 links resolve at WhatsApp and drop the query string,\n * so ?text= never arrives. Only wa.me/ and api.whatsapp.com/send?phone=\n * carry a prefilled body. `prefill` tells the client to fall back to clipboard. */\nfunction buildWaUrl(raw: string, message: string): { url: string; prefill: boolean } {\n  const link = (raw || \"\").trim();\n  if (/^\\+?\\d[\\d\\s\\-()]{6,}$/.test(link)) {\n    return {\n      url: `https://wa.me/${link.replace(/\\D/g, \"\")}?text=${encodeURIComponent(message)}`,\n      prefill: true,\n    };\n  }\n  let url: URL;\n  try {\n    url = new URL(link.startsWith(\"http\") ? link : `https://${link}`);\n  } catch {\n    return { url: CONFIG.brandWa, prefill: false };\n  }\n  const host = url.hostname.replace(/^www\\./, \"\");\n  if (host === \"wa.me\" && /^\\/message\\//i.test(url.pathname)) return { url: url.toString(), prefill: false };\n  if (host === \"chat.whatsapp.com\") return { url: url.toString(), prefill: false };\n  if (host === \"wa.me\" && /^\\/\\+?\\d{6,}$/.test(url.pathname)) {\n    url.searchParams.set(\"text\", message);\n    return { url: url.toString(), prefill: true };\n  }\n  if ((host === \"api.whatsapp.com\" || host === \"web.whatsapp.com\") && url.searchParams.get(\"phone\")) {\n    url.searchParams.set(\"text\", message);\n    return { url: url.toString(), prefill: true };\n  }\n  return { url: url.toString(), prefill: false };\n}\n\nfunction validWaLink(raw: string): boolean {\n  const link = (raw || \"\").trim();\n  if (!link) return false;\n  if (/^\\+?\\d[\\d\\s\\-()]{6,}$/.test(link)) return true;\n  try {\n    const host = new URL(link.startsWith(\"http\") ? link : `https://${link}`).hostname.replace(/^www\\./, \"\");\n    return [\"wa.me\", \"api.whatsapp.com\", \"web.whatsapp.com\", \"chat.whatsapp.com\"].includes(host);\n  } catch {\n    return false;\n  }\n}\n\n/* ================================================================== */\n/* SKU                                                                */\n/* ================================================================== */\n\nfunction skuCandidate(width = 6): string {\n  const max = Math.pow(10, width);\n  const min = Math.pow(10, width - 1);\n  return `SKU-${(crypto.getRandomValues(new Uint32Array(1))[0] % (max - min)) + min}`;\n}\n\n/** Uniqueness comes from the UNIQUE index, not a prior SELECT — check-then-insert\n * races the moment two buyers tap in the same second. */\nasync function insertOrder(o: {\n  listingId: number | null;\n  packageId: string | null;\n  title: string;\n  price: number;\n  sellerName: string;\n  sellerId: number | null;\n  buyerName: string | null;\n  buyerEmail: string | null;\n}): Promise {\n  const now = new Date().toISOString();\n  for (let i = 0; i < 14; i++) {\n    const sku = skuCandidate(i < 10 ? 6 : 8);\n    try {\n      await run(\n        `INSERT INTO ${T.orders}\n         (sku, listing_id, package_id, product_title, price, seller_name, seller_id,\n          buyer_name, buyer_email, status, created_at)\n         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 'Pending', ?)`,\n        [sku, o.listingId, o.packageId, o.title, o.price, o.sellerName, o.sellerId, o.buyerName, o.buyerEmail, now]\n      );\n      return sku;\n    } catch (err: any) {\n      if (/UNIQUE|constraint/i.test(String(err?.message || err))) continue;\n      throw err;\n    }\n  }\n  throw new Error(\"Could not allocate a unique SKU\");\n}\n\n/* ================================================================== */\n/* helpers                                                            */\n/* ================================================================== */\n\nconst json = (data: unknown, status = 200) =>\n  new Response(JSON.stringify(data), {\n    status,\n    headers: { \"content-type\": \"application/json; charset=utf-8\" },\n  });\n\nconst htmlRes = (b: string, status = 200) =>\n  new Response(b, { status, headers: { \"content-type\": \"text/html; charset=utf-8\" } });\n\nasync function readBody(req: Request): Promise {\n  try {\n    return (await req.json()) as Row;\n  } catch {\n    return {};\n  }\n}\n\nconst money = (n: number) =>\n  new Intl.NumberFormat(CONFIG.locale, { maximumFractionDigits: 0 }).format(Number(n) || 0);\n\nconst priceLabel = (n: number) => `${CONFIG.currency} ${money(n)}`;\n\n/** Exact checkout message format. */\nconst orderMessage = (sku: string, title: string, price: number) =>\n  `Order ${sku} - Product: ${title} - Price: ${priceLabel(price)}. Sent from ${CONFIG.brand}. Please confirm this order.`;\n\n/* ================================================================== */\n/* router                                                             */\n/* ================================================================== */\n\nexport default async function (req: Request): Promise {\n  await init();\n  const url = new URL(req.url);\n  const path = url.pathname.replace(/\\/+$/, \"\") || \"/\";\n  const method = req.method.toUpperCase();\n\n  try {\n    if (method === \"GET\" && path === \"/\") return htmlRes(PAGE);\n    if (method === \"GET\" && path === \"/health\") return json({ ok: true });\n\n    if (method === \"POST\" && path === \"/api/register\") return await register(req);\n    if (method === \"POST\" && path === \"/api/login\") return await login(req);\n    if (method === \"POST\" && path === \"/api/logout\") return await logout(req);\n    if (method === \"GET\" && path === \"/api/me\") return await me(req);\n    if (method === \"POST\" && path === \"/api/verify-email\") return await verifyEmail(req);\n    if (method === \"POST\" && path === \"/api/resend-code\") return await resendCode(req);\n\n    if (method === \"GET\" && path === \"/api/listings\") return await getListings();\n    if (method === \"POST\" && path === \"/api/listings\") return await createListing(req);\n    if (method === \"POST\" && path === \"/api/listings/delete\") return await deleteListing(req);\n\n    if (method === \"POST\" && (path === \"/create-order\" || path === \"/api/create-order\"))\n      return await createOrder(req);\n\n    if (method === \"POST\" && path === \"/api/request-seller\") return await requestSeller(req);\n    if (method === \"GET\" && path === \"/api/my-orders\") return await myOrders(req);\n    if (method === \"GET\" && path === \"/api/seller-orders\") return await sellerOrders(req);\n    if (method === \"POST\" && path === \"/api/order-status\") return await setOrderStatus(req);\n\n    if (method === \"GET\" && path === \"/api/admin/pending-sellers\") return await pendingSellers(req);\n    if (method === \"POST\" && path === \"/api/admin/approve-seller\") return await approveSeller(req);\n    if (method === \"GET\" && path === \"/api/admin/orders\") return await adminOrders(req);\n    if (method === \"GET\" && path === \"/api/admin/users\") return await adminUsers(req);\n    if (method === \"POST\" && path === \"/api/admin/user-action\") return await adminUserAction(req);\n\n    return json({ error: \"Not found\" }, 404);\n  } catch (err: any) {\n    console.error(err);\n    return json({ error: \"Server error\", detail: String(err?.message || err) }, 500);\n  }\n}\n\n/* ================================================================== */\n/* auth                                                               */\n/* ================================================================== */\n\nasync function register(req: Request): Promise {\n  const b = await readBody(req);\n  const name = String(b.name || \"\").trim();\n  const email = String(b.email || \"\").trim().toLowerCase();\n  const password = String(b.password || \"\");\n\n  if (name.length < 2) return json({ error: \"Enter your full name.\" }, 400);\n  if (!/^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$/.test(email)) return json({ error: \"That email isn't valid.\" }, 400);\n  if (password.length < 6) return json({ error: \"Use at least 6 characters.\" }, 400);\n  if (email === ADMIN_EMAIL) return json({ error: \"That account already exists. Log in instead.\" }, 409);\n\n  if (await one(`SELECT id FROM ${T.users} WHERE email = ?`, [email]))\n    return json({ error: \"An account already uses that email. Log in instead.\" }, 409);\n\n  const salt = randomHex(16);\n  const hash = await hashPassword(password, salt);\n  await run(\n    `INSERT INTO ${T.users} (name, email, role, pass_hash, pass_salt, created_at, verified)\n     VALUES (?, ?, 'buyer', ?, ?, ?, 0)`,\n    [name, email, hash, salt, new Date().toISOString()]\n  );\n  const user = await one(`SELECT id, name, email, role FROM ${T.users} WHERE email = ?`, [email]);\n  const mail = await issueVerification(Number(user!.id), email, name);\n  return json({\n    success: true,\n    token: await newSession(Number(user!.id)),\n    user,\n    verified: false,\n    mailSent: mail.ok,\n  });\n}\n\nasync function login(req: Request): Promise {\n  const b = await readBody(req);\n  const email = String(b.email || \"\").trim().toLowerCase();\n  const password = String(b.password || \"\");\n  const row = await one(\n    `SELECT id, name, email, role, verified, banned, pass_hash, pass_salt FROM ${T.users} WHERE email = ?`,\n    [email]\n  );\n  const generic = json({ error: \"Email or password is wrong.\" }, 401);\n  if (!row) return generic;\n  if (Number(row.banned) === 1)\n    return json({ error: \"This account is suspended. Contact support.\" }, 403);\n  const hash = await hashPassword(password, String(row.pass_salt));\n  if (!safeEqual(hash, String(row.pass_hash))) return generic;\n  return json({\n    success: true,\n    token: await newSession(Number(row.id)),\n    user: { id: row.id, name: row.name, email: row.email, role: row.role },\n    verified: Number(row.verified) === 1,\n  });\n}\n\nasync function logout(req: Request): Promise {\n  const token = bearer(req);\n  if (token) await run(`DELETE FROM ${T.sessions} WHERE token = ?`, [token]);\n  return json({ success: true });\n}\n\nasync function me(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ user: null });\n  const pending = await one(\n    `SELECT id FROM ${T.requests} WHERE user_id = ? AND status = 'pending'`,\n    [user.id]\n  );\n  return json({\n    user: { id: user.id, name: user.name, email: user.email, role: user.role },\n    admin: isAdmin(user),\n    canSell: canSell(user),\n    verified: isVerified(user),\n    sellerRequestPending: !!pending,\n  });\n}\n\n/* ================================================================== */\n/* email + verification                                               */\n/* ================================================================== */\n\n/**\n * Two backends. Resend if RESEND_API_KEY is set (needs a verified sending\n * domain), otherwise Val Town's std/email — which on the free plan only\n * reaches your own address, so anything else fails and lands in the logs.\n */\nasync function sendMail(to: string, subject: string, text: string): Promise<{ ok: boolean; error?: string }> {\n  const key = Deno.env.get(\"RESEND_API_KEY\");\n  if (key) {\n    try {\n      const from = Deno.env.get(\"MAIL_FROM\") || `${CONFIG.brand} `;\n      const res = await fetch(\"https://api.resend.com/emails\", {\n        method: \"POST\",\n        headers: { authorization: `Bearer ${key}`, \"content-type\": \"application/json\" },\n        body: JSON.stringify({ from, to, subject, text }),\n      });\n      if (res.ok) return { ok: true };\n      return { ok: false, error: (await res.text()).slice(0, 300) };\n    } catch (e: any) {\n      return { ok: false, error: String(e?.message || e).slice(0, 300) };\n    }\n  }\n  try {\n    const mod: any = await import(\"https://esm.town/v/std/email\");\n    await mod.email({ to, subject, text });\n    return { ok: true };\n  } catch (e: any) {\n    return { ok: false, error: String(e?.message || e).slice(0, 300) };\n  }\n}\n\nasync function issueVerification(userId: number, email: string, name: string) {\n  const code = String((crypto.getRandomValues(new Uint32Array(1))[0] % 900000) + 100000);\n  const expires = new Date(Date.now() + 30 * 60 * 1000).toISOString();\n  await run(\n    `UPDATE ${T.users} SET verify_code = ?, verify_expires = ?, verify_sent_at = ? WHERE id = ?`,\n    [code, expires, new Date().toISOString(), userId]\n  );\n  const text =\n    `Hi ${name},\\n\\nYour ${CONFIG.brand} verification code is ${code}\\n` +\n    `It expires in 30 minutes.\\n\\nIf you did not create this account, ignore this email.`;\n  const mail = await sendMail(email, `${code} is your ${CONFIG.brand} code`, text);\n  // Always log it: with no mail provider configured this is the only copy.\n  console.log(`[verify] ${email} code=${code} sent=${mail.ok}${mail.error ? \" err=\" + mail.error : \"\"}`);\n  return mail;\n}\n\nasync function verifyEmail(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ error: \"Log in first.\" }, 401);\n  if (isVerified(user)) return json({ success: true, already: true });\n\n  const code = String((await readBody(req)).code || \"\").trim();\n  const row = await one(`SELECT verify_code, verify_expires FROM ${T.users} WHERE id = ?`, [user.id]);\n  if (!row || !row.verify_code) return json({ error: \"No code on file. Send a new one.\" }, 400);\n  if (new Date(String(row.verify_expires)).getTime() < Date.now())\n    return json({ error: \"That code expired. Send a new one.\" }, 400);\n  if (!safeEqual(code, String(row.verify_code))) return json({ error: \"That code is wrong.\" }, 400);\n\n  await run(\n    `UPDATE ${T.users} SET verified = 1, verify_code = NULL, verify_expires = NULL WHERE id = ?`,\n    [user.id]\n  );\n  return json({ success: true });\n}\n\nasync function resendCode(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ error: \"Log in first.\" }, 401);\n  if (isVerified(user)) return json({ success: true, already: true });\n\n  const row = await one(`SELECT verify_sent_at FROM ${T.users} WHERE id = ?`, [user.id]);\n  const last = row && row.verify_sent_at ? new Date(String(row.verify_sent_at)).getTime() : 0;\n  const wait = 60000 - (Date.now() - last);\n  if (wait > 0) return json({ error: `Wait ${Math.ceil(wait / 1000)}s before asking for another code.` }, 429);\n\n  const mail = await issueVerification(Number(user.id), String(user.email), String(user.name));\n  return json({ success: true, mailSent: mail.ok });\n}\n\n/* ================================================================== */\n/* listings                                                           */\n/* ================================================================== */\n\nasync function getListings(): Promise {\n  const listings = await q(\n    `SELECT l.id, l.title, l.description, l.price, l.category, l.seller_name, l.seller_id, l.created_at\n       FROM ${T.listings} l JOIN ${T.users} u ON u.id = l.seller_id\n      WHERE l.active = 1 AND u.banned = 0 AND u.role IN ('approved_seller','admin')\n      ORDER BY l.id DESC LIMIT 200`\n  );\n  return json({ listings });\n}\n\nasync function createListing(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ error: \"Log in first.\" }, 401);\n  if (!isVerified(user)) return json({ error: \"Verify your email before publishing.\" }, 403);\n  if (!canSell(user)) return json({ error: \"Your seller account is not approved yet.\" }, 403);\n\n  const b = await readBody(req);\n  const title = String(b.title || \"\").trim();\n  const description = String(b.description || \"\").trim();\n  const price = Number(b.price);\n  const category = String(b.category || \"Growth\").trim() || \"Growth\";\n  const waLink = String(b.waLink || \"\").trim();\n\n  if (title.length < 3) return json({ error: \"Give the listing a title.\" }, 400);\n  if (!Number.isFinite(price) || price <= 0) return json({ error: \"Enter a price above zero.\" }, 400);\n  if (!validWaLink(waLink))\n    return json({ error: \"Use a wa.me short link, an api.whatsapp.com link, or a full phone number.\" }, 400);\n\n  await run(\n    `INSERT INTO ${T.listings}\n     (seller_id, seller_name, title, description, price, category, wa_link, active, created_at)\n     VALUES (?, ?, ?, ?, ?, ?, ?, 1, ?)`,\n    [user.id, user.name, title, description, price, category, waLink, new Date().toISOString()]\n  );\n  return json({ success: true, prefill: buildWaUrl(waLink, \"test\").prefill });\n}\n\nasync function deleteListing(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ error: \"Log in first.\" }, 401);\n  const id = Number((await readBody(req)).id);\n  const owned = await one(\n    `SELECT id FROM ${T.listings} WHERE id = ? AND (seller_id = ? OR ? = 1)`,\n    [id, user.id, isAdmin(user) ? 1 : 0]\n  );\n  if (!owned) return json({ error: \"That listing isn't yours.\" }, 403);\n  await run(`UPDATE ${T.listings} SET active = 0 WHERE id = ?`, [id]);\n  return json({ success: true });\n}\n\n/* ================================================================== */\n/* orders                                                             */\n/* ================================================================== */\n\nasync function createOrder(req: Request): Promise {\n  const b = await readBody(req);\n  const user = await currentUser(req);\n\n  let title: string, price: number, sellerName: string, waLink: string;\n  let listingId: number | null = null;\n  let sellerId: number | null = null;\n  let packageId: string | null = null;\n\n  if (b.listingId != null) {\n    const l = await one(\n      `SELECT id, title, price, seller_name, seller_id, wa_link FROM ${T.listings}\n        WHERE id = ? AND active = 1`,\n      [Number(b.listingId)]\n    );\n    if (!l) return json({ error: \"That listing is no longer available.\" }, 404);\n    listingId = Number(l.id);\n    sellerId = l.seller_id == null ? null : Number(l.seller_id);\n    title = String(l.title);\n    price = Number(l.price);\n    sellerName = String(l.seller_name);\n    waLink = String(l.wa_link);\n  } else {\n    const pkg = PACKAGES[String(b.packageId || \"\")];\n    if (!pkg) return json({ error: \"Unknown package.\" }, 400);\n    packageId = String(b.packageId);\n    title = pkg.title;\n    price = pkg.price;\n    sellerName = CONFIG.brand;\n    waLink = CONFIG.brandWa;\n  }\n\n  const sku = await insertOrder({\n    listingId,\n    packageId,\n    title,\n    price,\n    sellerName,\n    sellerId,\n    buyerName: user ? String(user.name) : null,\n    buyerEmail: user ? String(user.email) : null,\n  });\n\n  const message = orderMessage(sku, title, price);\n  const { url: waUrl, prefill } = buildWaUrl(waLink, message);\n\n  return json({\n    success: true,\n    sku,\n    waUrl,\n    message,\n    prefill,\n    product: { title, price, seller_name: sellerName },\n  });\n}\n\nasync function myOrders(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ error: \"Log in first.\" }, 401);\n  return json({\n    orders: await q(\n      `SELECT sku, product_title, price, seller_name, status, created_at FROM ${T.orders}\n        WHERE buyer_email = ? ORDER BY id DESC LIMIT 100`,\n      [user.email]\n    ),\n  });\n}\n\nasync function sellerOrders(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ error: \"Log in first.\" }, 401);\n  return json({\n    orders: await q(\n      `SELECT sku, product_title, price, buyer_name, status, created_at FROM ${T.orders}\n        WHERE seller_id = ? ORDER BY id DESC LIMIT 100`,\n      [user.id]\n    ),\n  });\n}\n\n/* ================================================================== */\n/* seller requests                                                    */\n/* ================================================================== */\n\nasync function requestSeller(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ error: \"Create an account first, then apply.\" }, 401);\n  if (!isVerified(user)) return json({ error: \"Verify your email before applying.\" }, 403);\n  if (canSell(user)) return json({ error: \"You can already publish listings.\" }, 400);\n\n  const note = String((await readBody(req)).note || \"\").trim().slice(0, 400);\n  const existing = await one(\n    `SELECT id FROM ${T.requests} WHERE user_id = ? AND status = 'pending'`,\n    [user.id]\n  );\n  if (!existing) {\n    await run(\n      `INSERT INTO ${T.requests} (user_id, name, email, note, status, created_at)\n       VALUES (?, ?, ?, ?, 'pending', ?)`,\n      [user.id, user.name, user.email, note, new Date().toISOString()]\n    );\n  }\n\n  const message =\n    `Seller application - ${CONFIG.brand}\\n` +\n    `Name: ${user.name}\\n` +\n    `Email: ${user.email}\\n` +\n    `Account ID: ${user.id}` +\n    (note ? `\\nAbout: ${note}` : \"\") +\n    `\\n\\nPlease approve my seller access.`;\n\n  const { url: waUrl, prefill } = buildWaUrl(CONFIG.brandWa, message);\n  return json({ success: true, waUrl, message, prefill, alreadyPending: !!existing });\n}\n\nasync function pendingSellers(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!isAdmin(user)) return json({ error: \"Not found\" }, 404);\n  return json({\n    requests: await q(\n      `SELECT r.id, r.user_id, r.name, r.email, r.note, r.status, r.created_at, u.role\n         FROM ${T.requests} r JOIN ${T.users} u ON u.id = r.user_id\n        ORDER BY (r.status = 'pending') DESC, r.id DESC LIMIT 200`\n    ),\n  });\n}\n\nasync function approveSeller(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!isAdmin(user)) return json({ error: \"Not found\" }, 404);\n\n  const b = await readBody(req);\n  const userId = Number(b.userId);\n  const target = await one(`SELECT id, email FROM ${T.users} WHERE id = ?`, [userId]);\n  if (!target) return json({ error: \"No such user.\" }, 404);\n  if (String(target.email).toLowerCase() === ADMIN_EMAIL)\n    return json({ error: \"The admin account already has full access.\" }, 400);\n\n  await run(`UPDATE ${T.users} SET role = 'approved_seller' WHERE id = ?`, [userId]);\n  await run(\n    `UPDATE ${T.requests} SET status = 'approved', decided_at = ? WHERE user_id = ? AND status = 'pending'`,\n    [new Date().toISOString(), userId]\n  );\n  return json({ success: true });\n}\n\nasync function adminOrders(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!isAdmin(user)) return json({ error: \"Not found\" }, 404);\n  const totals = await one(`SELECT COUNT(*) AS n, COALESCE(SUM(price),0) AS value FROM ${T.orders}`);\n  return json({\n    totals,\n    orders: await q(\n      `SELECT sku, product_title, price, seller_name, buyer_name, buyer_email, status, created_at\n         FROM ${T.orders} ORDER BY id DESC LIMIT 200`\n    ),\n  });\n}\n\n/* ================================================================== */\n/* frontend                                                           */\n/* ================================================================== */\n\nconst ORDER_STATUSES = [\"Pending\", \"Delivered\", \"Cancelled\"];\n\n/**\n * Who may move an order:\n *   admin  — any order, any status\n *   seller — orders on their own listings\n *   buyer  — may cancel their own order while it is still Pending\n */\nasync function setOrderStatus(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!user) return json({ error: \"Log in first.\" }, 401);\n\n  const b = await readBody(req);\n  const sku = String(b.sku || \"\").trim();\n  const status = String(b.status || \"\").trim();\n  if (!ORDER_STATUSES.includes(status)) return json({ error: \"Unknown status.\" }, 400);\n\n  const order = await one(`SELECT sku, seller_id, buyer_email, status FROM ${T.orders} WHERE sku = ?`, [sku]);\n  if (!order) return json({ error: \"No order with that SKU.\" }, 404);\n\n  const admin = isAdmin(user);\n  const isSeller = order.seller_id != null && Number(order.seller_id) === Number(user.id);\n  const isBuyer = String(order.buyer_email || \"\") === String(user.email);\n\n  let allowed = false;\n  if (admin || isSeller) allowed = true;\n  else if (isBuyer && status === \"Cancelled\" && order.status === \"Pending\") allowed = true;\n  if (!allowed) return json({ error: \"You can't change this order.\" }, 403);\n\n  await run(`UPDATE ${T.orders} SET status = ?, updated_at = ? WHERE sku = ?`, [\n    status,\n    new Date().toISOString(),\n    sku,\n  ]);\n  return json({ success: true, sku, status });\n}\n\nasync function adminUsers(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!isAdmin(user)) return json({ error: \"Not found\" }, 404);\n  return json({\n    users: await q(\n      `SELECT u.id, u.name, u.email, u.role, u.verified, u.banned, u.created_at,\n              (SELECT COUNT(*) FROM ${T.listings} l WHERE l.seller_id = u.id AND l.active = 1) AS listings,\n              (SELECT COUNT(*) FROM ${T.orders} o WHERE o.seller_id = u.id) AS sales\n         FROM ${T.users} u ORDER BY u.id DESC LIMIT 300`\n    ),\n  });\n}\n\n/**\n * approve | revoke | ban | unban | verify\n * Banning also drops the user's sessions, so an open tab stops working on its\n * next request instead of staying live until the token is discarded.\n */\nasync function adminUserAction(req: Request): Promise {\n  const user = await currentUser(req);\n  if (!isAdmin(user)) return json({ error: \"Not found\" }, 404);\n\n  const b = await readBody(req);\n  const userId = Number(b.userId);\n  const action = String(b.action || \"\");\n  const target = await one(`SELECT id, email FROM ${T.users} WHERE id = ?`, [userId]);\n  if (!target) return json({ error: \"No such user.\" }, 404);\n  if (String(target.email).toLowerCase() === ADMIN_EMAIL)\n    return json({ error: \"The master account can't be changed from here.\" }, 400);\n\n  const now = new Date().toISOString();\n  switch (action) {\n    case \"approve\":\n      await run(`UPDATE ${T.users} SET role = 'approved_seller' WHERE id = ?`, [userId]);\n      await run(\n        `UPDATE ${T.requests} SET status = 'approved', decided_at = ? WHERE user_id = ? AND status = 'pending'`,\n        [now, userId]\n      );\n      break;\n    case \"revoke\":\n      await run(`UPDATE ${T.users} SET role = 'buyer' WHERE id = ?`, [userId]);\n      await run(`UPDATE ${T.listings} SET active = 0 WHERE seller_id = ?`, [userId]);\n      await run(\n        `UPDATE ${T.requests} SET status = 'revoked', decided_at = ? WHERE user_id = ? AND status = 'approved'`,\n        [now, userId]\n      );\n      break;\n    case \"ban\":\n      await run(`UPDATE ${T.users} SET banned = 1 WHERE id = ?`, [userId]);\n      await run(`DELETE FROM ${T.sessions} WHERE user_id = ?`, [userId]);\n      break;\n    case \"unban\":\n      await run(`UPDATE ${T.users} SET banned = 0 WHERE id = ?`, [userId]);\n      break;\n    case \"verify\":\n      await run(\n        `UPDATE ${T.users} SET verified = 1, verify_code = NULL, verify_expires = NULL WHERE id = ?`,\n        [userId]\n      );\n      break;\n    default:\n      return json({ error: \"Unknown action.\" }, 400);\n  }\n  return json({ success: true });\n}","label","theagentsyt",[130],"7720a866-ffb4-4610-9385-c73ed2fff56d",["D",1789201935009],2,[28],"pulls","branches",1,"forks","envVars",{"_152":154,"_155":63},"connections",{"_152":63,"_153":63},"count","unfilledCount",3,"emptyCount",{"_44":140,"_33":28,"_31":32,"_131":-5,"_42":43,"_41":14,"_133":25,"_39":162,"_13":142,"_34":38,"_36":37,"_24":25,"_137":-5,"_159":163,"_27":164},{"_44":129,"_33":130,"_31":57,"_131":-5,"_42":43,"_41":132,"_133":25,"_39":158,"_13":135,"_34":38,"_36":136,"_24":25,"_137":138,"_159":160,"_27":161},["D",1789201814090],"children",[],[130],["D",1789201935009],[],[28],["D",1789198617445],{"_97":96,"_105":101},{"_97":96,"_98":99,"_100":101,"_18":55,"_102":103,"_104":25},{"_13":86,"_33":87,"_44":43,"_88":45,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":46,"_95":96},"ctx",{"_79":-5,"_124":202,"_203":204,"_205":206,"_207":25,"_208":25,"_209":25,"_210":59,"_211":-5,"_212":-7,"_213":-7,"_214":63,"_215":25,"_216":25,"_217":-5,"_218":25,"_219":25,"_220":25,"_221":-5},"ENV",{"_173":174,"_175":176,"_177":87,"_178":179,"_180":181,"_182":183,"_184":185,"_186":187,"_188":189,"_190":191,"_192":193,"_194":195,"_196":197,"_198":199,"_200":201},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","fdb67791413f4386b4dbf18f354029a617f6160f","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]
Diff · v17
