Fix feedback author attribution and stage one-time repair

src/admin.ts

@@ -1,5 +1,6 @@
 import { readBatches } from "./read-batches.js";
 import { readPages } from "./read-pages.js";
+import { createHash } from "node:crypto";
 import type { Express, Request, Response, NextFunction } from "express";
 import { z } from "zod";
 import { env } from "./config.js";
@@ -71,6 +72,56 @@ async function loadRelatedCounts(table: "players" | "sessions" | "actions", key:
 }
 
 export function registerAdminRoutes(app: Express) {
+  // Temporary one-time repair endpoint. Remove after the production attribution repair.
+  const feedbackAuthorId = "474bbc30-5535-4c06-8010-6d59d01949c0";
+  async function feedbackAuthorSnapshot() {
+    const notes = await readPages(async (from, to) => {
+      const { data, error } = await supabaseAdmin.from("annotations_notes").select("action_id")
+        .order("action_id").order("note").range(from, to);
+      if (error) throw new Error(`Unable to list feedback notes: ${error.message}`);
+      return data ?? [];
+    });
+    const ids = [...new Set(notes.map((note) => note.action_id))];
+    const rows: { action_id: string; user_id: string | null }[] = [];
+    for (let index = 0; index < ids.length; index += 100) {
+      const { data, error } = await supabaseAdmin.from("annotations").select("action_id,user_id")
+        .in("action_id", ids.slice(index, index + 100));
+      if (error) throw new Error(`Unable to list feedback authors: ${error.message}`);
+      rows.push(...(data ?? []));
+    }
+    if (rows.length !== ids.length) throw new Error("Feedback author snapshot is incomplete.");
+    rows.sort((a, b) => a.action_id.localeCompare(b.action_id));
+    const fingerprint = createHash("sha256").update(JSON.stringify(rows)).digest("hex");
+    return { rows, noteCount: notes.length, fingerprint };
+  }
+  app.get("/api/admin/repair-feedback-authors", asyncRoute(async (req, res) => {
+    if (!await admin(req, res)) return;
+    const { data: author, error } = await supabaseAdmin.from("users").select("fname,lname")
+      .eq("user_id", feedbackAuthorId).maybeSingle();
+    if (error || author?.fname !== "Ahmed" || author?.lname !== "Gad") throw new Error("Target feedback author could not be verified.");
+    const snapshot = await feedbackAuthorSnapshot();
+    return res.json({ ...snapshot, targetUserId: feedbackAuthorId });
+  }));
+  app.post("/api/admin/repair-feedback-authors", asyncRoute(async (req, res) => {
+    if (!await admin(req, res)) return;
+    const input = z.object({ fingerprint: z.string().regex(/^[a-f0-9]{64}$/) }).strict().safeParse(req.body);
+    if (!input.success) return fail(res, 400, "A current feedback snapshot is required.");
+    const { data: author, error } = await supabaseAdmin.from("users").select("fname,lname")
+      .eq("user_id", feedbackAuthorId).maybeSingle();
+    if (error || author?.fname !== "Ahmed" || author?.lname !== "Gad") throw new Error("Target feedback author could not be verified.");
+    const snapshot = await feedbackAuthorSnapshot();
+    if (snapshot.fingerprint !== input.data.fingerprint) return fail(res, 409, "Feedback authors changed. Refresh the snapshot.");
+    const ids = snapshot.rows.filter((row) => row.user_id !== feedbackAuthorId).map((row) => row.action_id);
+    for (let index = 0; index < ids.length; index += 100) {
+      const { error: updateError } = await supabaseAdmin.from("annotations")
+        .update({ user_id: feedbackAuthorId }).in("action_id", ids.slice(index, index + 100));
+      if (updateError) throw new Error(`Unable to update feedback authors: ${updateError.message}`);
+    }
+    const verified = await feedbackAuthorSnapshot();
+    if (verified.rows.some((row) => row.user_id !== feedbackAuthorId)) throw new Error("Feedback author verification failed.");
+    return res.json({ updatedAnnotations: ids.length, totalAnnotations: verified.rows.length,
+      noteCount: verified.noteCount, targetUserId: feedbackAuthorId, fingerprint: verified.fingerprint });
+  }));
   app.get("/api/admin/users", asyncRoute(async (req, res) => {
     if (!await admin(req, res)) return;
     const search = String(req.query.search ?? "").replace(/[^\p{L}\p{N}@._ -]/gu, "").trim().slice(0, 100);
@@ -335,22 +386,26 @@ export function registerAdminRoutes(app: Express) {
     });
     const remoteResult = await remote.json().catch(() => ({}));
     if (!remote.ok) return fail(res, remote.status, (remoteResult as { detail?: string }).detail ?? "Unable to update action data.");
-    const { data: existing, error: readError } = await supabaseAdmin.from("annotations").select("user_id").eq("action_id", actionId.data).maybeSingle();
+    const { data: existing, error: readError } = await supabaseAdmin.from("annotations")
+      .select("score,annotations_notes(note)").eq("action_id", actionId.data).maybeSingle();
     if (readError) throw new Error(`Unable to load action review: ${readError.message}`);
-    if (input.data.score !== null || notes.length) {
-      const { error } = await supabaseAdmin.from("annotations").upsert({ action_id: actionId.data, user_id: existing?.user_id ?? current.user.id, score: input.data.score }, { onConflict: "action_id" });
-      if (error) throw new Error(`Unable to save action review: ${error.message}`);
-    } else {
-      const { error } = await supabaseAdmin.from("annotations").delete().eq("action_id", actionId.data);
-      if (error) throw new Error(`Unable to remove action review: ${error.message}`);
+    if (input.data.score === null && notes.length === 0) {
+      if (existing) {
+        const { error } = await supabaseAdmin.from("annotations").delete().eq("action_id", actionId.data);
+        if (error) throw new Error(`Unable to remove action review: ${error.message}`);
+      }
       return res.json({ ok: true });
     }
-    const { error: clearError } = await supabaseAdmin.from("annotations_notes").delete().eq("action_id", actionId.data);
-    if (clearError) throw new Error(`Unable to replace action notes: ${clearError.message}`);
-    if (notes.length) {
-      const { error } = await supabaseAdmin.from("annotations_notes").upsert(notes.map((note) => ({ action_id: actionId.data, note })), { onConflict: "action_id,note", ignoreDuplicates: true });
-      if (error) throw new Error(`Unable to save action notes: ${error.message}`);
-    }
+    const previousNotes = (existing?.annotations_notes ?? []).map((row) => row.note);
+    const previousScore = existing?.score == null ? null : Number(existing.score);
+    const reviewUnchanged = existing && previousScore === input.data.score
+      && previousNotes.length === notes.length && previousNotes.every((note) => notes.includes(note));
+    if (reviewUnchanged) return res.json({ ok: true });
+    const { error } = await supabaseAdmin.rpc("save_action_review", {
+      p_session_id: sessionId.data, p_action_id: actionId.data,
+      p_user_id: current.user.id, p_score: input.data.score, p_notes: notes,
+    });
+    if (error) throw new Error(`Unable to save action review: ${error.message}`);
     return res.json({ ok: true });
   }));