!account) return res.sendStatus(404);
    if (String(account.account_role).toLowerCase() === "admin") return fail(res, 409, "Administrator accounts do not use subscriptions.");
    const { data: plan, error: planError } = await supabaseAdmin.from("subscriptions").select("subscription_id").eq("subscription_id", input.data.subscriptionId).maybeSingle();
    if (planError) throw new Error(`Unable to verify plan: ${planError.message}`);
    if (!plan) return fail(res, 404, "Plan not found.");
    const { data: row, error } = await supabaseAdmin.from("users_subscriptions").upsert({
      user_id: id.data, subscription_id: plan.subscription_id, startdate: input.data.startDate, enddate: input.data.endDate,
      num_players: 0, num_sessions: 0,
    }, { onConflict: "user_id" }).select("user_id,subscription_id,startdate,enddate,num_players,num_sessions").single();
    if (error) throw new Error(`Unable to assign plan: ${error.message}`);
    invalidateSubscriptionCache(id.data);
    return res.json({ subscription: row });
  }));

  app.delete("/api/admin/users/:userId/subscription", asyncRoute(async (req, res) => {
    if (!await admin(req, res)) return;
    const id = uuid.safeParse(req.params.userId); if (!id.success) return res.sendStatus(404);
    const { error } = await supabaseAdmin.from("users_subscriptions").update({ subscription_id: null, num_players: 0, num_sessions: 0 })
      .eq("user_id", id.data);
    if (error) throw new Error(`Unable to cancel plan: ${error.message}`);
    invalidateSubscriptionCache(id.data);
    return res.sendStatus(204);
  }));

  app.get("/api/admin/players", asyncRoute(async (req, res) => {
    if (!await admin(req, res)) return;
    const [{ data: players, error }, { data: users, error: userError }] = await Promise.all([
      supabaseAdmin.from("players").select("player_id,user_id,fname,lname,bdate,height,weight,position,club,gender,image_path").order("fname").limit(1000),
      supabaseAdmin.from("users").select("user_id,fname,lname,email").order("fname").limit(1000),
    ]);
    if (error) throw new Error(`Unable to load players: ${error.message}`);
    if (userError) throw new Error(`Unable to load owners: ${userError.message}`);
    const sessionCounts = new Map<string, number>();
    const linkedSessions = await loadRelatedCounts("sessions", "player_id", (players ?? []).map((player) => player.player_id));
    for (const session of linkedSessions) {
      if (session.player_id) sessionCounts.set(session.player_id, (sessionCounts.get(session.player_id) ?? 0) + 1);
    }
    const owners = new Map((users ?? []).map((user) => [user.user_id, user]));
    return res.json({ players: (players ?? []).map((player) => {
      const owner = player.user_id ? owners.get(player.user_id) : null;
      return { ...player, sessionCount: sessionCounts.get(player.player_id) ?? 0, owner: owner ? `${owner.fname} ${owner.lname}`.trim() || owner.email : null };
    }), users: users ?? [] });
  }));

  app.post("/api/admin/players", asyncRoute(async (req, res) => {
    if (!await admin(req, res)) return;
    const input = playerSchema.safeParse(req.body); if (!input.success) return fail(res, 400, "Check the player details.");
    if (input.data.userId) {
      const { data, error } = await supabaseAdmin.from("users").select("user_id").eq("user_id", input.data.userId).maybeSingle();
      if (error) throw new Error(`Unable to verify player owner: ${error.message}`);
      if (!data) return fail(res, 404, "Player owner not found.");
    }
    const { data, error } = await supabaseAdmin.rpc("admin_create_player", {
      p_user_id: input.data.userId,
      p_fname: input.data.fname,
      p_lname: input.data.lname?.trim() || null,
      p_bdate: input.data.bdate,
      p_height: input.data.heightCm,
      p_weight: input.data.weightKg,
      p_club: input.data.club || null,
      p_position: input.data.position,
      p_gender: input.data.gender,
    });
    if (error) throw new Error(`Unable to add player: ${error.message}`);
    return res.status(201).json({ player: data });
  }));

  app.patch("/api/admin/players/:playerId", asyncRoute(async (req, res) => {
    if (!await admin(req, res)) return;
    const id = uuid.safeParse(req.params.playerId);
    const input = playerUpdateSchema.safeParse(req.body);
    if (!id.success || !input.success) return fail(res, 400, "Check the player details.");
    const { data, error } = await supabaseAdmin.from("players").update({
      fname: input.data.fname, lname: input.data.lname, bdate: input.data.bdate,
      height: input.data.heightCm, weight: input.data.weightKg, club: input.data.club,
      position: input.data.position, gender: input.data.gender,
    }).eq("player_id", id.data).select("player_id,user_id").maybeSingle();
    if (error) throw new Error(`Unable to update player: ${error.message}`);
    if (!data) return res.sendStatus(404);
    return res.json({ player: data });
  }));

  app.delete("/api/admin/players/:playerId", asyncRoute(async (req, res) => {
    const current = await admin(req, res); if (!current) return;
    const id = uuid.safeParse(req.params.playerId); if (!id.success) return res.sendStatus(404);
    const mode = z.enum(["keep_sessions", "delete_sessions"]).safeParse(req.body?.mode);
    if (!mode.success) return fail(res, 400, "Choose whether to keep or delete this player's sessions.");
    const { data: player, error: readError } = await supabaseAdmin.from("players").select("player_id,user_id,image_path").eq("player_id", id.data).maybeSingle();
    if (readError) throw new Error(`Unable to load player: ${readError.message}`);
    if (!player) return res.sendStatus(404);
    const { data: linkedSessions, error: sessionsError } = await supabaseAdmin.from("sessions").select("session_id,user_id,by_admin").eq("player_id", id.data);
    if (sessionsError) throw new Error(`Unable to load player sessions: ${sessionsError.message}`);
    if (mode.data === "delete_sessions") for (const session of linkedSessions ?? []) await deleteStoredSession(session.session_id, current.user.id, true);
    const { error } = await supabaseAdmin.from("players").delete().eq("player_id", id.data);
    if (error) throw new Error(`Unable to delete player: ${error.message}`);
    const chargedSessions = mode.data === "delete_sessions"
      ? (linkedSessions ?? []).filter((session) => session.user_id === player.user_id && !session.by_admin).length
      : 0;
    await refundAdminUsage(player.user_id, 1, chargedSessions);
    await removeImages([player.image_path]).catch((imageError) => console.error("Player was deleted but its profile image could not be removed", imageError));
    return res.sendStatus(204);
  }));

  app.get("/api/admin/sessions", asyncRoute(async (req, res) => {
    if (!await admin(req, res)) return;
    const [{ data: sessions, error }, { data: users, error: usersError }, { data: players, error: playersError }] = await Promise.all([
      supabaseAdmin.from("sessions").select("session_id,user_id,player_id,name,path,status,created_at,by_admin").order("created_at", { ascending: false }).limit(1000),
      supabaseAdmin.from("users").select("user_id,fname,lname,email").order("fname").limit(1000),
      supabaseAdmin.from("players").select("player_id,fname,lname").order("fname").limit(1000),
    ]);
    if (error) throw new Error(`Unable to load sessions: ${error.message}`);
    if (usersError) throw new Error(`Unable to load owners: ${usersError.message}`);
    if (playersError) throw new Error(`Unable to load session players: ${playersError.message}`);
    const owners = new Map((users ?? []).map((user) => [user.user_id, user]));
    const roster = new Map((players ?? []).map((player) => [player.player_id, player]));
    const ids = (sessions ?? []).map((session) => session.session_id);
    const actionRows = await loadRelatedCounts("actions", "session_id", ids);
    const actionCounts = new Map<string, number>();
    for (const action of actionRows ?? []) if (action.session_id) actionCounts.set(action.session_id, (actionCounts.get(action.session_id) ?? 0) + 1);
    return res.json({ sessions: (sessions ?? []).map((session) => {
      const owner = session.user_id ? owners.get(session.user_id) : null;
      const player = session.player_id ? roster.get(session.player_id) : null;
      return {
        ...session,
        owner: owner ? `${owner.fname} ${owner.lname}`.trim() || owner.email : null,
        player: player ? `${player.fname} ${player.lname}`.trim() : null,
        actionCount: actionCounts.get(session.session_id) ?? 0,
      };
    }), users: users ?? [], players: players ?? [] });
  }));

  app.delete("/api/admin/sessions/:sessionId", asyncRoute(async (req, res) => {
    const current = await admin(req, res); if (!current) return;
    const id = uuid.safeParse(req.params.sessionId); if (!id.success) return res.sendStatus(404);
    const { data: session, error } = await supabaseAdmin.from("sessions").select("user_id,by_admin").eq("session_id", id.data).maybeSingle();
    if (error) throw new Error(`Unable to load session before deletion: ${error.message}`);
    if (!session) return res.sendStatus(404);
    await deleteStoredSession(id.data, current.user.id, true);
    await refundAdminUsage(session.user_id, 0, session.by_admin ? 0 : 1);
    return res.sendStatus(204);
  }));

  app.get("/api/admin/sessions/:sessionId", asyncRoute(async (req, res) => {
    if (!await admin(req, res)) return;
    const id = uuid.safeParse(req.params.sessionId); if (!id.success) return res.sendStatus(404);
    const { data: session, error } = await supabaseAdmin.from("sessions").select("session_id,user_id,player_id,name,path,status,created_at,by_admin").eq("session_id", id.data).maybeSingle();
    if (error) throw new Error(`Unable to load session: ${error.message}`);
    if (!session) return res.sendStatus(404);
    const { data: actions, error: actionsError } = await supabaseAdmin.from("actions").select("action_id,start_frame,end_frame,type").eq("session_id", id.data).order("start_frame");
    if (actionsError) throw new Error(`Unable to load actions: ${actionsError.message}`);
    const actionIds = (actions ?? []).map((action) => action.action_id);
    const [{ data: annotations, error: annotationError }, { data: notes, error: notesError }] = actionIds.length ? await Promise.all([
      supabaseAdmin.from("annotations").select("action_id,score,user_id").in("action_id", actionIds),
      supabaseAdmin.from("annotations_notes").select("action_id,note").in("action_id", actionIds),
    ]) : [{ data: [], error: null }, { data: [], error: null }];
    if (annotationError) throw new Error(`Unable to load action annotations: ${annotationError.message}`);
    if (notesError) throw new Error(`Unable to load action notes: ${notesError.message}`);
    const annotationsById = new Map((annotations ?? []).map((row) => [row.action_id, row]));
    const notesById = new Map<string, string[]>();
    for (const row of notes ?? []) notesById.set(row.action_id, [...(notesById.get(row.action_id) ?? []), row.note]);
    return res.json({ session, actions: (actions ?? []).map((action) => ({ ...action, score: annotationsById.get(action.action_id)?.score ?? null, notes: notesById.get(action.action_id) ?? [] })) });
  }));

  app.patch("/api/admin/sessions/:sessionId/actions/:actionId", asyncRoute(async (req, res) => {
    const current = await admin(req, res); if (!current) return;
    const sessionId = uuid.safeParse(req.params.sessionId); const actionId = uuid.safeParse(req.params.actionId);
    const input = z.object({ startFrame: z.number().int().nonnegative(), endFrame: z.number().int().nonnegative(), type: z.string().trim().min(1).max(50), score: z.number().min(0).max(10).nullable(), notes: z.array(z.string().trim().min(1).max(2000)).max(30) }).strict().safeParse(req.body);
    if (!sessionId.success || !actionId.success || !input.success || input.data.endFrame < input.data.startFrame) return fail(res, 400, "Check the action review and frame interval.");
    const { data: sessionState, error: sessionStateError } = await supabaseAdmin.from("sessions")
      .select("status").eq("session_id", sessionId.data).maybeSingle();
    if (sessionStateError) throw new Error(`Unable to verify session state: ${sessionStateError.message}`);
    if (!sessionState) return res.sendStatus(404);
    if (["pending", "uploading", "queued", "running"].includes(sessionState.status)) return fail(res, 409, "Actions cannot be changed while the session is running.");
    const notes = [...new Set(input.data.notes)];
    const remote = await analysisRequest(`/sessions/${sessionId.data}/actions/${actionId.data}`, current.user.id, "PATCH", true, {
      startFrame: input.data.startFrame,
      endFrame: input.data.endFrame,
      type: input.data.type,
    });
    const remoteResult = await remote.json().catch(() => ({}));
    if (!remote.ok) return fail(res, remote.status, (remoteResult as { detail?: string }).detail ?? "Unable to update action data.");
    const { data: existing, error: readError } = await supabaseAdmin.from("annotations")
      .select("score,annotations_notes(note)").eq("action_id", actionId.data).maybeSingle();
    if (readError) throw new Error(`Unable to load action review: ${readError.message}`);
    if (input.data.score === null && notes.length === 0) {
      if (existing) {
        const { error } = await supabaseAdmin.from("annotations").delete().eq("action_id", actionId.data);
        if (error) throw new Error(`Unable to remove action review: ${error.message}`);
      }
      return res.json({ ok: true });
    }
    const previousNotes = (existing?.annotations_notes ?? []).map((row) => row.note);
    const previousScore = existing?.score == null ? null : Number(existing.score);
    const reviewUnchanged = existing && previousScore === input.data.score
      && previousNotes.length === notes.length && previousNotes.every((note) => notes.includes(note));
    if (reviewUnchanged) return res.json({ ok: true });
    const { error } = await supabaseAdmin.rpc("save_action_review", {
      p_session_id: sessionId.data, p_action_id: actionId.data,
      p_user_id: current.user.id, p_score: input.data.score, p_notes: notes,
    });
    if (error) throw new Error(`Unable to save action review: ${error.message}`);
    return res.json({ ok: true });
  }));

  app.delete("/api/admin/users/:userId", asyncRoute(async (req, res) => {
    const current = await admin(req, res); if (!current) return;
    const id = uuid.safeParse(req.params.userId); if (!id.success) return res.sendStatus(404);
    if (id.data === current.user.id) return fail(res, 400, "You cannot delete your own administrator account.");
    const mode = z.enum(["keep_data", "delete_data"]).safeParse(req.body?.mode);
    if (!mode.success) return fail(res, 400, "Choose whether to keep or delete this account's players and sessions.");
    const { data: target, error } = await supabaseAdmin.from("users").select("user_id,account_role,image_path").eq("user_id", id.data).maybeSingle();
    if (error) throw new Error(`Unable to load account: ${error.message}`);
    if (!target) return res.sendStatus(404);
    const { data: players, error: playersError } = await supabaseAdmin.from("players")
      .select("player_id,image_path").eq("user_id", id.data);
    if (playersError) throw new Error(`Unable to load account players: ${playersError.message}`);
    if (mode.data === "delete_data") {
      const playerIds = (players ?? []).map((player) => player.player_id);
      const direct = await supabaseAdmin.from("sessions").select("session_id").eq("user_id", id.data);
      if (direct.error) throw new Error(`Unable to load account sessions: ${direct.error.message}`);
      const linked = playerIds.length
        ? await supabaseAdmin.from("sessions").select("session_id").in("player_id", playerIds)
        : { data: [], error: null };
      if (linked.error) throw new Error(`Unable to load player sessions: ${linked.error.message}`);
      const sessionIds = [...new Set([...(direct.data ?? []), ...(linked.data ?? [])].map((row) => row.session_id))];
      for (const sessionId of sessionIds) await deleteStoredSession(sessionId, current.user.id, true);
      if (playerIds.length) {
        const { error: playerDeleteError } = await supabaseAdmin.from("players").delete().in("player_id", playerIds);
        if (playerDeleteError) throw new Error(`Unable to delete account players: ${playerDeleteError.message}`);
      }
      await removeImages((players ?? []).map((player) => player.image_path));
    }
    const { error: assignmentError } = await supabaseAdmin.from("users_subscriptions").delete().eq("user_id", id.data);
    if (assignmentError) throw new Error(`Unable to remove account subscription: ${assignmentError.message}`);
    const { error: authError } = await supabaseAdmin.auth.admin.deleteUser(id.data);
    if (authError) throw new Error(`Unable to remove authentication account: ${authError.message}`);
    const { error: profileError } = await supabaseAdmin.from("users").delete().eq("user_id", id.data);
    if (profileError) throw new Error(`Authentication account was removed but profile cleanup failed: ${profileError.message}`);
    await removeImages([target.image_path])
      .catch((imageError) => console.error("Account was deleted but some profile images could not be removed", imageError));
    return res.sendStatus(204);
  }));
}