Add admin management console and APIs

app.py

@@ -53,11 +53,12 @@ def hub():
     return HfApi(token=os.environ["HF_TOKEN"])
 
 
-def backend(path, user_id, method="GET", body=None):
+def backend(path, user_id, method="GET", body=None, is_admin=False):
     for attempt in range(3):
         try:
             response = httpx.request(method, f'{os.environ["BACKEND_INTERNAL_URL"].rstrip("/")}/internal/analysis{path}',
-                json=body, timeout=60, headers={"x-sporalize-proxy-secret": os.environ["ANALYSIS_PROXY_SECRET"], "x-sporalize-user-id": user_id})
+                json=body, timeout=60, headers={"x-sporalize-proxy-secret": os.environ["ANALYSIS_PROXY_SECRET"], "x-sporalize-user-id": user_id,
+                    **({"x-sporalize-admin": "true"} if is_admin else {})})
             response.raise_for_status()
             return response.json() if response.content else None
         except (httpx.TransportError, httpx.HTTPStatusError) as error:
@@ -153,6 +154,7 @@ async def authenticate(request: Request, call_next):
             request.state.user_id = str(UUID(request.headers.get("x-sporalize-user-id", "")))
         except ValueError:
             return JSONResponse({"detail": "Invalid user identity"}, status_code=403)
+        request.state.is_admin = request.headers.get("x-sporalize-admin") == "true"
     return await call_next(request)
 
 
@@ -580,9 +582,9 @@ def result_action_id(session_id, index):
     return f"{digest[:8]}-{digest[8:12]}-5{digest[13:16]}-8{digest[17:20]}-{digest[20:32]}"
 
 
-def owned_session_row(session_id, user_id):
+def owned_session_row(session_id, user_id, is_admin=False):
     row = backend(f"/{session_id}", user_id)
-    if row.get("user_id") != user_id:
+    if row.get("user_id") != user_id and not is_admin:
         raise HTTPException(404, "Session not found")
     return row
 
@@ -601,7 +603,7 @@ def upload_session_results(path_in_repo, payload, commit_message):
 
 @app.delete("/api/sessions/{session_id}/actions/{action_id}")
 def delete_action(session_id: UUID, action_id: UUID, request: Request):
-    row = owned_session_row(session_id, request.state.user_id)
+    row = owned_session_row(session_id, request.state.user_id, request.state.is_admin)
     if row.get("path") != f"sessions/{session_id}":
         raise HTTPException(409, "Session results are not available")
 
@@ -627,7 +629,7 @@ def delete_action(session_id: UUID, action_id: UUID, request: Request):
     updated_payload = json.dumps(json_value(updated_reports), allow_nan=False).encode("utf-8")
     upload_session_results(result_path, updated_payload, f"Delete action {action_id}")
     try:
-        backend(f"/{session_id}/actions/{action_id}", request.state.user_id, "DELETE")
+        backend(f"/{session_id}/actions/{action_id}", request.state.user_id, "DELETE", is_admin=request.state.is_admin)
     except Exception:
         try:
             upload_session_results(result_path, original_payload, f"Restore action {action_id} after delete failure")
@@ -637,9 +639,55 @@ def delete_action(session_id: UUID, action_id: UUID, request: Request):
     return {"ok": True}
 
 
+@app.patch("/api/sessions/{session_id}/actions/{action_id}")
+def update_action(session_id: UUID, action_id: UUID, payload: dict, request: Request):
+    if not request.state.is_admin:
+        raise HTTPException(403, "Administrator access is required")
+    row = owned_session_row(session_id, request.state.user_id, True)
+    if row.get("path") != f"sessions/{session_id}":
+        raise HTTPException(409, "Session results are not available")
+
+    start_frame = payload.get("startFrame")
+    end_frame = payload.get("endFrame")
+    action_type = payload.get("type")
+    if not isinstance(start_frame, int) or isinstance(start_frame, bool) or start_frame < 0:
+        raise HTTPException(400, "Start frame must be a non-negative integer")
+    if not isinstance(end_frame, int) or isinstance(end_frame, bool) or end_frame < start_frame:
+        raise HTTPException(400, "End frame must be an integer greater than or equal to the start frame")
+    if not isinstance(action_type, str) or not action_type.strip() or len(action_type.strip()) > 50:
+        raise HTTPException(400, "Action type is invalid")
+
+    result_path = f'{row["path"]}/results.json'
+    downloaded_path = hf_hub_download(repo_id=os.environ["STORAGE_REPO_ID"], repo_type="dataset",
+        filename=result_path, token=os.environ["HF_TOKEN"])
+    original_payload = Path(downloaded_path).read_bytes()
+    reports = json.loads(original_payload.decode("utf-8"))
+    matching_index = next((index for index, report in enumerate(reports)
+        if not report.get("error") and not report.get("_deleted")
+        and result_action_id(session_id, index) == str(action_id)), None)
+    if matching_index is None:
+        raise HTTPException(404, "Action not found")
+    reports[matching_index]["start_frame"] = start_frame
+    reports[matching_index]["end_frame"] = end_frame
+    reports[matching_index]["action"] = action_type.strip()
+    updated_payload = json.dumps(json_value(reports), allow_nan=False).encode("utf-8")
+    upload_session_results(result_path, updated_payload, f"Update action {action_id}")
+    try:
+        backend(f"/{session_id}/actions/{action_id}", request.state.user_id, "PATCH", {
+            "startFrame": start_frame, "endFrame": end_frame, "type": action_type.strip(),
+        }, is_admin=True)
+    except Exception:
+        try:
+            upload_session_results(result_path, original_payload, f"Restore action {action_id} after update failure")
+        except Exception:
+            logger.exception("Could not restore session results after action update failed: session=%s action=%s", session_id, action_id)
+        raise
+    return {"ok": True}
+
+
 @app.delete("/api/sessions/{session_id}")
 def delete_session(session_id: UUID, request: Request):
-    row = owned_session_row(session_id, request.state.user_id)
+    row = owned_session_row(session_id, request.state.user_id, request.state.is_admin)
     expected_path = f"sessions/{session_id}"
     storage_path = row.get("path")
     if storage_path is not None and storage_path != expected_path:
@@ -654,7 +702,7 @@ def delete_session(session_id: UUID, request: Request):
                 path_in_repo=storage_path, commit_message=f"Delete session {session_id}",
             )
 
-    backend(f"/{session_id}", request.state.user_id, "DELETE")
+    backend(f"/{session_id}", request.state.user_id, "DELETE", is_admin=request.state.is_admin)
     return {"ok": True}
 
 

src/admin.ts

@@ -0,0 +1,343 @@
+import type { Express, Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { env } from "./config.js";
+import { supabaseAdmin } from "./supabase.js";
+import { requireAdmin } from "./server.js";
+import { invalidateSubscriptionCache } from "./subscriptions.js";
+
+const uuid = z.uuid();
+const date = z.string().regex(/^\d{4}-\d{2}-\d{2}$/);
+const profileSchema = z.object({
+  fname: z.string().trim().min(1).max(100), lname: z.string().trim().min(1).max(100),
+  academy: z.string().trim().max(150).nullable(), role: z.string().trim().max(50).nullable(),
+}).strict();
+const playerSchema = z.object({
+  name: z.string().trim().min(1).max(200), age: z.number().int().min(4).max(60).nullable().optional(),
+  heightCm: z.number().min(100).max(230).nullable().optional(), weightKg: z.number().min(20).max(150).nullable().optional(),
+  club: z.string().trim().max(150).nullable().optional(), position: z.string().trim().max(50).nullable().optional(),
+  gender: z.enum(["male", "female"]).nullable().optional(), userId: uuid.nullable().optional(),
+}).strict();
+
+function fail(res: Response, status: number, error: string) { return res.status(status).json({ error }); }
+function asyncRoute(handler: (req: Request, res: Response) => Promise<unknown>) {
+  return (req: Request, res: Response, next: NextFunction) => { void handler(req, res).catch(next); };
+}
+async function admin(req: Request, res: Response) { return requireAdmin(req, res); }
+function playerName(name: string) {
+  const [fname, ...parts] = name.split(/\s+/);
+  return { fname, lname: parts.join(" ") };
+}
+function ageDate(age?: number | null) {
+  if (age == null) return null;
+  const birth = new Date();
+  birth.setUTCFullYear(birth.getUTCFullYear() - age);
+  return birth.toISOString().slice(0, 10);
+}
+
+async function analysisRequest(path: string, userId: string, method: string, isAdmin = true) {
+  const response = await fetch(`${env.ANALYSIS_API_URL}/api${path}`, {
+    method,
+    headers: {
+      "x-sporalize-proxy-secret": env.ANALYSIS_PROXY_SECRET,
+      "x-sporalize-user-id": userId,
+      ...(isAdmin ? { "x-sporalize-admin": "true" } : {}),
+    },
+  });
+  if (!response.ok) throw new Error(`Analysis storage request failed (${response.status}).`);
+  return response;
+}
+
+async function removeImages(paths: Array<string | null | undefined>) {
+  const safe = [...new Set(paths.filter((path): path is string => Boolean(path) && /^(players|users)\/[0-9a-f-]{36}\/[0-9a-f-]{36}\.(jpg|png|webp)$/i.test(path!)))];
+  if (!safe.length) return;
+  const { error } = await supabaseAdmin.storage.from("profile-images").remove(safe);
+  if (error) throw new Error(`Unable to remove profile images: ${error.message}`);
+}
+
+export function registerAdminRoutes(app: Express) {
+  app.get("/api/admin/users", asyncRoute(async (req, res) => {
+    if (!await admin(req, res)) return;
+    const search = String(req.query.search ?? "").replace(/[^\p{L}\p{N}@._ -]/gu, "").trim().slice(0, 100);
+    let query = supabaseAdmin.from("users").select("user_id,fname,lname,email,academy,role,image_path,account_role").order("fname").limit(250);
+    if (search) query = query.or(`fname.ilike.%${search}%,lname.ilike.%${search}%,email.ilike.%${search}%`);
+    const { data, error } = await query;
+    if (error) throw new Error(`Unable to load user directory: ${error.message}`);
+    const ids = (data ?? []).map((row) => row.user_id);
+    const [subs, counts] = ids.length ? await Promise.all([
+      supabaseAdmin.from("users_subscriptions").select("user_id,subscription_id,startdate,enddate,num_players,num_sessions,num_sessions_month").in("user_id", ids),
+      supabaseAdmin.from("sessions").select("user_id").in("user_id", ids),
+    ]) : [{ data: [], error: null }, { data: [], error: null }];
+    if (subs.error) throw new Error(`Unable to load user plans: ${subs.error.message}`);
+    if (counts.error) throw new Error(`Unable to load user session counts: ${counts.error.message}`);
+    const planIds = [...new Set((subs.data ?? []).flatMap((row) => row.subscription_id ? [row.subscription_id] : []))];
+    const { data: plans, error: plansError } = planIds.length
+      ? await supabaseAdmin.from("subscriptions").select("subscription_id,plan,price,player_limit,monthly_session_limit").in("subscription_id", planIds)
+      : { data: [], error: null };
+    if (plansError) throw new Error(`Unable to load plan names: ${plansError.message}`);
+    const planMap = new Map((plans ?? []).map((plan) => [plan.subscription_id, plan]));
+    const subMap = new Map((subs.data ?? []).map((row) => [row.user_id, row]));
+    const sessionCounts = new Map<string, number>();
+    for (const row of counts.data ?? []) if (row.user_id) sessionCounts.set(row.user_id, (sessionCounts.get(row.user_id) ?? 0) + 1);
+    return res.json({ users: (data ?? []).map((row) => {
+      const assignment = String(row.account_role).toLowerCase() === "admin" ? null : subMap.get(row.user_id);
+      const plan = assignment?.subscription_id ? planMap.get(assignment.subscription_id) : null;
+      return {
+        id: row.user_id, fname: row.fname, lname: row.lname, name: `${row.fname} ${row.lname}`.trim(),
+        email: row.email, academy: row.academy, role: row.role, imagePath: row.image_path, accountRole: row.account_role,
+        subscription: plan ? { id: plan.subscription_id, name: plan.plan, startDate: assignment?.startdate, endDate: assignment?.enddate, playerLimit: plan.player_limit, sessionLimit: plan.monthly_session_limit } : null,
+        usage: { players: assignment?.num_players ?? 0, sessions: assignment?.num_sessions_month ?? assignment?.num_sessions ?? 0, totalSessions: sessionCounts.get(row.user_id) ?? 0 },
+      };
+    }) });
+  }));
+
+  app.get("/api/admin/plans", asyncRoute(async (req, res) => {
+    if (!await admin(req, res)) return;
+    const { data, error } = await supabaseAdmin.from("subscriptions").select("subscription_id,plan,price,player_limit,monthly_session_limit").order("price");
+    if (error) throw new Error(`Unable to load plans: ${error.message}`);
+    return res.json({ plans: data ?? [] });
+  }));
+
+  app.get("/api/admin/users/:userId", asyncRoute(async (req, res) => {
+    if (!await admin(req, res)) return;
+    const id = uuid.safeParse(req.params.userId); if (!id.success) return res.sendStatus(404);
+    const [{ data: user, error }, { data: assignment, error: subError }] = await Promise.all([
+      supabaseAdmin.from("users").select("user_id,fname,lname,email,academy,role,image_path,account_role").eq("user_id", id.data).maybeSingle(),
+      supabaseAdmin.from("users_subscriptions").select("subscription_id,startdate,enddate,num_players,num_sessions,num_sessions_month").eq("user_id", id.data).maybeSingle(),
+    ]);
+    if (error) throw new Error(`Unable to load user: ${error.message}`);
+    if (subError) throw new Error(`Unable to load user plan: ${subError.message}`);
+    if (!user) return res.sendStatus(404);
+    return res.json({ user, subscription: assignment ?? null });
+  }));
+
+  app.patch("/api/admin/users/:userId", asyncRoute(async (req, res) => {
+    if (!await admin(req, res)) return;
+    const id = uuid.safeParse(req.params.userId); const input = profileSchema.safeParse(req.body);
+    if (!id.success || !input.success) return fail(res, 400, "Check the profile details.");
+    const { data, error } = await supabaseAdmin.from("users").update(input.data).eq("user_id", id.data)
+      .select("user_id,fname,lname,email,academy,role,image_path,account_role").maybeSingle();
+    if (error) throw new Error(`Unable to update profile: ${error.message}`);
+    if (!data) return res.sendStatus(404);
+    return res.json({ user: data });
+  }));
+
+  app.put("/api/admin/users/:userId/subscription", asyncRoute(async (req, res) => {
+    if (!await admin(req, res)) return;
+    const id = uuid.safeParse(req.params.userId);
+    const input = z.object({ subscriptionId: uuid, startDate: date, endDate: date }).strict().safeParse(req.body);
+    if (!id.success || !input.success || input.data.endDate < input.data.startDate) return fail(res, 400, "Choose a valid plan period.");
+    const { data: account, error: accountError } = await supabaseAdmin.from("users").select("account_role").eq("user_id", id.data).maybeSingle();
+    if (accountError) throw new Error(`Unable to verify account: ${accountError.message}`);
+    if (!account) return res.sendStatus(404);
+    if (String(account.account_role).toLowerCase() === "admin") return fail(res, 409, "Administrator accounts do not use subscriptions.");
+    const { data: plan, error: planError } = await supabaseAdmin.from("subscriptions").select("subscription_id").eq("subscription_id", input.data.subscriptionId).maybeSingle();
+    if (planError) throw new Error(`Unable to verify plan: ${planError.message}`);
+    if (!plan) return fail(res, 404, "Plan not found.");
+    const { data: row, error } = await supabaseAdmin.from("users_subscriptions").upsert({
+      user_id: id.data, subscription_id: plan.subscription_id, startdate: input.data.startDate, enddate: input.data.endDate,
+      num_players: 0, num_sessions: 0, num_sessions_month: 0,
+    }, { onConflict: "user_id" }).select("user_id,subscription_id,startdate,enddate,num_players,num_sessions,num_sessions_month").single();
+    if (error) throw new Error(`Unable to assign plan: ${error.message}`);
+    invalidateSubscriptionCache(id.data);
+    return res.json({ subscription: row });
+  }));
+
+  app.delete("/api/admin/users/:userId/subscription", asyncRoute(async (req, res) => {
+    if (!await admin(req, res)) return;
+    const id = uuid.safeParse(req.params.userId); if (!id.success) return res.sendStatus(404);
+    const { error } = await supabaseAdmin.from("users_subscriptions").update({ subscription_id: null, num_players: 0, num_sessions: 0, num_sessions_month: 0 })
+      .eq("user_id", id.data);
+    if (error) throw new Error(`Unable to cancel plan: ${error.message}`);
+    invalidateSubscriptionCache(id.data);
+    return res.sendStatus(204);
+  }));
+
+  app.get("/api/admin/players", asyncRoute(async (req, res) => {
+    if (!await admin(req, res)) return;
+    const [{ data: players, error }, { data: users, error: userError }] = await Promise.all([
+      supabaseAdmin.from("players").select("player_id,user_id,fname,lname,bdate,height,weight,position,club,gender,image_path").order("fname").limit(1000),
+      supabaseAdmin.from("users").select("user_id,fname,lname,email").order("fname").limit(1000),
+    ]);
+    if (error) throw new Error(`Unable to load players: ${error.message}`);
+    if (userError) throw new Error(`Unable to load owners: ${userError.message}`);
+    const owners = new Map((users ?? []).map((user) => [user.user_id, user]));
+    return res.json({ players: (players ?? []).map((player) => {
+      const owner = player.user_id ? owners.get(player.user_id) : null;
+      return { ...player, owner: owner ? `${owner.fname} ${owner.lname}`.trim() || owner.email : null };
+    }), users: users ?? [] });
+  }));
+
+  app.post("/api/admin/players", asyncRoute(async (req, res) => {
+    if (!await admin(req, res)) return;
+    const input = playerSchema.safeParse(req.body); if (!input.success) return fail(res, 400, "Check the player details.");
+    if (input.data.userId) {
+      const { data, error } = await supabaseAdmin.from("users").select("user_id").eq("user_id", input.data.userId).maybeSingle();
+      if (error) throw new Error(`Unable to verify player owner: ${error.message}`);
+      if (!data) return fail(res, 404, "Player owner not found.");
+    }
+    const { fname, lname } = playerName(input.data.name);
+    const { data, error } = await supabaseAdmin.from("players").insert({
+      user_id: input.data.userId ?? null, fname, lname, bdate: ageDate(input.data.age), height: input.data.heightCm ?? null,
+      weight: input.data.weightKg ?? null, club: input.data.club || null, position: input.data.position || null, gender: input.data.gender ?? null,
+    }).select("player_id,user_id,fname,lname,position,club,gender,image_path").single();
+    if (error) throw new Error(`Unable to add player: ${error.message}`);
+    return res.status(201).json({ player: data });
+  }));
+
+  app.patch("/api/admin/players/:playerId", asyncRoute(async (req, res) => {
+    if (!await admin(req, res)) return;
+    const id = uuid.safeParse(req.params.playerId);
+    const input = z.object({ userId: uuid.nullable() }).strict().safeParse(req.body);
+    if (!id.success || !input.success) return fail(res, 400, "Choose a valid owner.");
+    if (input.data.userId) {
+      const { data, error } = await supabaseAdmin.from("users").select("user_id").eq("user_id", input.data.userId).maybeSingle();
+      if (error) throw new Error(`Unable to verify player owner: ${error.message}`);
+      if (!data) return fail(res, 404, "Player owner not found.");
+    }
+    const { data, error } = await supabaseAdmin.from("players").update({ user_id: input.data.userId }).eq("player_id", id.data).select("player_id,user_id").maybeSingle();
+    if (error) throw new Error(`Unable to transfer player: ${error.message}`);
+    if (!data) return res.sendStatus(404);
+    return res.json({ player: data });
+  }));
+
+  app.delete("/api/admin/players/:playerId", asyncRoute(async (req, res) => {
+    if (!await admin(req, res)) return;
+    const id = uuid.safeParse(req.params.playerId); if (!id.success) return res.sendStatus(404);
+    const { data: player, error: readError } = await supabaseAdmin.from("players").select("player_id,image_path").eq("player_id", id.data).maybeSingle();
+    if (readError) throw new Error(`Unable to load player: ${readError.message}`);
+    if (!player) return res.sendStatus(404);
+    const { error } = await supabaseAdmin.from("players").delete().eq("player_id", id.data);
+    if (error) throw new Error(`Unable to delete player: ${error.message}`);
+    await removeImages([player.image_path]).catch((imageError) => console.error("Player was deleted but its profile image could not be removed", imageError));
+    return res.sendStatus(204);
+  }));
+
+  app.get("/api/admin/sessions", asyncRoute(async (req, res) => {
+    if (!await admin(req, res)) return;
+    const [{ data: sessions, error }, { data: users, error: usersError }, { data: players, error: playersError }] = await Promise.all([
+      supabaseAdmin.from("sessions").select("session_id,user_id,player_id,name,path,status,created_at").order("created_at", { ascending: false }).limit(1000),
+      supabaseAdmin.from("users").select("user_id,fname,lname,email").order("fname").limit(1000),
+      supabaseAdmin.from("players").select("player_id,fname,lname").order("fname").limit(1000),
+    ]);
+    if (error) throw new Error(`Unable to load sessions: ${error.message}`);
+    if (usersError) throw new Error(`Unable to load owners: ${usersError.message}`);
+    if (playersError) throw new Error(`Unable to load session players: ${playersError.message}`);
+    const owners = new Map((users ?? []).map((user) => [user.user_id, user]));
+    const roster = new Map((players ?? []).map((player) => [player.player_id, player]));
+    const ids = (sessions ?? []).map((session) => session.session_id);
+    const { data: actionRows, error: actionsError } = ids.length
+      ? await supabaseAdmin.from("actions").select("session_id").in("session_id", ids)
+      : { data: [], error: null };
+    if (actionsError) throw new Error(`Unable to load session action counts: ${actionsError.message}`);
+    const actionCounts = new Map<string, number>();
+    for (const action of actionRows ?? []) if (action.session_id) actionCounts.set(action.session_id, (actionCounts.get(action.session_id) ?? 0) + 1);
+    return res.json({ sessions: (sessions ?? []).map((session) => {
+      const owner = session.user_id ? owners.get(session.user_id) : null;
+      const player = session.player_id ? roster.get(session.player_id) : null;
+      return {
+        ...session,
+        owner: owner ? `${owner.fname} ${owner.lname}`.trim() || owner.email : null,
+        player: player ? `${player.fname} ${player.lname}`.trim() : null,
+        actionCount: actionCounts.get(session.session_id) ?? 0,
+      };
+    }), users: users ?? [], players: players ?? [] });
+  }));
+
+  app.patch("/api/admin/sessions/:sessionId", asyncRoute(async (req, res) => {
+    if (!await admin(req, res)) return;
+    const id = uuid.safeParse(req.params.sessionId);
+    const input = z.object({ userId: uuid.nullable() }).strict().safeParse(req.body);
+    if (!id.success || !input.success) return fail(res, 400, "Choose a valid session owner.");
+    if (input.data.userId) {
+      const { data, error } = await supabaseAdmin.from("users").select("user_id").eq("user_id", input.data.userId).maybeSingle();
+      if (error) throw new Error(`Unable to verify session owner: ${error.message}`);
+      if (!data) return fail(res, 404, "Session owner not found.");
+    }
+    const { data, error } = await supabaseAdmin.from("sessions").update({ user_id: input.data.userId }).eq("session_id", id.data).select("session_id,user_id").maybeSingle();
+    if (error) throw new Error(`Unable to transfer session: ${error.message}`);
+    if (!data) return res.sendStatus(404);
+    return res.json({ session: data });
+  }));
+
+  app.delete("/api/admin/sessions/:sessionId", asyncRoute(async (req, res) => {
+    const current = await admin(req, res); if (!current) return;
+    const id = uuid.safeParse(req.params.sessionId); if (!id.success) return res.sendStatus(404);
+    await analysisRequest(`/sessions/${id.data}`, current.user.id, "DELETE");
+    return res.sendStatus(204);
+  }));
+
+  app.get("/api/admin/sessions/:sessionId", asyncRoute(async (req, res) => {
+    if (!await admin(req, res)) return;
+    const id = uuid.safeParse(req.params.sessionId); if (!id.success) return res.sendStatus(404);
+    const { data: session, error } = await supabaseAdmin.from("sessions").select("session_id,user_id,player_id,name,path,status,created_at").eq("session_id", id.data).maybeSingle();
+    if (error) throw new Error(`Unable to load session: ${error.message}`);
+    if (!session) return res.sendStatus(404);
+    const { data: actions, error: actionsError } = await supabaseAdmin.from("actions").select("action_id,start_frame,end_frame,type").eq("session_id", id.data).order("start_frame");
+    if (actionsError) throw new Error(`Unable to load actions: ${actionsError.message}`);
+    const actionIds = (actions ?? []).map((action) => action.action_id);
+    const [{ data: annotations, error: annotationError }, { data: notes, error: notesError }] = actionIds.length ? await Promise.all([
+      supabaseAdmin.from("annotations").select("action_id,score,user_id").in("action_id", actionIds),
+      supabaseAdmin.from("annotations_notes").select("action_id,note").in("action_id", actionIds),
+    ]) : [{ data: [], error: null }, { data: [], error: null }];
+    if (annotationError) throw new Error(`Unable to load action annotations: ${annotationError.message}`);
+    if (notesError) throw new Error(`Unable to load action notes: ${notesError.message}`);
+    const annotationsById = new Map((annotations ?? []).map((row) => [row.action_id, row]));
+    const notesById = new Map<string, string[]>();
+    for (const row of notes ?? []) notesById.set(row.action_id, [...(notesById.get(row.action_id) ?? []), row.note]);
+    return res.json({ session, actions: (actions ?? []).map((action) => ({ ...action, score: annotationsById.get(action.action_id)?.score ?? null, notes: notesById.get(action.action_id) ?? [] })) });
+  }));
+
+  app.patch("/api/admin/sessions/:sessionId/actions/:actionId", asyncRoute(async (req, res) => {
+    const current = await admin(req, res); if (!current) return;
+    const sessionId = uuid.safeParse(req.params.sessionId); const actionId = uuid.safeParse(req.params.actionId);
+    const input = z.object({ startFrame: z.number().int().nonnegative(), endFrame: z.number().int().nonnegative(), type: z.string().trim().min(1).max(50), score: z.number().min(0).max(10).nullable(), notes: z.array(z.string().trim().min(1).max(2000)).max(30) }).strict().safeParse(req.body);
+    if (!sessionId.success || !actionId.success || !input.success || input.data.endFrame < input.data.startFrame) return fail(res, 400, "Check the action review and frame interval.");
+    const notes = [...new Set(input.data.notes)];
+    const remote = await analysisRequest(`/sessions/${sessionId.data}/actions/${actionId.data}`, current.user.id, "PATCH");
+    const remoteResult = await remote.json().catch(() => ({}));
+    if (!remote.ok) return fail(res, remote.status, (remoteResult as { detail?: string }).detail ?? "Unable to update action data.");
+    const { data: existing, error: readError } = await supabaseAdmin.from("annotations").select("user_id").eq("action_id", actionId.data).maybeSingle();
+    if (readError) throw new Error(`Unable to load action review: ${readError.message}`);
+    if (input.data.score !== null || notes.length) {
+      const { error } = await supabaseAdmin.from("annotations").upsert({ action_id: actionId.data, user_id: existing?.user_id ?? current.user.id, score: input.data.score }, { onConflict: "action_id" });
+      if (error) throw new Error(`Unable to save action review: ${error.message}`);
+    } else {
+      const { error } = await supabaseAdmin.from("annotations").delete().eq("action_id", actionId.data);
+      if (error) throw new Error(`Unable to remove action review: ${error.message}`);
+      return res.json({ ok: true });
+    }
+    const { error: clearError } = await supabaseAdmin.from("annotations_notes").delete().eq("action_id", actionId.data);
+    if (clearError) throw new Error(`Unable to replace action notes: ${clearError.message}`);
+    if (notes.length) {
+      const { error } = await supabaseAdmin.from("annotations_notes").upsert(notes.map((note) => ({ action_id: actionId.data, note })), { onConflict: "action_id,note", ignoreDuplicates: true });
+      if (error) throw new Error(`Unable to save action notes: ${error.message}`);
+    }
+    return res.json({ ok: true });
+  }));
+
+  app.delete("/api/admin/users/:userId", asyncRoute(async (req, res) => {
+    const current = await admin(req, res); if (!current) return;
+    const id = uuid.safeParse(req.params.userId); if (!id.success) return res.sendStatus(404);
+    if (id.data === current.user.id) return fail(res, 400, "You cannot delete your own administrator account.");
+    const { data: target, error } = await supabaseAdmin.from("users").select("user_id,account_role,image_path").eq("user_id", id.data).maybeSingle();
+    if (error) throw new Error(`Unable to load account: ${error.message}`);
+    if (!target) return res.sendStatus(404);
+    if (String(target.account_role).toLowerCase() === "admin") {
+      return fail(res, 409, "Administrator accounts cannot be deleted here. Change administrator access directly in the database first.");
+    }
+    const { data: sessions, error: sessionError } = await supabaseAdmin.from("sessions").select("session_id").eq("user_id", id.data);
+    if (sessionError) throw new Error(`Unable to load account sessions: ${sessionError.message}`);
+    for (const session of sessions ?? []) await analysisRequest(`/sessions/${session.session_id}`, current.user.id, "DELETE");
+    const { data: players, error: playersError } = await supabaseAdmin.from("players").select("player_id,image_path").eq("user_id", id.data);
+    if (playersError) throw new Error(`Unable to load account players: ${playersError.message}`);
+    const { error: playerDeleteError } = await supabaseAdmin.from("players").delete().eq("user_id", id.data);
+    if (playerDeleteError) throw new Error(`Unable to remove account players: ${playerDeleteError.message}`);
+    const { error: authError } = await supabaseAdmin.auth.admin.deleteUser(id.data);
+    if (authError) throw new Error(`Unable to remove authentication account: ${authError.message}`);
+    const { error: profileDeleteError } = await supabaseAdmin.from("users").delete().eq("user_id", id.data);
+    if (profileDeleteError) throw new Error(`Account authentication was removed but profile cleanup failed: ${profileDeleteError.message}`);
+    await removeImages([target.image_path, ...(players ?? []).map((player) => player.image_path)])
+      .catch((imageError) => console.error("Account was deleted but some profile images could not be removed", imageError));
+    return res.sendStatus(204);
+  }));
+}

src/analysis.ts

@@ -39,6 +39,7 @@ export function analysisRouter(db: SupabaseClient, secret: string) {
     const user = z.uuid().safeParse(req.header("x-sporalize-user-id"));
     if (!user.success) return res.sendStatus(403);
     res.locals.userId = user.data;
+    res.locals.isAdmin = req.header("x-sporalize-admin") === "true";
     next();
   });
   router.use(express.json({ limit: "2mb" }));
@@ -46,25 +47,38 @@ export function analysisRouter(db: SupabaseClient, secret: string) {
     try {
       const input = beginSchema.parse(req.body);
       const userId = res.locals.userId as string;
-      const subscription = await activeSubscriptionFor(userId, { refresh: true });
-      if (!subscription) {
+      const isAdmin = res.locals.isAdmin === true;
+      const subscription = isAdmin ? null : await activeSubscriptionFor(userId, { refresh: true });
+      if (!isAdmin && !subscription) {
         return res.status(402).json({ error: "An active subscription is required to start a new analysis.", code: "subscription_required" });
       }
-      const { data: usage, error: usageError } = await db.from("users_subscriptions")
-        .select("num_sessions_month").eq("user_id", userId).maybeSingle();
-      if (usageError) return res.status(503).json({ error: "Unable to check your session quota." });
-      const usedSessions = Number(usage?.num_sessions_month ?? 0);
-      const sessionLimit = subscription.monthly_session_limit == null ? null : Number(subscription.monthly_session_limit);
-      if (sessionLimit !== null && usedSessions >= sessionLimit) {
-        return res.status(403).json({
-          error: "You have used all sessions included in this plan period. Renew or upgrade your plan to analyze another session.",
-          code: "quota_exceeded", resource: "sessions", used: usedSessions, limit: sessionLimit,
-        });
+      if (!isAdmin) {
+        const { data: usage, error: usageError } = await db.from("users_subscriptions")
+          .select("num_sessions_month").eq("user_id", userId).maybeSingle();
+        if (usageError) return res.status(503).json({ error: "Unable to check your session quota." });
+        const usedSessions = Number(usage?.num_sessions_month ?? 0);
+        const sessionLimit = subscription?.monthly_session_limit == null ? null : Number(subscription.monthly_session_limit);
+        if (sessionLimit !== null && usedSessions >= sessionLimit) {
+          return res.status(403).json({
+            error: "You have used all sessions included in this plan period. Renew or upgrade your plan to analyze another session.",
+            code: "quota_exceeded", resource: "sessions", used: usedSessions, limit: sessionLimit,
+          });
+        }
       }
-      const { data: player, error: playerError } = await db.from("players")
-        .select("player_id").eq("player_id", input.playerId).eq("user_id", userId).maybeSingle();
+      let playerQuery = db.from("players").select("player_id").eq("player_id", input.playerId);
+      if (!isAdmin) playerQuery = playerQuery.eq("user_id", userId);
+      const { data: player, error: playerError } = await playerQuery.maybeSingle();
       if (playerError) return res.status(503).json({ error: "Unable to verify the selected player." });
       if (!player) return res.status(404).json({ error: "Choose a player from your own roster before starting analysis." });
+      if (isAdmin) {
+        const { error } = await db.from("sessions").insert({
+          session_id: input.clientId, user_id: userId, player_id: input.playerId,
+          name: input.name || `Session ${input.clientId.slice(0, 8)}`,
+          path: `sessions/${input.clientId}`, status: "pending",
+        });
+        if (error) return res.status(503).json({ error: "Unable to prepare analysis session." });
+        return res.json({ session_id: input.clientId, player_id: input.playerId });
+      }
       const { data, error } = await db.rpc("begin_analysis", {
         p_session_id: input.clientId, p_user_id: userId,
         p_player_id: input.playerId,
@@ -98,8 +112,9 @@ export function analysisRouter(db: SupabaseClient, secret: string) {
       const sessionId = z.uuid().parse(req.params.sessionId);
       const actionId = z.uuid().parse(req.params.actionId);
       const userId = res.locals.userId as string;
-      const { data: session, error: sessionError } = await db.from("sessions")
-        .select("session_id").eq("session_id", sessionId).eq("user_id", userId).maybeSingle();
+      let sessionQuery = db.from("sessions").select("session_id").eq("session_id", sessionId);
+      if (res.locals.isAdmin !== true) sessionQuery = sessionQuery.eq("user_id", userId);
+      const { data: session, error: sessionError } = await sessionQuery.maybeSingle();
       if (sessionError) return res.status(503).json({ error: "Unable to verify session ownership." });
       if (!session) return res.status(404).json({ error: "Session not found." });
 
@@ -110,12 +125,32 @@ export function analysisRouter(db: SupabaseClient, secret: string) {
       return res.sendStatus(204);
     } catch (error) { next(error); }
   });
+  router.patch("/:sessionId/actions/:actionId", async (req, res, next) => {
+    try {
+      if (res.locals.isAdmin !== true) return res.sendStatus(403);
+      const sessionId = z.uuid().parse(req.params.sessionId);
+      const actionId = z.uuid().parse(req.params.actionId);
+      const input = z.object({
+        startFrame: z.number().int().nonnegative(),
+        endFrame: z.number().int().nonnegative(),
+        type: z.string().trim().min(1).max(50),
+      }).strict().parse(req.body);
+      if (input.endFrame < input.startFrame) return res.status(400).json({ error: "Action end frame must be after its start frame." });
+      const { data, error } = await db.from("actions").update({
+        start_frame: input.startFrame, end_frame: input.endFrame, type: input.type,
+      }).eq("action_id", actionId).eq("session_id", sessionId).select("action_id").maybeSingle();
+      if (error) return res.status(503).json({ error: "Unable to update action." });
+      if (!data) return res.sendStatus(404);
+      return res.json({ ok: true });
+    } catch (error) { next(error); }
+  });
   router.delete("/:sessionId", async (req, res, next) => {
     try {
       const sessionId = z.uuid().parse(req.params.sessionId);
       const userId = res.locals.userId as string;
-      const { data: session, error: sessionError } = await db.from("sessions")
-        .select("session_id").eq("session_id", sessionId).eq("user_id", userId).maybeSingle();
+      let sessionQuery = db.from("sessions").select("session_id").eq("session_id", sessionId);
+      if (res.locals.isAdmin !== true) sessionQuery = sessionQuery.eq("user_id", userId);
+      const { data: session, error: sessionError } = await sessionQuery.maybeSingle();
       if (sessionError) return res.status(503).json({ error: "Unable to verify session ownership." });
       if (!session) return res.status(404).json({ error: "Session not found." });
 
@@ -123,8 +158,9 @@ export function analysisRouter(db: SupabaseClient, secret: string) {
       // delete them first. Their annotations and feedback cascade from actions.
       const { error: actionsError } = await db.from("actions").delete().eq("session_id", sessionId);
       if (actionsError) return res.status(503).json({ error: "Unable to remove session actions." });
-      const { data: deleted, error } = await db.from("sessions").delete()
-        .eq("session_id", sessionId).eq("user_id", userId).select("session_id").maybeSingle();
+      let deleteQuery = db.from("sessions").delete().eq("session_id", sessionId);
+      if (res.locals.isAdmin !== true) deleteQuery = deleteQuery.eq("user_id", userId);
+      const { data: deleted, error } = await deleteQuery.select("session_id").maybeSingle();
       if (error) return res.status(503).json({ error: "Unable to delete session." });
       if (!deleted) return res.status(404).json({ error: "Session not found." });
       return res.sendStatus(204);
@@ -138,6 +174,22 @@ export function analysisRouter(db: SupabaseClient, secret: string) {
       let actions;
       try { actions = input.status === "completed" ? actionRows(sessionId, input.actions) : []; }
       catch { return res.status(400).json({ error: "Invalid action details" }); }
+      if (res.locals.isAdmin === true) {
+        const { data: session, error: sessionError } = await db.from("sessions").update({
+          status: input.status,
+          ...(input.status === "completed" ? { path: input.path } : {}),
+        }).eq("session_id", sessionId).eq("user_id", res.locals.userId).select("session_id").maybeSingle();
+        if (sessionError) return res.status(503).json({ error: "Unable to save analysis session." });
+        if (!session) return res.sendStatus(404);
+        if (input.status === "completed") {
+          const rows = actions.map((action) => ({ ...action, session_id: sessionId }));
+          if (rows.length) {
+            const { error } = await db.from("actions").upsert(rows, { onConflict: "action_id" });
+            if (error) return res.status(503).json({ error: "Unable to save analysis actions." });
+          }
+        }
+        return res.json({ ok: true });
+      }
       const { error } = await db.rpc("finish_analysis", {
         p_session_id: sessionId, p_user_id: res.locals.userId, p_status: input.status,
         p_path: input.status === "completed" ? input.path : null, p_actions: actions,

src/server.ts

@@ -12,6 +12,7 @@ import { analysisRouter } from "./analysis.js";
 import { authenticatedUser, clearPasswordRecoveryCookie, clearSessionCookies, hasPasswordRecoveryCookie, safeRedirect, setPasswordRecoveryCookie, setSessionCookies } from "./auth.js";
 import { hashPassword, oauthClient, supabaseAdmin, supabaseAuth, syncProfile, userHasPassword, userPayload } from "./supabase.js";
 import { registerProfileImageRoutes } from "./profile-images.js";
+import { registerAdminRoutes } from "./admin.js";
 
 const app = express();
 app.disable("x-powered-by");
@@ -94,6 +95,29 @@ const meanPlayerScore = (values: number[]) => values.length
   ? values.reduce((sum, value) => sum + value, 0) / values.length * 10
   : null;
 
+export async function accountRoleFor(userId: string) {
+  const { data, error } = await supabaseAdmin.from("users").select("account_role").eq("user_id", userId).maybeSingle();
+  if (error) throw new Error(`Unable to load account permissions: ${error.message}`);
+  return String(data?.account_role ?? "user").toLowerCase();
+}
+
+export async function userIsAdmin(userId: string) {
+  return await accountRoleFor(userId) === "admin";
+}
+
+export async function requireAdmin(req: Request, res: Response) {
+  const current = await authenticatedUser(req, res);
+  if (!current) {
+    res.status(401).json({ error: "Authentication required." });
+    return null;
+  }
+  if (!await userIsAdmin(current.user.id)) {
+    res.status(403).json({ error: "Administrator access is required." });
+    return null;
+  }
+  return current;
+}
+
 async function loadActionAnnotations(actionIds: string[]) {
   const annotations: Array<{ action_id: string; score: number | null }> = [];
   // Keep PostgREST query URLs small when a player has many analyzed actions.
@@ -114,6 +138,9 @@ async function requireActiveSubscription(req: Request, res: Response) {
     res.status(401).json({ error: "Authentication required." });
     return null;
   }
+  if (await userIsAdmin(current.user.id)) {
+    return { ...current, isAdmin: true, subscription: { player_limit: null, monthly_session_limit: null } };
+  }
   const subscription = await activeSubscriptionFor(current.user.id, { refresh: true });
   if (!subscription) {
     res.status(402).json({ error: "An active subscription is required to access Sporalize Labs.", code: "subscription_required" });
@@ -122,6 +149,8 @@ async function requireActiveSubscription(req: Request, res: Response) {
   return { ...current, subscription };
 }
 
+registerAdminRoutes(app);
+
 async function enforcePlayerQuota(userId: string, limit: number | null, res: Response) {
   const { data, error } = await supabaseAdmin.from("users_subscriptions")
     .select("num_players").eq("user_id", userId).maybeSingle();
@@ -159,8 +188,9 @@ app.get("/api/subscription/access", async (req, res, next) => {
   try {
     const current = await authenticatedUser(req, res);
     if (!current) return res.status(401).json({ error: "Authentication required." });
-    const subscription = await activeSubscriptionFor(current.user.id, { refresh: true });
-    return res.json({ active: Boolean(subscription), subscription });
+    const admin = await userIsAdmin(current.user.id);
+    const subscription = admin ? null : await activeSubscriptionFor(current.user.id, { refresh: true });
+    return res.json({ active: admin || Boolean(subscription), subscription, isAdmin: admin });
   } catch (error) { next(error); }
 });
 
@@ -169,6 +199,10 @@ app.get("/api/plan-billing", async (req, res, next) => {
     const current = await authenticatedUser(req, res);
     if (!current) return res.status(401).json({ error: "Authentication required." });
     const userId = current.user.id;
+    if (await userIsAdmin(userId)) {
+      res.set("Cache-Control", "no-store");
+      return res.json({ subscription: null, usage: { players: 0, sessions: 0, monthlySessions: 0 }, billingHistoryAvailable: false, isAdmin: true });
+    }
     const assignmentResult = await supabaseAdmin.from("users_subscriptions")
       .select("subscription_id,startdate,enddate,num_players,num_sessions,num_sessions_month").eq("user_id", userId).maybeSingle();
     if (assignmentResult.error) throw new Error(`Unable to load plan assignment: ${assignmentResult.error.message}`);
@@ -207,7 +241,8 @@ app.get("/api/owned-players", async (req, res, next) => {
       .order("fname", { ascending: true });
     if (error) throw new Error(`Unable to load players: ${error.message}`);
     // Analysis player choices stay scoped to the signed-in user's own roster.
-    const ownedPlayers = (data ?? []).filter((player) => player.user_id === current.user.id);
+    const admin = await userIsAdmin(current.user.id);
+    const ownedPlayers = admin ? data ?? [] : (data ?? []).filter((player) => player.user_id === current.user.id);
     return res.json({ players: ownedPlayers.map((player) => ({
       playerId: player.player_id,
       name: [player.fname, player.lname].filter(Boolean).join(" "),
@@ -523,7 +558,7 @@ app.get("/api/sessions/:sessionId/reviews", async (req, res, next) => {
       .select("session_id,user_id").eq("session_id", sessionId.data).maybeSingle();
     if (sessionError) throw new Error(`Unable to verify review session: ${sessionError.message}`);
     if (!session) return res.sendStatus(404);
-    if (session.user_id !== current.user.id && !await activeSubscriptionFor(current.user.id, { refresh: true })) {
+    if (session.user_id !== current.user.id && !await userIsAdmin(current.user.id) && !await activeSubscriptionFor(current.user.id, { refresh: true })) {
       return res.status(403).json({ error: "An active subscription is required to view shared sessions.", code: "subscription_required" });
     }
 
@@ -574,7 +609,7 @@ app.get("/api/sessions/:sessionId/feedbacks", async (req, res, next) => {
       .select("session_id,user_id").eq("session_id", sessionId.data).maybeSingle();
     if (sessionError) throw new Error(`Unable to verify feedback session: ${sessionError.message}`);
     if (!session) return res.sendStatus(404);
-    if (session.user_id !== current.user.id && !await activeSubscriptionFor(current.user.id, { refresh: true })) {
+    if (session.user_id !== current.user.id && !await userIsAdmin(current.user.id) && !await activeSubscriptionFor(current.user.id, { refresh: true })) {
       return res.status(403).json({ error: "An active subscription is required to view shared sessions.", code: "subscription_required" });
     }
 
@@ -734,8 +769,9 @@ app.post("/api/auth/login", authLimiter, async (req, res, next) => {
     await syncProfile(data.user);
     setSessionCookies(res, data.session);
     clearPasswordRecoveryCookie(res);
-    const subscription = await activeSubscriptionFor(data.user.id);
-    return res.json({ user: userPayload(data.user), access: { active: Boolean(subscription), subscription } });
+    const role = await accountRoleFor(data.user.id);
+    const subscription = role === "admin" ? null : await activeSubscriptionFor(data.user.id);
+    return res.json({ user: userPayload(data.user, role), access: { active: role === "admin" || Boolean(subscription), subscription } });
   } catch (error) { next(error); }
 });
 
@@ -790,9 +826,10 @@ app.get("/api/auth/me", async (req, res, next) => {
   try {
     const current = await authenticatedUser(req, res);
     if (!current) return res.status(401).json({ error: "Authentication required." });
-    const subscription = await activeSubscriptionFor(current.user.id);
+    const role = await accountRoleFor(current.user.id);
+    const subscription = role === "admin" ? null : await activeSubscriptionFor(current.user.id);
     res.set("Cache-Control", "no-store");
-    return res.json({ user: userPayload(current.user), access: { active: Boolean(subscription), subscription } });
+    return res.json({ user: userPayload(current.user, role), access: { active: role === "admin" || Boolean(subscription), subscription } });
   } catch (error) { next(error); }
 });
 
@@ -861,6 +898,7 @@ app.delete("/api/auth/account", async (req, res, next) => {
   try {
     const current = await authenticatedUser(req, res);
     if (!current) return res.status(401).json({ error: "Authentication required." });
+    if (await userIsAdmin(current.user.id)) return res.status(403).json({ error: "Admin accounts cannot delete themselves." });
     if (req.body?.confirmation !== "DELETE") return res.status(400).json({ error: "Confirm account deletion by typing DELETE." });
     const { data: imageRow, error: imageReadError } = await supabaseAdmin.from("users")
       .select("image_path").eq("user_id", current.user.id).maybeSingle();
@@ -883,16 +921,17 @@ async function proxyAnalysisRequest(req: Request, res: Response) {
   const current = await authenticatedUser(req, res);
   if (!current) return res.status(401).json({ error: "Authentication required." });
   const resourcePath = req.path;
+  const isAdmin = await userIsAdmin(current.user.id);
   const sessionMatch = resourcePath.match(/^\/(?:sessions\/)?([0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})(?:\/|$)/i);
   if (["GET", "HEAD"].includes(req.method) && sessionMatch) {
-    const subscribed = await activeSubscriptionFor(current.user.id, { refresh: true });
+    const subscribed = isAdmin || await activeSubscriptionFor(current.user.id, { refresh: true });
     if (!subscribed) {
       const { data: session, error } = await supabaseAdmin.from("sessions")
         .select("session_id").eq("session_id", sessionMatch[1]).eq("user_id", current.user.id).maybeSingle();
       if (error) throw new Error(`Unable to verify session access: ${error.message}`);
       if (!session) return res.status(403).json({ error: "An active subscription is required to view shared sessions.", code: "subscription_required" });
     }
-  } else if (sessionMatch) {
+  } else if (sessionMatch && !isAdmin) {
     const { data: session, error } = await supabaseAdmin.from("sessions")
       .select("session_id").eq("session_id", sessionMatch[1]).eq("user_id", current.user.id).maybeSingle();
     if (error) throw new Error(`Unable to verify session ownership: ${error.message}`);
@@ -902,7 +941,7 @@ async function proxyAnalysisRequest(req: Request, res: Response) {
   // a new analysis is gated here; the internal begin-analysis route repeats
   // this check before creating its player/session rows.
   if (req.method === "POST" && req.path === "/analyze") {
-    const active = await activeSubscriptionFor(current.user.id, { refresh: true });
+    const active = isAdmin || await activeSubscriptionFor(current.user.id, { refresh: true });
     if (!active) return res.status(402).json({ error: "An active subscription is required to create or change Labs data.", code: "subscription_required" });
   }
 
@@ -911,6 +950,7 @@ async function proxyAnalysisRequest(req: Request, res: Response) {
   headers.set("x-sporalize-proxy-secret", env.ANALYSIS_PROXY_SECRET);
   // Derived from the verified cookie session; never trust a browser-supplied ID.
   headers.set("x-sporalize-user-id", current.user.id);
+  if (isAdmin) headers.set("x-sporalize-admin", "true");
   headers.set("x-forwarded-host", new URL(env.BACKEND_URL).host);
   headers.set("x-forwarded-proto", new URL(env.BACKEND_URL).protocol.replace(":", ""));
   for (const name of ["accept", "content-type", "range", "if-range"]) {

src/subscriptions.ts

@@ -1,72 +1,75 @@
-import { supabaseAdmin } from "./supabase.js";
-
-type AssignSubscriptionInput = {
-  userId: string;
-  subscriptionId: string;
-  startDate: string;
-  endDate: string;
-};
-
-/**
- * Persist a paid subscription after a payment provider's webhook has been
- * authenticated and its payment has been confirmed. Never call this directly
- * from a browser request.
- */
-export async function assignPaidSubscription(input: AssignSubscriptionInput) {
-  const { userId, subscriptionId, startDate, endDate } = input;
-  const isoDate = /^\d{4}-\d{2}-\d{2}$/;
-  if (!isoDate.test(startDate) || !isoDate.test(endDate) || endDate < startDate) {
-    throw new Error("Invalid subscription period.");
-  }
-
-  const { data: plan, error: planError } = await supabaseAdmin
-    .from("subscriptions")
-    .select("subscription_id")
-    .eq("subscription_id", subscriptionId)
-    .maybeSingle();
-  if (planError) throw new Error(`Unable to validate subscription plan: ${planError.message}`);
-  if (!plan) throw new Error("Subscription plan was not found.");
-
-  const { data, error } = await supabaseAdmin
-    .from("users_subscriptions")
-    .upsert({ user_id: userId, subscription_id: subscriptionId, startdate: startDate, enddate: endDate }, { onConflict: "user_id" })
-    .select("user_id,subscription_id,startdate,enddate")
-    .single();
-  if (error) throw new Error(`Unable to assign paid subscription: ${error.message}`);
-  accessCache.delete(userId);
-  accessRequests.delete(userId);
-  return data;
-}
-
-async function loadActiveSubscription(userId: string) {
-  const today = new Date().toISOString().slice(0, 10);
-  const { data: assignment, error } = await supabaseAdmin.from("users_subscriptions")
-    .select("subscription_id,startdate,enddate").eq("user_id", userId).maybeSingle();
-  if (error) throw new Error(`Unable to check subscription: ${error.message}`);
-  if (!assignment?.subscription_id || assignment.startdate > today || assignment.enddate < today) return null;
-
-  const { data: plan, error: planError } = await supabaseAdmin.from("subscriptions")
-    .select("subscription_id,plan,price,player_limit,monthly_session_limit").eq("subscription_id", assignment.subscription_id).maybeSingle();
-  if (planError) throw new Error(`Unable to load subscription plan: ${planError.message}`);
-  return plan ? { ...plan, startdate: assignment.startdate, enddate: assignment.enddate } : null;
-}
-
-// Brief, per-user cache shared by polling, media and session requests.
-const accessCache = new Map<string, { value: Awaited<ReturnType<typeof loadActiveSubscription>>; expires: number }>();
-const accessRequests = new Map<string, Promise<Awaited<ReturnType<typeof loadActiveSubscription>>>>();
-export async function activeSubscriptionFor(userId: string, options: { refresh?: boolean } = {}) {
-  const cached = accessCache.get(userId);
-  if (!options.refresh && cached && cached.expires > Date.now()) return cached.value;
-  const existing = accessRequests.get(userId);
-  if (existing) return existing;
-  const pending = loadActiveSubscription(userId).then((value) => {
-    if (accessRequests.get(userId) === pending) {
-      if (accessCache.size >= 1000) accessCache.delete(accessCache.keys().next().value!);
-      const tomorrow = new Date(); tomorrow.setUTCHours(24, 0, 0, 0);
-      accessCache.set(userId, { value, expires: Math.min(Date.now() + 30_000, tomorrow.getTime()) });
-    }
-    return value;
-  }).finally(() => { if (accessRequests.get(userId) === pending) accessRequests.delete(userId); });
-  accessRequests.set(userId, pending);
-  return pending;
-}
+import { supabaseAdmin } from "./supabase.js";
+
+type AssignSubscriptionInput = {
+  userId: string;
+  subscriptionId: string;
+  startDate: string;
+  endDate: string;
+};
+
+/**
+ * Persist a paid subscription after a payment provider's webhook has been
+ * authenticated and its payment has been confirmed. Never call this directly
+ * from a browser request.
+ */
+export async function assignPaidSubscription(input: AssignSubscriptionInput) {
+  const { userId, subscriptionId, startDate, endDate } = input;
+  const isoDate = /^\d{4}-\d{2}-\d{2}$/;
+  if (!isoDate.test(startDate) || !isoDate.test(endDate) || endDate < startDate) {
+    throw new Error("Invalid subscription period.");
+  }
+
+  const { data: plan, error: planError } = await supabaseAdmin
+    .from("subscriptions")
+    .select("subscription_id")
+    .eq("subscription_id", subscriptionId)
+    .maybeSingle();
+  if (planError) throw new Error(`Unable to validate subscription plan: ${planError.message}`);
+  if (!plan) throw new Error("Subscription plan was not found.");
+
+  const { data, error } = await supabaseAdmin
+    .from("users_subscriptions")
+    .upsert({ user_id: userId, subscription_id: subscriptionId, startdate: startDate, enddate: endDate }, { onConflict: "user_id" })
+    .select("user_id,subscription_id,startdate,enddate")
+    .single();
+  if (error) throw new Error(`Unable to assign paid subscription: ${error.message}`);
+  invalidateSubscriptionCache(userId);
+  return data;
+}
+
+async function loadActiveSubscription(userId: string) {
+  const today = new Date().toISOString().slice(0, 10);
+  const { data: assignment, error } = await supabaseAdmin.from("users_subscriptions")
+    .select("subscription_id,startdate,enddate").eq("user_id", userId).maybeSingle();
+  if (error) throw new Error(`Unable to check subscription: ${error.message}`);
+  if (!assignment?.subscription_id || assignment.startdate > today || assignment.enddate < today) return null;
+
+  const { data: plan, error: planError } = await supabaseAdmin.from("subscriptions")
+    .select("subscription_id,plan,price,player_limit,monthly_session_limit").eq("subscription_id", assignment.subscription_id).maybeSingle();
+  if (planError) throw new Error(`Unable to load subscription plan: ${planError.message}`);
+  return plan ? { ...plan, startdate: assignment.startdate, enddate: assignment.enddate } : null;
+}
+
+// Brief, per-user cache shared by polling, media and session requests.
+const accessCache = new Map<string, { value: Awaited<ReturnType<typeof loadActiveSubscription>>; expires: number }>();
+const accessRequests = new Map<string, Promise<Awaited<ReturnType<typeof loadActiveSubscription>>>>();
+export function invalidateSubscriptionCache(userId: string) {
+  accessCache.delete(userId);
+  accessRequests.delete(userId);
+}
+export async function activeSubscriptionFor(userId: string, options: { refresh?: boolean } = {}) {
+  const cached = accessCache.get(userId);
+  if (!options.refresh && cached && cached.expires > Date.now()) return cached.value;
+  const existing = accessRequests.get(userId);
+  if (existing) return existing;
+  const pending = loadActiveSubscription(userId).then((value) => {
+    if (accessRequests.get(userId) === pending) {
+      if (accessCache.size >= 1000) accessCache.delete(accessCache.keys().next().value!);
+      const tomorrow = new Date(); tomorrow.setUTCHours(24, 0, 0, 0);
+      accessCache.set(userId, { value, expires: Math.min(Date.now() + 30_000, tomorrow.getTime()) });
+    }
+    return value;
+  }).finally(() => { if (accessRequests.get(userId) === pending) accessRequests.delete(userId); });
+  accessRequests.set(userId, pending);
+  return pending;
+}

src/supabase.ts

@@ -71,6 +71,6 @@ export async function syncProfile(user: User, profile?: { fname?: string; lname?
   if (error) throw new Error(`Unable to create user profile: ${error.message}`);
 }
 
-export function userPayload(user: User) {
-  return { id: user.id, email: user.email, emailVerified: Boolean(user.email_confirmed_at), metadata: user.user_metadata ?? {} };
+export function userPayload(user: User, accountRole = "user") {
+  return { id: user.id, email: user.email, emailVerified: Boolean(user.email_confirmed_at), accountRole, metadata: user.user_metadata ?? {} };
 }