P1-P3 admin cleanup: rank guard, SSRF guard, count caching, dead code removal, pagination rewrite

- P1: new src/lib/admin/rank-guard.ts with tryGuardRank/guardRank + RankGuardTarget/Result; extracted from users.ts; applied to admin-bans (create/lift + rank redirect) and admin-badges (caps + rank guard + error surfacing); import-url-safety.ts SSRF guard wired into clone save+icon fetch; logAudit await in help-tickets; antiddos mutations SETTINGS_EDIT; markAllAlertsRead NOTIFICATIONS_EDIT; rankError/saveError in all 25 message files; tests rew/new for bans/badges/rank-guard/import-url-safety

- P2: ticket-inbox merged pagination reworked to single UNION ALL SQL with LIMIT/OFFSET (avoids O(offset) materialization); getCachedAdminCount with cacheFiltered option applied to devops/errors/photos/items/guilds/help-tickets/moderation pages; admin-theme catches→?error=1+banner+25 locales; logger in silent catches (rare-values/writeable-boxes); catalog-items-loader CAST→plain equality; count caching helper extended with opt-in cacheFiltered

- P3: removed dead modules is-staff/notice/recent-furni-resync/log-filters plus load-user-sanctions/user-sanction-timeline; removed orphaned CATALOG_PAGE_COLUMNS re-export; removed getFurniIconUrl from studio-furni-icons

Build: lint 0, typecheck 0, 3480 tests pass, i18n:check exit 0, colors exit 0. Circular chunk warning (9452/10535/66463) is webpack code-splitting artifact; build succeeds.

README.md

@@ -974,6 +974,13 @@ Every heavy command therefore runs inside its own cgroup with a hard
 `MemoryMax`, via `scripts/with-memory-cap.sh`. If the build outgrows its
 ceiling, only that cgroup is killed — the build fails, the site keeps serving.
 
+The systemd backend also sets `MemoryHigh` (95% of the ceiling) so the kernel
+reclaims and throttles **before** the hard limit, and it clamps the ceiling to
+`MemAvailable - reserve` (`CMS_MEMORY_CAP_RESERVE`, default `4g`). That stops a
+cap larger than the free memory from dragging the whole host into the global
+OOM-killer. `MemorySwapMax=0` is set explicitly (this host has no swap). If
+fewer than 1 GB would remain, the script refuses to start.
+
 | Script                | Ceiling | Covers                                  |
 | --------------------- | ------- | --------------------------------------- |
 | `pnpm dev`            | 8 GB    | Dev server                              |
@@ -1027,6 +1034,10 @@ where the container *is* the boundary (the Docker build, a CI runner), set
 On a host **without** systemd and without `CMS_MEMORY_CAP_BACKEND=none`, the
 script refuses to run rather than proceeding unbounded.
 
+Tunables for the systemd backend: `CMS_MEMORY_CAP_RESERVE` (default `4g`) is
+the headroom left for everything else on the machine; the effective ceiling is
+`min(requested, MemAvailable - reserve)`.
+
 > Do not "fix" a cap failure by lowering `--max-old-space-size` or by raising
 > `CMS_MEMORY_CAP_VIRTUAL` (the default is `40g` on purpose). A `ulimit -v` of
 > 10g makes V8 clamp its own heap to ~2.25 GB and webpack dies with

scripts/with-memory-cap.sh

@@ -26,9 +26,21 @@
 #   systemd (cgroup MemoryMax)
 #     Meet RSS over de héle procesboom. Dit is de echte garantie en wordt
 #     overal gebruikt waar systemd beschikbaar is (de host waar deze
-#     CMS draait). De RSS-plafonds in package.json zijn hierop gekozen:
-#     `next build` piekte op 6,5GB, dus 10GB laat ruimte over terwijl er
-#     6GB basislast naast blijft passen binnen de 23,5GB van deze machine.
+#     CMS draait). De plafonds in package.json zijn hierop gekozen:
+#     `next build` piekt op ~9,7GB in `memory.current` (inclusief de
+#     page cache die de build zelf opbouwt), dus 10GB laat net genoeg ruimte
+#     over terwijl er ~6-9GB basislast naast blijft passen op deze machine.
+#
+#     Twee extra vangnetten, omdat de basislast inmiddels groter kan zijn
+#     (Docker, de emulator en de agent tikken samen ~9GB aan) en een vaste cap
+#     die hoger is dan het vrije geheugen de host alsnog kan laten OOM-killen:
+#       - MemoryHigh (95% van de cap) dwingt de kernel eerder te reclaimen en
+#         te throttlen, zodat een allocatiestorm de harde grens niet voorbij
+#         schiet voordat de cgroup-OOM-killer reageert;
+#       - het plafond wordt teruggeschroefd tot `MemAvailable - reserve`, met
+#         `CMS_MEMORY_CAP_RESERVE` (standaard 4g) als marge voor de rest van
+#         de machine. Is er minder dan 1GB over, dan weigert het script.
+#     MemorySwapMax=0 staat expliciet aan: deze host heeft geen swap.
 #
 #   ulimit -v (per proces, virtuele adresruimte)
 #     Alleen als expliciet gevraagd. Meet virtuele adresruimte, NIET RSS, en
@@ -58,6 +70,7 @@
 # Gebruik: bash scripts/with-memory-cap.sh 10g <command...>
 # Backend kiezen: CMS_MEMORY_CAP_BACKEND=systemd|ulimit|none|auto
 # ulimit-waarde kiezen: CMS_MEMORY_CAP_VIRTUAL=40g
+# Marge bovenop de basislast: CMS_MEMORY_CAP_RESERVE=4g
 set -Eeuo pipefail
 
 usage() {
@@ -122,9 +135,46 @@ probe_systemd() {
 	return 1
 }
 
+# Beschikbaar geheugen in bytes: wat het systeem kan toewijzen zonder te
+# swappen. Dit is inclusief opvraagbare page cache, dus de juiste maat om te
+# bepalen hoeveel een nieuwe cgroup nog mag gebruiken zonder de host in de
+# globale OOM-killer te duwen.
+mem_available_bytes() {
+	local kb
+	kb="$(grep -m1 '^MemAvailable:' /proc/meminfo 2>/dev/null | tr -dc '0-9')"
+	[ -n "$kb" ] || kb=0
+	echo $((kb * 1024))
+}
+
 run_systemd() {
-	echo "[mem-cap] systemd cgroup MemoryMax=$((bytes / 1024 / 1024 / 1024))GB: $*" >&2
-	exec "${systemd_cmd[@]}" -p "MemoryMax=$bytes" "$@"
+	local effective="$bytes"
+	# Houd marge voor de al draaiende basislast (MariaDB, Docker, de live
+	# release, de agent) plus kernel/page cache. Zonder die marge kan een cap
+	# die hoger is dan het werkelijk beschikbare geheugen alsnog de host laten
+	# OOM-killen voordat de cgroup-grens grijpt.
+	local reserve
+	reserve="$(to_bytes "${CMS_MEMORY_CAP_RESERVE:-4g}")" || exit 64
+	local available
+	available="$(mem_available_bytes)"
+	if [ "$available" -gt 0 ]; then
+		local headroom=$((available > reserve ? available - reserve : 0))
+		if [ "$headroom" -lt "$effective" ]; then
+			echo "[mem-cap] plafond verlaagd naar $((headroom / 1024 / 1024))MB: MemAvailable=$((available / 1024 / 1024))MB reserve=$((reserve / 1024 / 1024))MB" >&2
+			effective="$headroom"
+		fi
+	fi
+	if [ "$effective" -lt $((1024 * 1024 * 1024)) ]; then
+		echo "[mem-cap] te weinig vrij geheugen (MemAvailable=$((available / 1024 / 1024))MB) om begrensd te starten; weiger." >&2
+		echo "[mem-cap] maak geheugen vrij of verhoog CMS_MEMORY_CAP_RESERVE bewust niet." >&2
+		return 1
+	fi
+	# MemoryHigh laat de kernel proactief reclaimen en throttlen vóór de harde
+	# MemoryMax, zodat een snelle allocatiestorm niet voorbij de grens schiet en
+	# de (globale) OOM-killer de hele machine meeneemt. MemorySwapMax=0 is
+	# expliciet: deze host heeft geen swap.
+	local high=$((effective * 95 / 100))
+	echo "[mem-cap] systemd cgroup MemoryHigh=$((high / 1024 / 1024))MB MemoryMax=$((effective / 1024 / 1024))MB MemorySwapMax=0: $*" >&2
+	exec "${systemd_cmd[@]}" -p "MemoryHigh=$high" -p "MemoryMax=$effective" -p "MemorySwapMax=0" "$@"
 }
 
 run_ulimit() {

src/actions/admin-alerts.ts

@@ -34,7 +34,7 @@ export async function sendHotelAlert(formData: FormData): Promise<void> {
 
 /** Mark every unread ops alert as read. */
 export async function markAllAlertsRead(): Promise<void> {
-	await requirePermission(PERMS.NOTIFICATIONS_VIEW);
+	await requirePermission(PERMS.NOTIFICATIONS_EDIT);
 	try {
 		await db
 			.update(AlertLogs)

src/actions/admin-antiddos.ts

@@ -140,7 +140,7 @@ async function persistSettings(config: AntiddosConfig): Promise<void> {
  * override the proxy reads, so the change is live within the proxy cache TTL.
  */
 export async function saveAntiddosSettings(formData: FormData): Promise<void> {
-	const staff = await requirePermission(PERMS.SETTINGS_VIEW);
+	const staff = await requirePermission(PERMS.SETTINGS_EDIT);
 	const config = configFromForm(formData);
 
 	try {
@@ -165,7 +165,7 @@ export async function saveAntiddosSettings(formData: FormData): Promise<void> {
  * DB-persisted settings. The gate immediately falls back to env ANTI_DDOS_*.
  */
 export async function resetAntiddosSettings(): Promise<void> {
-	const staff = await requirePermission(PERMS.SETTINGS_VIEW);
+	const staff = await requirePermission(PERMS.SETTINGS_EDIT);
 
 	try {
 		if (redis) await redis.del(OVERRIDE_KEY);
@@ -186,7 +186,7 @@ export async function resetAntiddosSettings(): Promise<void> {
 
 /** Remove a single IP from the temporary DDoS block list. */
 export async function unbanAntiddosIp(formData: FormData): Promise<void> {
-	const staff = await requirePermission(PERMS.SETTINGS_VIEW);
+	const staff = await requirePermission(PERMS.SETTINGS_EDIT);
 	const ip = str(formData.get("ip")).trim();
 	if (!ip) return;
 
@@ -213,7 +213,7 @@ export async function unbanAntiddosIp(formData: FormData): Promise<void> {
 
 /** Remove an automatic Cloudflare edge block for a tracked IP. */
 export async function removeCloudflareRule(formData: FormData): Promise<void> {
-	const staff = await requirePermission(PERMS.SETTINGS_VIEW);
+	const staff = await requirePermission(PERMS.SETTINGS_EDIT);
 	const ip = str(formData.get("ip")).trim();
 	if (!ip) return;
 
@@ -233,7 +233,7 @@ export async function removeCloudflareRule(formData: FormData): Promise<void> {
 
 /** Test the configured Cloudflare API credentials against the zone. */
 export async function verifyCloudflareConfiguration(): Promise<void> {
-	const staff = await requirePermission(PERMS.SETTINGS_VIEW);
+	const staff = await requirePermission(PERMS.SETTINGS_EDIT);
 	const status = await verifyCloudflareConnection();
 	await setLastCloudflareVerify(status);
 	logger.info("Cloudflare API configuration verified", {

src/actions/admin-bans.ts

@@ -2,8 +2,10 @@
 
 import { eq } from "drizzle-orm";
 import { revalidatePath } from "next/cache";
+import { redirect } from "next/navigation";
 import { requirePermissionRateLimited } from "@/lib/admin/guard";
-import { Ban, db, User } from "@/lib/db";
+import { tryGuardRank } from "@/lib/admin/rank-guard";
+import { Ban, db } from "@/lib/db";
 import { PERMS } from "@/lib/permissions";
 import { rcon } from "@/lib/services/rcon";
 import { logStaffActivity } from "@/lib/services/staff-activity";
@@ -26,16 +28,15 @@ export async function createBan(formData: FormData): Promise<void> {
 	const type = String(formData.get("type"));
 	if (!(userId > 0) || !BAN_TYPES.has(type)) return;
 
+	const guard = await tryGuardRank(userId, staff.rank);
+	if (!guard.ok && guard.reason === "rank") {
+		redirect("/admin/bans?error=rank");
+	}
+
 	const now = Math.floor(Date.now() / 1000);
 	// Emulator convention: banExpire 0 = permanent (not a far-future timestamp).
 	const banExpire = hours > 0 ? now + Math.floor(hours) * 3600 : 0;
 
-	const [user] = await db
-		.select({ username: User.username })
-		.from(User)
-		.where(eq(User.id, userId))
-		.limit(1);
-
 	await db.insert(Ban).values({
 		userId,
 		ip: "",
@@ -48,7 +49,7 @@ export async function createBan(formData: FormData): Promise<void> {
 		cfhTopic: -1,
 	});
 
-	if (user) await rcon.disconnectUser(userId, user.username);
+	if (guard.ok) await rcon.disconnectUser(userId, guard.target.username);
 	await logStaffActivity({
 		staffId: staff.id,
 		action: "user_ban",
@@ -63,6 +64,17 @@ export async function liftBan(formData: FormData): Promise<void> {
 	const staff = await requirePermissionRateLimited(PERMS.USERS_BAN);
 	const id = Number(formData.get("id"));
 	if (id > 0) {
+		const [ban] = await db
+			.select({ userId: Ban.userId })
+			.from(Ban)
+			.where(eq(Ban.id, id))
+			.limit(1);
+		if (ban) {
+			const guard = await tryGuardRank(ban.userId, staff.rank);
+			if (!guard.ok && guard.reason === "rank") {
+				redirect("/admin/bans?error=rank");
+			}
+		}
 		await db.delete(Ban).where(eq(Ban.id, id));
 		await logStaffActivity({
 			staffId: staff.id,

src/actions/admin-help-tickets.ts

@@ -70,7 +70,7 @@ export const liftBanFromHelpTicket = adminAction(
 				.where(eq(WebsiteHelpCenterTickets.id, ticketId));
 		}
 
-		logAudit({
+		await logAudit({
 			userId: ctx.session.user.id,
 			action: "unban_via_help_ticket",
 			target: "User",
@@ -123,7 +123,7 @@ export const replyHelpCenterTicket = adminAction(
 				.where(eq(WebsiteHelpCenterTickets.id, ticketId));
 		});
 
-		logAudit({
+		await logAudit({
 			userId: staffId,
 			action: "help_center_ticket_reply",
 			target: "WebsiteHelpCenterTickets",
@@ -157,7 +157,7 @@ export const closeHelpCenterTicket = adminAction(
 			.set({ open: false, updatedAt: now })
 			.where(eq(WebsiteHelpCenterTickets.id, ticketId));
 
-		logAudit({
+		await logAudit({
 			userId: Number(ctx.session.user.id),
 			action: "help_center_ticket_close",
 			target: "WebsiteHelpCenterTickets",
@@ -193,7 +193,7 @@ export const reopenHelpCenterTicket = adminAction(
 			.set({ open: true, updatedAt: now })
 			.where(eq(WebsiteHelpCenterTickets.id, ticketId));
 
-		logAudit({
+		await logAudit({
 			userId: Number(ctx.session.user.id),
 			action: "help_center_ticket_reopen",
 			target: "WebsiteHelpCenterTickets",

src/actions/admin-rare-values.ts

@@ -6,6 +6,7 @@ import { requirePermission } from "@/lib/admin/guard";
 import { db, WebsiteRareValueCategories, WebsiteRareValues } from "@/lib/db";
 import { EDGE_CACHE_TAGS, purgeEdgeCache } from "@/lib/edge-cache";
 import { formPositiveBigInt } from "@/lib/form-data";
+import { logger } from "@/lib/logger";
 import { PERMS } from "@/lib/permissions";
 
 export async function createCategory(formData: FormData): Promise<void> {
@@ -31,8 +32,9 @@ export async function createCategory(formData: FormData): Promise<void> {
 			badge,
 			priority,
 		});
-	} catch {
-		// Unique name collision or DB error — ignore, page will re-render unchanged.
+	} catch (err) {
+		// Unique name collision or DB error — page re-renders unchanged.
+		logger.error("Failed to create rare-value category", { err });
 	}
 	revalidatePath("/admin/rare-values");
 	void purgeEdgeCache([EDGE_CACHE_TAGS.public], "rare values edited");
@@ -51,8 +53,8 @@ export async function deleteCategory(formData: FormData): Promise<void> {
 		await db
 			.delete(WebsiteRareValueCategories)
 			.where(eq(WebsiteRareValueCategories.id, id));
-	} catch {
-		// Not found or DB error — ignore.
+	} catch (err) {
+		logger.error("Failed to delete rare value", { err });
 	}
 	revalidatePath("/admin/rare-values");
 	void purgeEdgeCache([EDGE_CACHE_TAGS.public], "rare values edited");
@@ -100,8 +102,8 @@ export async function createValue(formData: FormData): Promise<void> {
 			currencyType,
 			furnitureIcon,
 		});
-	} catch {
-		// DB error — ignore.
+	} catch (err) {
+		logger.error("Failed to persist rare value", { err });
 	}
 	revalidatePath("/admin/rare-values");
 	void purgeEdgeCache([EDGE_CACHE_TAGS.public], "rare values edited");
@@ -114,8 +116,8 @@ export async function deleteValue(formData: FormData): Promise<void> {
 
 	try {
 		await db.delete(WebsiteRareValues).where(eq(WebsiteRareValues.id, id));
-	} catch {
-		// Not found or DB error — ignore.
+	} catch (err) {
+		logger.error("Failed to delete rare value", { err });
 	}
 	revalidatePath("/admin/rare-values");
 	void purgeEdgeCache([EDGE_CACHE_TAGS.public], "rare values edited");
@@ -146,8 +148,8 @@ export async function updateCategory(formData: FormData): Promise<void> {
 			.update(WebsiteRareValueCategories)
 			.set({ name, badge, priority })
 			.where(eq(WebsiteRareValueCategories.id, id));
-	} catch {
-		// Unique name collision or DB error — ignore.
+	} catch (err) {
+		logger.error("Failed to update rare-value category", { err });
 	}
 	revalidatePath("/admin/rare-values");
 	void purgeEdgeCache([EDGE_CACHE_TAGS.public], "rare values edited");
@@ -201,8 +203,8 @@ export async function updateValue(formData: FormData): Promise<void> {
 			.update(WebsiteRareValues)
 			.set(sets)
 			.where(eq(WebsiteRareValues.id, id));
-	} catch {
-		// DB error — ignore.
+	} catch (err) {
+		logger.error("Failed to persist rare value", { err });
 	}
 	revalidatePath("/admin/rare-values");
 	void purgeEdgeCache([EDGE_CACHE_TAGS.public], "rare values edited");

src/actions/admin-theme.test.ts

@@ -141,13 +141,13 @@ describe("saveTheme", () => {
 		expect(mockRedirect).toHaveBeenCalledWith("/admin/theme?saved=1");
 	});
 
-	it("fails soft when a write fails and still redirects", async () => {
+	it("redirects with an error when a write fails", async () => {
 		fakeDbConfig.fail = (kind: string) => kind === "insert";
 		await saveTheme(form({ color_primary: "#123456" }));
 		expect(mockReload).not.toHaveBeenCalled();
 		expect(mockLogStaffActivity).not.toHaveBeenCalled();
 		expect(mockRevalidatePath).not.toHaveBeenCalled();
-		expect(mockRedirect).toHaveBeenCalledWith("/admin/theme?saved=1");
+		expect(mockRedirect).toHaveBeenCalledWith("/admin/theme?error=1");
 	});
 });
 
@@ -182,12 +182,12 @@ describe("applyPreset", () => {
 		expect(mockLogStaffActivity).not.toHaveBeenCalled();
 	});
 
-	it("fails soft on write errors", async () => {
+	it("redirects with an error on write errors", async () => {
 		fakeDbConfig.fail = (kind: string) => kind === "insert";
 		await applyPreset(form({ preset: "Ocean" }));
 		expect(mockReload).not.toHaveBeenCalled();
 		expect(mockLogStaffActivity).not.toHaveBeenCalled();
-		expect(mockRedirect).toHaveBeenCalledWith("/admin/theme?preset=Ocean");
+		expect(mockRedirect).toHaveBeenCalledWith("/admin/theme?error=1");
 	});
 });
 
@@ -218,12 +218,12 @@ describe("saveCustomTheme", () => {
 		expect(mockSnapshotCurrentTheme).not.toHaveBeenCalled();
 	});
 
-	it("fails soft on persist errors", async () => {
+	it("redirects with an error on persist errors", async () => {
 		mockUpsertCustomTheme.mockRejectedValueOnce(new Error("store down"));
 		await saveCustomTheme(form({ name: "My Theme" }));
 		expect(mockLogStaffActivity).not.toHaveBeenCalled();
 		expect(mockRevalidatePath).not.toHaveBeenCalled();
-		expect(mockRedirect).toHaveBeenCalledWith("/admin/theme?savedTheme=1");
+		expect(mockRedirect).toHaveBeenCalledWith("/admin/theme?error=1");
 	});
 });
 
@@ -284,7 +284,7 @@ describe("applyCustomTheme", () => {
 		);
 	});
 
-	it("fails soft on write errors", async () => {
+	it("redirects with an error on write errors", async () => {
 		mockGetCustomTheme.mockResolvedValue({
 			id: "t1",
 			name: "Studio",
@@ -296,7 +296,7 @@ describe("applyCustomTheme", () => {
 		expect(mockReload).not.toHaveBeenCalled();
 		expect(mockLogStaffActivity).not.toHaveBeenCalled();
 		expect(mockRevalidatePath).not.toHaveBeenCalled();
-		expect(mockRedirect).toHaveBeenCalledWith("/admin/theme?theme=Studio");
+		expect(mockRedirect).toHaveBeenCalledWith("/admin/theme?error=1");
 	});
 });
 
@@ -324,11 +324,11 @@ describe("renameCustomTheme", () => {
 		expect(mockSnapshotCurrentTheme).not.toHaveBeenCalled();
 	});
 
-	it("fails soft on upsert errors", async () => {
+	it("redirects with an error on upsert errors", async () => {
 		mockUpsertCustomTheme.mockRejectedValueOnce(new Error("store down"));
 		await renameCustomTheme(form({ id: "t1", name: "Renamed" }));
 		expect(mockRevalidatePath).not.toHaveBeenCalled();
-		expect(mockRedirect).toHaveBeenCalledWith("/admin/theme?renamed=1");
+		expect(mockRedirect).toHaveBeenCalledWith("/admin/theme?error=1");
 	});
 });
 
@@ -350,10 +350,10 @@ describe("deleteCustomTheme", () => {
 		expect(mockDeleteCustomThemeStore).not.toHaveBeenCalled();
 	});
 
-	it("fails soft on store errors", async () => {
+	it("redirects with an error on store errors", async () => {
 		mockDeleteCustomThemeStore.mockRejectedValueOnce(new Error("store down"));
 		await deleteCustomTheme(form({ id: "t1" }));
 		expect(mockRevalidatePath).not.toHaveBeenCalled();
-		expect(mockRedirect).toHaveBeenCalledWith("/admin/theme?deletedTheme=1");
+		expect(mockRedirect).toHaveBeenCalledWith("/admin/theme?error=1");
 	});
 });

src/actions/admin-theme.ts

@@ -104,7 +104,7 @@ export async function saveTheme(formData: FormData): Promise<void> {
 		});
 		revalidatePath("/", "layout");
 	} catch {
-		// ignore — page re-renders current state
+		return redirect("/admin/theme?error=1");
 	}
 	redirect("/admin/theme?saved=1");
 }
@@ -128,7 +128,7 @@ export async function applyPreset(formData: FormData): Promise<void> {
 		});
 		revalidatePath("/", "layout");
 	} catch {
-		// ignore
+		return redirect("/admin/theme?error=1");
 	}
 	redirect(`/admin/theme?preset=${encodeURIComponent(name)}`);
 }
@@ -149,7 +149,7 @@ export async function saveCustomTheme(formData: FormData): Promise<void> {
 		});
 		revalidatePath("/admin/theme");
 	} catch {
-		// ignore
+		return redirect("/admin/theme?error=1");
 	}
 	redirect("/admin/theme?savedTheme=1");
 }
@@ -175,7 +175,7 @@ export async function applyCustomTheme(formData: FormData): Promise<void> {
 		});
 		revalidatePath("/", "layout");
 	} catch {
-		// ignore
+		return redirect("/admin/theme?error=1");
 	}
 	redirect(`/admin/theme?theme=${encodeURIComponent(theme.name)}`);
 }
@@ -194,7 +194,7 @@ export async function renameCustomTheme(formData: FormData): Promise<void> {
 		await upsertCustomTheme(name, snapshot, id);
 		revalidatePath("/admin/theme");
 	} catch {
-		// ignore
+		return redirect("/admin/theme?error=1");
 	}
 	redirect("/admin/theme?renamed=1");
 }
@@ -209,7 +209,7 @@ export async function deleteCustomTheme(formData: FormData): Promise<void> {
 		await deleteCustomThemeStore(id);
 		revalidatePath("/admin/theme");
 	} catch {
-		// ignore
+		return redirect("/admin/theme?error=1");
 	}
 	redirect("/admin/theme?deletedTheme=1");
 }

src/actions/admin-writeable-boxes.ts

@@ -4,6 +4,7 @@ import { eq } from "drizzle-orm";
 import { revalidatePath } from "next/cache";
 import { requirePermission } from "@/lib/admin/guard";
 import { db, WebsiteWriteableBoxes } from "@/lib/db";
+import { logger } from "@/lib/logger";
 import { PERMS } from "@/lib/permissions";
 import { logStaffActivity } from "@/lib/services/staff-activity";
 
@@ -72,8 +73,9 @@ export async function createBox(formData: FormData): Promise<void> {
 			targetType: "writeable_box",
 			targetId: Number(result.insertId),
 		});
-	} catch {
-		// DB unavailable — swallow and re-render.
+	} catch (err) {
+		// DB unavailable — keep the page usable, but record the failure.
+		logger.error("Failed to create writeable box", { err });
 		return;
 	}
 
@@ -116,7 +118,8 @@ export async function updateBox(formData: FormData): Promise<void> {
 			targetType: "writeable_box",
 			targetId: Number(id),
 		});
-	} catch {
+	} catch (err) {
+		logger.error("Failed to persist writeable box", { err });
 		return;
 	}
 
@@ -140,7 +143,8 @@ export async function deleteBox(formData: FormData): Promise<void> {
 			targetType: "writeable_box",
 			targetId: Number(id),
 		});
-	} catch {
+	} catch (err) {
+		logger.error("Failed to persist writeable box", { err });
 		return;
 	}
 
@@ -168,7 +172,8 @@ export async function toggleBox(formData: FormData): Promise<void> {
 			targetType: "writeable_box",
 			targetId: Number(id),
 		});
-	} catch {
+	} catch (err) {
+		logger.error("Failed to persist writeable box", { err });
 		return;
 	}
 

src/actions/users.ts

@@ -4,6 +4,7 @@ import crypto from "node:crypto";
 import { and, eq } from "drizzle-orm";
 import { z } from "zod";
 import { isDynamicSuperAdmin } from "@/lib/admin/authorization-policy";
+import { guardRank } from "@/lib/admin/rank-guard";
 import { invalidateLoginCache } from "@/lib/auth";
 import { hashPassword } from "@/lib/auth/password";
 import { revokeUserCredentials } from "@/lib/auth/session-revocation";
@@ -329,32 +330,6 @@ export const removeBadge = adminAction(
 	},
 );
 
-// ── Rank guard helper ───────────────────────────────────────────────
-
-async function guardRank(targetUserId: number, sessionRank: number) {
-	const [target] = await db
-		.select({
-			username: User.username,
-			rank: User.rank,
-			mail: User.mail,
-		})
-		.from(User)
-		.where(eq(User.id, targetUserId))
-		.limit(1);
-	if (!target) throw new ActionError("User not found");
-	// The owner is whoever holds the hotel's highest rank *today*. The old
-	// `sessionRank < 7` shortcut handed every rank-7 account owner powers on
-	// any hotel whose top rank is 8+, which makes it a plain escalation.
-	const highestRank = await getHighestRank();
-	if (
-		target.rank >= sessionRank &&
-		!isDynamicSuperAdmin(sessionRank, highestRank)
-	) {
-		throw new ActionError("Cannot modify user with equal or higher rank");
-	}
-	return target;
-}
-
 // ── Reset Password ──────────────────────────────────────────────────
 
 const resetPasswordSchema = z.object({

src/app/admin/bans/page.tsx

@@ -11,12 +11,17 @@ import { Ban, db } from "@/lib/db";
 import { formatDate } from "@/lib/format-date";
 import { canAccess, getAdminContext, PERMS } from "@/lib/permissions";
 
-export default async function AdminBans() {
+export default async function AdminBans({
+	searchParams,
+}: {
+	searchParams: Promise<{ error?: string }>;
+}) {
 	const { session, permissions } = await getAdminContext();
 	if (!canAccess(permissions, PERMS.BANS_VIEW, session.user.rank)) {
 		redirect("/admin");
 	}
 
+	const params = await searchParams;
 	const t = await getTranslations("pages.admin.bans");
 	const now = unixNow();
 	let bans: (typeof Ban.$inferSelect)[] = [];
@@ -37,6 +42,11 @@ export default async function AdminBans() {
 	return (
 		<AdminPageShell icon={BanIcon} title={t("title")} subtitle={t("subtitle")}>
 			<main>
+				{params.error === "rank" ? (
+					<p role="alert" className="text-sm text-[var(--admin-error)] mb-4">
+						{t("rankError")}
+					</p>
+				) : null}
 				<div className="grid grid-cols-[repeat(auto-fit,minmax(180px,1fr))] gap-3.5 mb-6">
 					<StatusCard
 						label={t("activeBans")}

src/app/admin/devops/errors/page.tsx

@@ -1,10 +1,11 @@
-import { count, desc } from "drizzle-orm";
+import { desc } from "drizzle-orm";
 import { redirect } from "next/navigation";
 import { getTranslations } from "next-intl/server";
 import { Card, CardContent } from "@/components/ui/card";
 import { db, EmulatorErrors } from "@/lib/db";
 import { formatDate } from "@/lib/format-date";
 import { canAccess, getAdminContext, PERMS } from "@/lib/permissions";
+import { getCachedAdminCount } from "@/lib/services/admin-stats";
 
 export default async function EmulatorErrorsPage({
 	searchParams,
@@ -21,17 +22,16 @@ export default async function EmulatorErrorsPage({
 	const page = Math.max(1, Number(params.page) || 1);
 	const perPage = 50;
 
-	const [errors, totalRows] = await Promise.all([
+	const [errors, total] = await Promise.all([
 		db
 			.select()
 			.from(EmulatorErrors)
 			.orderBy(desc(EmulatorErrors.id))
 			.limit(perPage)
 			.offset((page - 1) * perPage),
-		db.select({ total: count() }).from(EmulatorErrors),
+		getCachedAdminCount(EmulatorErrors, "emulator_errors"),
 	]);
 
-	const total = Number(totalRows[0]?.total ?? 0);
 	const lastPage = Math.ceil(total / perPage);
 
 	return (

src/app/admin/guilds/page.tsx

@@ -11,6 +11,7 @@ import { calcPagination, parseListParams } from "@/lib/admin-helpers";
 import { db, Guilds, GuildsMembers, User } from "@/lib/db";
 import { formatDate } from "@/lib/format-date";
 import { canAccess, getAdminContext, PERMS } from "@/lib/permissions";
+import { getCachedAdminCount } from "@/lib/services/admin-stats";
 
 export default async function AdminGuildsPage({
 	searchParams,
@@ -50,11 +51,7 @@ export default async function AdminGuildsPage({
 				)
 			: undefined;
 
-		const [totalRow] = await db
-			.select({ total: count() })
-			.from(Guilds)
-			.where(where);
-		total = Number(totalRow?.total ?? 0);
+		total = await getCachedAdminCount(Guilds, "guilds", where);
 		const pagination = calcPagination(total, parsed.page, parsed.perPage);
 		rows = await db
 			.select({

src/app/admin/help-tickets/page.tsx

@@ -23,6 +23,7 @@ import {
 } from "@/lib/db";
 import { formatDate } from "@/lib/format-date";
 import { canAccess, getAdminContext, PERMS } from "@/lib/permissions";
+import { getCachedAdminCount } from "@/lib/services/admin-stats";
 import { type HelpTicketRow, HelpTicketsTable } from "./help-tickets-table";
 
 export default async function AdminHelpTicketsPage({
@@ -90,29 +91,27 @@ export default async function AdminHelpTicketsPage({
 							: WebsiteHelpCenterTickets.updatedAt;
 	const orderBy = parsed.order === "asc" ? asc(orderCol) : desc(orderCol);
 
-	const [totalRows, openRows, closedRows, queues] = await Promise.all([
-		db
-			.select({ total: count() })
-			.from(WebsiteHelpCenterTickets)
-			.where(where)
-			.catch(() => [{ total: 0 }]),
-		db
-			.select({ total: count() })
-			.from(WebsiteHelpCenterTickets)
-			.where(eq(WebsiteHelpCenterTickets.open, true))
-			.catch(() => [{ total: 0 }]),
-		db
-			.select({ total: count() })
-			.from(WebsiteHelpCenterTickets)
-			.where(eq(WebsiteHelpCenterTickets.open, false))
-			.catch(() => [{ total: 0 }]),
+	const [total, openCount, closedCount, queues] = await Promise.all([
+		getCachedAdminCount(
+			WebsiteHelpCenterTickets,
+			"help_tickets_total",
+			where,
+		).catch(() => 0),
+		getCachedAdminCount(
+			WebsiteHelpCenterTickets,
+			"help_tickets_open",
+			eq(WebsiteHelpCenterTickets.open, true),
+			{ cacheFiltered: true },
+		).catch(() => 0),
+		getCachedAdminCount(
+			WebsiteHelpCenterTickets,
+			"help_tickets_closed",
+			eq(WebsiteHelpCenterTickets.open, false),
+			{ cacheFiltered: true },
+		).catch(() => 0),
 		fetchTicketQueueOpenCounts(),
 	]);
 
-	const total = Number(totalRows[0]?.total ?? 0);
-	const openCount = Number(openRows[0]?.total ?? 0);
-	const closedCount = Number(closedRows[0]?.total ?? 0);
-
 	const pagination = calcPagination(total, parsed.page, parsed.perPage);
 
 	const tickets = await db

src/app/admin/items/page.tsx

@@ -1,10 +1,11 @@
-import { and, count, desc, eq, like, or } from "drizzle-orm";
+import { and, desc, eq, like, or } from "drizzle-orm";
 import { Package } from "lucide-react";
 import { getTranslations } from "next-intl/server";
 import { AdminPageShell } from "@/components/admin/admin-page-shell";
 import { fetchAdminList } from "@/lib/admin-list";
 import { db, ItemsBase } from "@/lib/db";
 import { canAccess, PERMS } from "@/lib/permissions";
+import { getCachedAdminCount } from "@/lib/services/admin-stats";
 import { type ItemsBaseRow, ItemsTable } from "./items-table";
 
 export default async function ItemsBasePage({
@@ -34,7 +35,7 @@ export default async function ItemsBasePage({
 					conditions.push(eq(ItemsBase.type, rawParams.filter_type));
 				}
 				const where = conditions.length > 0 ? and(...conditions) : undefined;
-				const [rows, totals] = await Promise.all([
+				const [rows, total] = await Promise.all([
 					db
 						.select({
 							id: ItemsBase.id,
@@ -51,7 +52,7 @@ export default async function ItemsBasePage({
 						.orderBy(desc(ItemsBase.id))
 						.limit(perPage)
 						.offset((page - 1) * perPage),
-					db.select({ total: count() }).from(ItemsBase).where(where),
+					getCachedAdminCount(ItemsBase, "items_base", where),
 				]);
 				return {
 					rows: rows.map((r) => ({
@@ -64,7 +65,7 @@ export default async function ItemsBasePage({
 						width: r.width,
 						length: r.length,
 					})),
-					total: totals[0]?.total ?? 0,
+					total,
 				};
 			},
 		},

src/app/admin/moderation/page.tsx

@@ -16,6 +16,7 @@ import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
 import { getMinStaffRank } from "@/lib/admin/min-staff-rank";
 import { AdminAuditLog, Ban, db, SupportTickets, User } from "@/lib/db";
 import { canAccess, getAdminContext, PERMS } from "@/lib/permissions";
+import { getCachedAdminCount } from "@/lib/services/admin-stats";
 
 const CFH_STATES: Record<number, { label: string; class: string }> = {
 	0: {
@@ -39,25 +40,31 @@ export default async function ModerationDashboard() {
 	const minStaffRank = await getMinStaffRank();
 
 	const [
-		openCfhRows,
-		pickedCfhRows,
-		todayBansRows,
+		openCfh,
+		pickedCfh,
+		todayBans,
 		modsOnlineRows,
 		recentCfh,
 		recentModActions,
 	] = await Promise.all([
-		db
-			.select({ total: count() })
-			.from(SupportTickets)
-			.where(eq(SupportTickets.state, 0)),
-		db
-			.select({ total: count() })
-			.from(SupportTickets)
-			.where(eq(SupportTickets.state, 1)),
-		db
-			.select({ total: count() })
-			.from(Ban)
-			.where(gte(Ban.timestamp, todayStart)),
+		getCachedAdminCount(
+			SupportTickets,
+			"moderation_open_cfh",
+			eq(SupportTickets.state, 0),
+			{ cacheFiltered: true },
+		),
+		getCachedAdminCount(
+			SupportTickets,
+			"moderation_picked_cfh",
+			eq(SupportTickets.state, 1),
+			{ cacheFiltered: true },
+		),
+		getCachedAdminCount(
+			Ban,
+			"moderation_today_bans",
+			gte(Ban.timestamp, todayStart),
+			{ cacheFiltered: true },
+		),
 		db
 			.select({ total: count() })
 			.from(User)
@@ -81,9 +88,6 @@ export default async function ModerationDashboard() {
 			.limit(10),
 	]);
 
-	const openCfh = Number(openCfhRows[0]?.total ?? 0);
-	const pickedCfh = Number(pickedCfhRows[0]?.total ?? 0);
-	const todayBans = Number(todayBansRows[0]?.total ?? 0);
 	const modsOnline = Number(modsOnlineRows[0]?.total ?? 0);
 
 	// Fetch usernames for CFH tickets

src/app/admin/photos/page.tsx

@@ -1,4 +1,4 @@
-import { count, desc, inArray } from "drizzle-orm";
+import { desc, inArray } from "drizzle-orm";
 import { Camera } from "lucide-react";
 import { redirect } from "next/navigation";
 import { getTranslations } from "next-intl/server";
@@ -11,6 +11,7 @@ import { calcPagination, parseListParams } from "@/lib/admin-helpers";
 import { CameraWeb, db, User } from "@/lib/db";
 import { formatDate } from "@/lib/format-date";
 import { canAccess, getAdminContext, PERMS } from "@/lib/permissions";
+import { getCachedAdminCount } from "@/lib/services/admin-stats";
 
 export default async function AdminPhotos({
 	searchParams,
@@ -25,11 +26,9 @@ export default async function AdminPhotos({
 	const t = await getTranslations("pages.admin.photos");
 	const parsed = parseListParams(new URLSearchParams(await searchParams));
 
-	const [totalRow] = await db
-		.select({ total: count() })
-		.from(CameraWeb)
-		.catch(() => [{ total: 0 }]);
-	const total = Number(totalRow?.total ?? 0);
+	const total = await getCachedAdminCount(CameraWeb, "camera_web").catch(
+		() => 0,
+	);
 	const pagination = calcPagination(total, parsed.page, parsed.perPage || 24);
 
 	let photos: (typeof CameraWeb.$inferSelect)[] = [];

src/app/admin/theme/page.tsx

@@ -323,6 +323,7 @@ export default async function AdminTheme({
 		theme?: string;
 		renamed?: string;
 		deletedTheme?: string;
+		error?: string;
 	}>;
 }) {
 	const { session, permissions } = await getAdminContext();
@@ -372,6 +373,14 @@ export default async function AdminTheme({
 
 	return (
 		<main>
+			{sp.error ? (
+				<div
+					role="alert"
+					className="mb-4 p-3 rounded-lg text-xs text-[var(--admin-error)]"
+				>
+					{t("saveError")}
+				</div>
+			) : null}
 			{sp.saved ? (
 				<div className="mb-4 p-3 rounded-lg theme-status-success text-xs">
 					{t("saved")}

src/app/admin/users/_components/user-sanction-timeline.tsx

@@ -1,83 +0,0 @@
-import Link from "@/components/link";
-import { formatDate } from "@/lib/format-date";
-import type { SanctionEvent } from "../_lib/load-user-sanctions";
-
-const KIND_CLASS: Record<SanctionEvent["kind"], string> = {
-	ban: "bg-[var(--admin-error-subtle)] text-[var(--admin-error)]",
-	lift: "bg-[var(--admin-success-subtle)] text-[var(--admin-success)]",
-	mute: "bg-[var(--admin-accent)]/20 text-[var(--admin-accent)]",
-	unmute: "bg-[var(--admin-success-subtle)] text-[var(--admin-success)]",
-	cfh: "bg-[var(--admin-accent)]/15 text-[var(--admin-text)]",
-	staff: "bg-[var(--admin-border)] text-[var(--admin-text-muted)]",
-	status: "bg-[var(--admin-accent)]/25 text-[var(--admin-accent)]",
-};
-
-export function UserSanctionTimeline({
-	events,
-	muteUntil,
-}: {
-	events: SanctionEvent[];
-	muteUntil: number;
-}) {
-	const now = Math.floor(Date.now() / 1000);
-	const muted = muteUntil > now;
-
-	return (
-		<div className="rounded-lg border bg-card p-4 space-y-4">
-			<div className="flex items-center justify-between gap-2">
-				<h3 className="text-sm font-semibold m-0">Sanctions timeline</h3>
-				{muted ? (
-					<span className="text-xs font-bold px-2 py-0.5 rounded-full bg-[var(--admin-accent)]/20 text-[var(--admin-accent)]">
-						Muted until {formatDate(new Date(muteUntil * 1000))}
-					</span>
-				) : null}
-			</div>
-
-			{events.length === 0 ? (
-				<p className="text-sm text-muted-foreground m-0">
-					No bans, mutes, CFH, or staff actions recorded for this user.
-				</p>
-			) : (
-				<ol className="space-y-3 m-0 p-0 list-none">
-					{events.map((ev) => (
-						<li
-							key={ev.id}
-							className="flex gap-3 border-b border-[var(--admin-border)] pb-3 last:border-0 last:pb-0"
-						>
-							<span
-								className={`shrink-0 mt-0.5 text-[0.65rem] font-bold uppercase tracking-wide px-2 py-0.5 rounded-full ${KIND_CLASS[ev.kind]}`}
-							>
-								{ev.kind}
-							</span>
-							<div className="min-w-0 flex-1">
-								<div className="flex flex-wrap items-baseline gap-x-2 gap-y-0.5">
-									{ev.href ? (
-										<Link
-											href={ev.href}
-											className="text-sm font-medium hover:underline"
-										>
-											{ev.label}
-										</Link>
-									) : (
-										<span className="text-sm font-medium">{ev.label}</span>
-									)}
-									<span className="text-xs text-muted-foreground">
-										{formatDate(new Date(ev.at * 1000))}
-									</span>
-									{ev.actor ? (
-										<span className="text-xs text-muted-foreground">
-											by {ev.actor}
-										</span>
-									) : null}
-								</div>
-								<p className="text-xs text-muted-foreground m-0 mt-0.5 break-words">
-									{ev.detail}
-								</p>
-							</div>
-						</li>
-					))}
-				</ol>
-			)}
-		</div>
-	);
-}

src/app/api/admin/import/clone/icon/route.ts

@@ -1,5 +1,6 @@
 import { apiError } from "@/lib/api";
 import { withAdmin } from "@/lib/api-handler";
+import { assertSafeImportUrl } from "@/lib/import-url-safety";
 import { PERMS } from "@/lib/permissions";
 import { extractFurniIconPng } from "@/lib/services/clone-icon";
 import { getSource } from "@/lib/services/clone-sources";
@@ -38,10 +39,20 @@ export const GET = withAdmin(
 		if (icon === undefined) {
 			const source = await getSource(sourceId);
 			if (!source) return apiError("Source not found", 404);
+			if (!source.nitroBaseUrl)
+				return apiError("Source has no nitro base URL", 400);
 			try {
-				const res = await fetch(`${source.nitroBaseUrl}/${classname}.nitro`, {
+				await assertSafeImportUrl(source.nitroBaseUrl, "nitroBaseUrl");
+			} catch (err) {
+				return apiError((err as Error).message, 400);
+			}
+			try {
+				const res = await fetch(
+					`${source.nitroBaseUrl.replace(/\/+$/, "")}/${classname}.nitro`,
+					{
 						signal: AbortSignal.timeout(15000),
-				});
+					},
+				);
 				if (!res.ok) {
 					iconCache.set(cacheKey, null);
 					return apiError("Bundle not found", 404);

src/app/api/admin/import/clone/route.ts

@@ -1,5 +1,6 @@
 import { apiError, apiOk } from "@/lib/api";
 import { withAdmin } from "@/lib/api-handler";
+import { assertSafeImportUrl } from "@/lib/import-url-safety";
 import { PERMS } from "@/lib/permissions";
 import { logAudit } from "@/lib/services/audit";
 import {
@@ -87,22 +88,25 @@ export const POST = withAdmin(
 		} = body as Record<string, string>;
 		const enabledRaw = (body as Record<string, unknown>).enabled;
 
-		const isHttps = (u: string) => {
-			try {
-				return new URL(u).protocol === "https:";
-			} catch {
-				return false;
-			}
-		};
-
 		if (!name?.trim()) return apiError("name is required", 400);
 		if (!furnidataUrl?.trim()) return apiError("furnidataUrl is required", 400);
 
 		const normalized = (u: string | undefined) =>
 			(u ?? "").trim().replace(/\/+$/, "");
 
-		if (!isHttps(furnidataUrl))
-			return apiError("furnidataUrl must be a valid https:// URL", 400);
+		for (const [label, rawUrl] of [
+			["furnidataUrl", furnidataUrl],
+			["nitroBaseUrl", nitroBaseUrl],
+			["iconBaseUrl", iconBaseUrl],
+			["sourceSwfBaseUrl", sourceSwfBaseUrl],
+		] as const) {
+			if (!rawUrl?.trim()) continue;
+			try {
+				await assertSafeImportUrl(rawUrl, label);
+			} catch (err) {
+				return apiError((err as Error).message, 400);
+			}
+		}
 
 		const entry = await upsertSource({
 			id,

src/components/admin/studio/studio-furni-icons.ts

@@ -8,11 +8,6 @@ export function getFurniImageUrl(item: FurniItem) {
 	return `/swf/dcr/hof_furni/icons/${encodeURIComponent(iconName)}_icon.png`;
 }
 
-export function getFurniIconUrl(classname: string, revision: number) {
-	const iconName = classname.replace(/\*/g, "_");
-	return `https://images.habbo.com/dcr/hof_furni/${revision}/${encodeURIComponent(iconName)}_icon.png`;
-}
-
 export function handleImgError(
 	e: SyntheticEvent<HTMLImageElement>,
 	item: FurniItem,

src/features/catalog/server/tree-nodes.ts

@@ -17,19 +17,6 @@ export function toInt(value: unknown, fallback = 0): number {
 	return Number.isFinite(n) ? n : fallback;
 }
 
-/** The nine columns every catalog tree read needs, in one shape. */
-const PAGE_COLUMNS = [
-	"id",
-	"parentId",
-	"caption",
-	"pageLayout",
-	"iconColor",
-	"iconImage",
-	"orderNum",
-	"visible",
-	"enabled",
-] as const;
-
 type PageRow = {
 	id: number | string;
 	parentId: number | string;
@@ -270,5 +257,3 @@ export async function readAncestors(kind: CatalogKind, id: number) {
 	}
 	return chain;
 }
-
-export const CATALOG_PAGE_COLUMNS = PAGE_COLUMNS;

src/lib/admin-operations-contract.test.ts

@@ -73,6 +73,7 @@ const ACTION_GATES: Array<[string, string]> = [
 	["admin-ads.ts", "PERMS.PAGES_EDIT"],
 	["admin-vouchers.ts", "PERMS.SHOP_EDIT"],
 	["admin-alerts.ts", "PERMS.NOTIFICATIONS_EDIT"],
+	["admin-antiddos.ts", "PERMS.SETTINGS_EDIT"],
 	["commandocentrum.ts", "PERMS.RCON_EXECUTE"],
 	["translations.ts", "PERMS.SETTINGS_EDIT"],
 	["tickets.ts", "PERMS.TICKETS_EDIT"],

src/lib/admin/is-staff.test.ts

@@ -1,14 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { isStaff } from "./is-staff";
-
-describe("isStaff", () => {
-	it("is true at or above the min staff rank", () => {
-		expect(isStaff(7, 7)).toBe(true);
-		expect(isStaff(10, 7)).toBe(true);
-	});
-
-	it("is false below the min staff rank", () => {
-		expect(isStaff(6, 7)).toBe(false);
-		expect(isStaff(1, 7)).toBe(false);
-	});
-});

src/lib/admin/is-staff.ts

@@ -1,4 +0,0 @@
-/** AtomCMS housekeeping gate: staff are users with rank >= min_staff_rank. */
-export function isStaff(rank: number, minStaffRank: number): boolean {
-	return rank >= minStaffRank;
-}

src/lib/admin/log-filters.test.ts

@@ -1,39 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { buildStaffActivityWhere } from "./log-filters";
-
-describe("buildStaffActivityWhere", () => {
-	it("returns an empty where when no filters are set", () => {
-		expect(buildStaffActivityWhere({})).toEqual({});
-	});
-
-	it("builds an OR search across action, description and IP", () => {
-		const where = buildStaffActivityWhere({ q: "ban " });
-		expect(where.OR).toEqual([
-			{ action: { contains: "ban" } },
-			{ description: { contains: "ban" } },
-			{ ipAddress: { contains: "ban" } },
-		]);
-		expect(where.OR?.[0]).toEqual({ action: { contains: "ban" } });
-	});
-
-	it("sets userId when staffId is provided", () => {
-		const where = buildStaffActivityWhere({ staffId: 42 });
-		expect(where.userId).toBe(BigInt(42));
-	});
-
-	it("uses a prefix match for authorization-only", () => {
-		expect(buildStaffActivityWhere({ authorizationOnly: true })).toEqual({
-			action: { startsWith: "permission." },
-		});
-	});
-
-	it("uses a contains match for a specific action", () => {
-		expect(buildStaffActivityWhere({ action: "ban" })).toEqual({
-			action: { contains: "ban" },
-		});
-	});
-
-	it("ignores whitespace-only search terms", () => {
-		expect(buildStaffActivityWhere({ q: "   " })).toEqual({});
-	});
-});

src/lib/admin/log-filters.ts

@@ -1,28 +0,0 @@
-export interface StaffActivityFilters {
-	q?: string;
-	staffId?: number | null;
-	action?: string | null;
-	authorizationOnly?: boolean;
-}
-
-interface StaffActivityWhere {
-	OR?: Array<Record<string, { contains?: string }>>;
-	userId?: bigint;
-	action?: { startsWith: string } | { contains: string };
-}
-
-export function buildStaffActivityWhere(
-	filters: StaffActivityFilters,
-): StaffActivityWhere {
-	const where: StaffActivityWhere = {};
-	if (filters.q?.trim())
-		where.OR = [
-			{ action: { contains: filters.q.trim() } },
-			{ description: { contains: filters.q.trim() } },
-			{ ipAddress: { contains: filters.q.trim() } },
-		];
-	if (filters.staffId) where.userId = BigInt(filters.staffId);
-	if (filters.authorizationOnly) where.action = { startsWith: "permission." };
-	else if (filters.action) where.action = { contains: filters.action };
-	return where;
-}

src/lib/admin/notice.test.ts

@@ -1,26 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { adminMutationNotice } from "./notice";
-
-describe("adminMutationNotice", () => {
-	it("returns a danger notice when there is an error", () => {
-		expect(adminMutationNotice({ error: "boom" })).toEqual({
-			tone: "danger",
-			label: "Error",
-			message: "The operation could not be completed.",
-		});
-	});
-	it("returns a success notice when saved is 1", () => {
-		expect(adminMutationNotice({ saved: "1" })).toEqual({
-			tone: "ok",
-			label: "Saved",
-			message: "Changes were saved successfully.",
-		});
-	});
-	it("returns null when nothing is set", () => {
-		expect(adminMutationNotice({})).toBeNull();
-	});
-	it("prioritises errors over saved flags", () => {
-		const notice = adminMutationNotice({ saved: "1", error: "x" });
-		expect(notice?.tone).toBe("danger");
-	});
-});

src/lib/admin/notice.ts

@@ -1,26 +0,0 @@
-export interface AdminMutationNotice {
-	tone: "ok" | "danger";
-	label: "Saved" | "Error";
-	message: string;
-}
-
-export function adminMutationNotice(params: {
-	saved?: string;
-	error?: string;
-}): AdminMutationNotice | null {
-	if (params.error) {
-		return {
-			tone: "danger",
-			label: "Error",
-			message: "The operation could not be completed.",
-		};
-	}
-	if (params.saved === "1") {
-		return {
-			tone: "ok",
-			label: "Saved",
-			message: "Changes were saved successfully.",
-		};
-	}
-	return null;
-}

src/lib/admin/rank-guard.test.ts

@@ -0,0 +1,82 @@
+// @ts-nocheck
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const state = vi.hoisted(() => ({
+	users: [] as Array<{ username: string; rank: number; mail: string | null }>,
+	highestRank: 8,
+}));
+
+vi.mock("@/lib/db", async () => {
+	const schema = await import("@/db/schema");
+	const { createFakeDb } = await import("@/test/fake-db");
+	const fake = createFakeDb((_table, projection) =>
+		"username" in projection ? state.users : [],
+	);
+	return { ...schema, db: fake };
+});
+
+vi.mock("@/lib/permissions", () => ({
+	getHighestRank: vi.fn(async () => state.highestRank),
+}));
+
+vi.mock("@/lib/safe-action-shared", () => ({
+	ActionError: class ActionError extends Error {},
+}));
+
+import { getHighestRank } from "@/lib/permissions";
+import { guardRank, tryGuardRank } from "./rank-guard";
+
+beforeEach(() => {
+	vi.clearAllMocks();
+	state.users = [{ username: "victim", rank: 5, mail: "[email protected]" }];
+	state.highestRank = 8;
+});
+
+describe("tryGuardRank", () => {
+	it("allows an actor at a strictly higher rank", async () => {
+		const result = await tryGuardRank(1, 7);
+		expect(result).toEqual({ ok: true, target: state.users[0] });
+	});
+
+	it("blocks an actor at the same rank", async () => {
+		state.users = [{ username: "victim", rank: 7, mail: null }];
+		const result = await tryGuardRank(1, 7);
+		expect(result).toEqual({ ok: false, reason: "rank" });
+	});
+
+	it("blocks an actor at a lower rank", async () => {
+		const result = await tryGuardRank(1, 3);
+		expect(result).toEqual({ ok: false, reason: "rank" });
+	});
+
+	it("lets the dynamic super admin act on anyone", async () => {
+		state.users = [{ username: "victim", rank: 8, mail: "[email protected]" }];
+		state.highestRank = 8;
+		const result = await tryGuardRank(1, 8);
+		expect(result).toEqual({
+			ok: true,
+			target: { username: "victim", rank: 8, mail: "[email protected]" },
+		});
+		expect(await getHighestRank()).toBe(8);
+	});
+
+	it("reports a missing target as not_found", async () => {
+		state.users = [];
+		const result = await tryGuardRank(999, 7);
+		expect(result).toEqual({ ok: false, reason: "not_found" });
+	});
+});
+
+describe("guardRank", () => {
+	it("throws a readable ActionError for a target at equal or higher rank", async () => {
+		state.users = [{ username: "victim", rank: 7, mail: null }];
+		await expect(guardRank(1, 7)).rejects.toThrow(
+			"Cannot modify user with equal or higher rank",
+		);
+	});
+
+	it("throws a readable ActionError for a missing target", async () => {
+		state.users = [];
+		await expect(guardRank(999, 7)).rejects.toThrow("User not found");
+	});
+});

src/lib/admin/rank-guard.ts

@@ -0,0 +1,65 @@
+import { eq } from "drizzle-orm";
+import { isDynamicSuperAdmin } from "@/lib/admin/authorization-policy";
+import { db, User } from "@/lib/db";
+import { getHighestRank } from "@/lib/permissions";
+import { ActionError } from "@/lib/safe-action-shared";
+
+export interface RankGuardTarget {
+	username: string;
+	rank: number;
+	mail: string | null;
+}
+
+export type RankGuardResult =
+	| { ok: true; target: RankGuardTarget }
+	| { ok: false; reason: "not_found" | "rank" };
+
+/**
+ * Refuse to act on a target whose rank is equal to or higher than the actor's,
+ * unless the actor is the dynamic super admin (the account holding the hotel's
+ * current highest rank). This is the single source of truth for the
+ * "cannot modify equal/higher rank" invariant; every admin action that mutates
+ * a specific user must go through it.
+ *
+ * Returns a discriminated result instead of throwing so callers can choose
+ * between "block the request" and "tolerate a deleted user" (e.g. lifting a
+ * ban for an account that no longer exists).
+ */
+export async function tryGuardRank(
+	targetUserId: number,
+	sessionRank: number,
+): Promise<RankGuardResult> {
+	const [target] = await db
+		.select({
+			username: User.username,
+			rank: User.rank,
+			mail: User.mail,
+		})
+		.from(User)
+		.where(eq(User.id, targetUserId))
+		.limit(1);
+	if (!target) return { ok: false, reason: "not_found" };
+	const highestRank = await getHighestRank();
+	if (
+		target.rank >= sessionRank &&
+		!isDynamicSuperAdmin(sessionRank, highestRank)
+	) {
+		return { ok: false, reason: "rank" };
+	}
+	return { ok: true, target };
+}
+
+export async function guardRank(
+	targetUserId: number,
+	sessionRank: number,
+): Promise<RankGuardTarget> {
+	const result = await tryGuardRank(targetUserId, sessionRank);
+	if (!result.ok) {
+		throw new ActionError(
+			result.reason === "not_found"
+				? "User not found"
+				: "Cannot modify user with equal or higher rank",
+		);
+	}
+	return result.target;
+}

src/lib/admin/recent-furni-resync.test.ts

@@ -1,70 +0,0 @@
-import { describe, expect, it, vi } from "vitest";
-import {
-	RECENT_FURNI_RESYNC_URL,
-	requestRecentFurniResync,
-} from "./recent-furni-resync";
-
-describe("requestRecentFurniResync", () => {
-	it("POSTs to the resync endpoint and maps the payload", async () => {
-		const fetcher = vi.fn().mockResolvedValue({
-			ok: true,
-			json: async () => ({
-				examined: 10,
-				resynced: 4,
-				failed: 1,
-				rconOk: true,
-				errors: [{ classname: "sofa", message: "boom" }],
-			}),
-		});
-		const result = await requestRecentFurniResync(fetcher);
-		expect(fetcher).toHaveBeenCalledWith(RECENT_FURNI_RESYNC_URL, {
-			method: "POST",
-		});
-		expect(result).toEqual({
-			examined: 10,
-			resynced: 4,
-			failed: 1,
-			rconOk: true,
-			errors: [{ classname: "sofa", message: "boom" }],
-		});
-	});
-
-	it("throws with the server error message on failure", async () => {
-		const fetcher = vi.fn().mockResolvedValue({
-			ok: false,
-			json: async () => ({ error: "no permission" }),
-		});
-		await expect(requestRecentFurniResync(fetcher)).rejects.toThrow(
-			"no permission",
-		);
-	});
-
-	it("falls back to a generic error message", async () => {
-		const fetcher = vi.fn().mockResolvedValue({
-			ok: false,
-			json: async () => ({}),
-		});
-		await expect(requestRecentFurniResync(fetcher)).rejects.toThrow(
-			"Furni resync failed",
-		);
-	});
-
-	it("filters malformed error entries and coerces counts", async () => {
-		const fetcher = vi.fn().mockResolvedValue({
-			ok: true,
-			json: async () => ({
-				examined: "10",
-				resynced: undefined,
-				failed: null,
-				rconOk: "yes",
-				errors: [{ classname: "a", message: "b" }, { nope: 1 }, "x"],
-			}),
-		});
-		const result = await requestRecentFurniResync(fetcher);
-		expect(result.examined).toBe(10);
-		expect(result.resynced).toBe(0);
-		expect(result.failed).toBe(0);
-		expect(result.rconOk).toBe(false);
-		expect(result.errors).toEqual([{ classname: "a", message: "b" }]);
-	});
-});

src/lib/admin/recent-furni-resync.ts

@@ -1,49 +0,0 @@
-export const RECENT_FURNI_RESYNC_URL = "/api/admin/import/furni/resync?days=7";
-
-export interface RecentFurniResyncError {
-	classname: string;
-	message: string;
-}
-
-export interface RecentFurniResyncResult {
-	examined: number;
-	resynced: number;
-	failed: number;
-	rconOk: boolean;
-	errors: RecentFurniResyncError[];
-}
-
-type AdminFetcher = (
-	input: RequestInfo | URL,
-	init?: RequestInit,
-) => Promise<Response>;
-
-export async function requestRecentFurniResync(
-	fetcher: AdminFetcher,
-): Promise<RecentFurniResyncResult> {
-	const response = await fetcher(RECENT_FURNI_RESYNC_URL, { method: "POST" });
-	const payload = (await response.json()) as Record<string, unknown>;
-	if (!response.ok) {
-		throw new Error(
-			typeof payload.error === "string" ? payload.error : "Furni resync failed",
-		);
-	}
-
-	const errors = Array.isArray(payload.errors)
-		? payload.errors.filter(
-				(value): value is RecentFurniResyncError =>
-					typeof value === "object" &&
-					value !== null &&
-					typeof (value as RecentFurniResyncError).classname === "string" &&
-					typeof (value as RecentFurniResyncError).message === "string",
-			)
-		: [];
-
-	return {
-		examined: Number(payload.examined) || 0,
-		resynced: Number(payload.resynced) || 0,
-		failed: Number(payload.failed) || 0,
-		rconOk: payload.rconOk === true,
-		errors,
-	};
-}

src/lib/import-url-safety.ts

@@ -0,0 +1,82 @@
+import { lookup } from "node:dns/promises";
+
+function isPrivateIpv4(hex: string): boolean {
+	const parts = hex.split(".").map((p) => Number(p));
+	if (parts.length !== 4 || parts.some((p) => Number.isNaN(p))) return true;
+	const [a, b] = parts;
+	if (a === 0 || a === 10) return true;
+	if (a === 127 || a === 255) return true;
+	if (a === 169 && b === 254) return true;
+	if (a === 172 && b >= 16 && b <= 31) return true;
+	if (a === 192 && b === 168) return true;
+	if (a === 100 && b >= 64 && b <= 127) return true;
+	if (a === 192 && b === 0 && parts[2] === 0 && parts[3] === 0) return true;
+	return false;
+}
+
+function isPrivateIpv6(addr: string): boolean {
+	const lower = addr.toLowerCase();
+	if (lower.startsWith("::") || lower === "::1") return true;
+	if (/^fe[89ab]/.test(lower) || /^fc|^fd/.test(lower)) return true;
+	if (lower.includes(":") && lower.split(":").length === 4) return false;
+	if (/^2001:0?db8/.test(lower)) return true;
+	return lower === "::" || lower.endsWith(":ffff:");
+}
+
+function isPrivateIp(ip: string): boolean {
+	return ip.includes(":") ? isPrivateIpv6(ip) : isPrivateIpv4(ip);
+}
+
+const BLOCKED_HOST_LABELS =
+	/^(localhost|.*\.local|.*\.localhost|.*\.internal|.*\.localdomain|.*\.lan)$/i;
+
+/**
+ * Guard a remote asset URL before it is stored or fetched. Rejects anything
+ * that could reach the host itself: non-https, embedded credentials, private
+ * IP literals, loopback/local-only hostnames and any host that resolves to a
+ * private or loopback address. Throws TypeError with a human message so admin
+ * routes can surface it as a 400.
+ */
+export async function assertSafeImportUrl(
+	url: string,
+	label: string,
+): Promise<void> {
+	const trimmed = url.trim();
+	if (!trimmed) return;
+	let parsed: URL;
+	try {
+		parsed = new URL(trimmed);
+	} catch {
+		throw new TypeError(`${label} is not a valid URL`);
+	}
+	if (parsed.protocol !== "https:") {
+		throw new TypeError(`${label} must be an https:// URL`);
+	}
+	if (parsed.username || parsed.password) {
+		throw new TypeError(`${label} must not embed credentials`);
+	}
+	const hostname = parsed.hostname.replace(/^\[|\]$/g, "");
+	if (BLOCKED_HOST_LABELS.test(hostname)) {
+		throw new TypeError(`${label} points at a local host`);
+	}
+	if (hostname) {
+		const looksLiteral =
+			hostname.includes(":") || /^\d{1,3}(\.\d{1,3}){3}$/.test(hostname);
+		if (looksLiteral) {
+			if (isPrivateIp(hostname.toLowerCase())) {
+				throw new TypeError(`${label} points at a private address`);
+			}
+			return;
+		}
+		let addresses: string[];
+		try {
+			const result = await lookup(hostname, { all: true, verbatim: true });
+			addresses = result.map((r) => r.address);
+		} catch {
+			throw new TypeError(`${label} does not resolve to a public host`);
+		}
+		if (addresses.some((ip) => isPrivateIp(ip.toLowerCase()))) {
+			throw new TypeError(`${label} resolves to a private address`);
+		}
+	}
+}

src/lib/services/admin-stats.ts

@@ -4,23 +4,27 @@ import { db } from "@/lib/db";
 import { redisCache } from "@/lib/redis-cache";
 
 /**
- * Caches admin list totals when no filters are applied (no 'where' clause),
- * preventing heavy COUNT(*) table scans on every request for large tables.
- * Filtered queries bypass cache to ensure exact search result counts.
+ * Caches admin list totals, preventing heavy COUNT(*) table scans on every
+ * request for large tables.
+ *
+ * By default only the unfiltered (global) count is cached; filtered queries
+ * hit the DB so search result counts stay exact. Callers that read a stable,
+ * fixed-filter total (e.g. "open tickets") can opt into caching it too with
+ * `{ cacheFiltered: true }` and a cacheKey unique to that filter.
  */
 export async function getCachedAdminCount(
 	table: MySqlTable,
 	cacheKey: string,
 	where?: SQL | undefined,
+	options?: { cacheFiltered?: boolean },
 ): Promise<number> {
-	// Only cache the global count (where = undefined)
-	if (where) {
+	const run = async (): Promise<number> => {
 		const [row] = await db.select({ total: count() }).from(table).where(where);
 		return Number(row?.total ?? 0);
-	}
+	};
 
-	return await redisCache(`admin:count:${cacheKey}`, 60, async () => {
-		const [row] = await db.select({ total: count() }).from(table);
-		return Number(row?.total ?? 0);
-	});
+	if (!where || options?.cacheFiltered) {
+		return await redisCache(`admin:count:${cacheKey}`, 60, run);
+	}
+	return await run();
 }

src/lib/services/catalog-items-loader.ts

@@ -127,13 +127,16 @@ export async function loadCatalogItemsData(
 	pageId: number,
 	catalog: "normal" | "bc" = "normal",
 ): Promise<CatalogItemsData> {
-	// Load items via raw query to work around pageId Int vs VARCHAR mismatch
+	// Load items via raw query to work around pageId Int vs VARCHAR mismatch.
+	// Bind the id as a *string* constant: MySQL/MariaDB coerce a constant to the
+	// column's type once, so `page_id = ?` stays sargable whether the live column
+	// is INT or VARCHAR. Casting the column (CAST(page_id AS CHAR)) would wrap it
+	// in a function and force a full table scan.
 	const pageIdStr = String(pageId);
-	// CAST: live Habbo DBs often store page_id as VARCHAR while schema maps Int.
 	const offers = catalog === "bc" ? "catalog_items_bc" : "catalog_items";
 	const rawItems = await queryRows<Record<string, unknown>>(sql`
     SELECT * FROM ${sql.raw(offers)}
-    WHERE CAST(page_id AS CHAR) = ${pageIdStr}
+    WHERE page_id = ${pageIdStr}
     ORDER BY order_number ASC, id ASC
   `);
 	// The BC table carries only a reference to the furniture: there are no price,

src/lib/services/clone-bulk-import-live.test.ts

@@ -14,7 +14,7 @@ const log = (msg: string) => appendFileSync(LOG, `${msg}\n`);
 const IMPORT_IDS = ["default-sodastudios", "default-hubbly"];
 
 describe("clone bulk import", {
-	skip: process.env.RUN_CLONE_BULK_LIVE !== "1",
+	skip: !runLive,
 }, () => {
 	beforeAll(async () => {
 		loadEnvForLiveTests();

src/lib/services/clone-feasibility-live.test.ts

@@ -11,7 +11,7 @@ const LOG = "/tmp/clone-feasibility.log";
 const log = (msg: string) => appendFileSync(LOG, `${msg}\n`);
 
 describe("clone feasibility", {
-	skip: process.env.RUN_CLONE_FEASIBILITY_LIVE !== "1",
+	skip: !runLive,
 }, () => {
 	beforeAll(async () => {
 		loadEnvForLiveTests();

src/messages/ar.json

@@ -1915,7 +1915,8 @@
 				"reasonPlaceholder": "Reason for the ban",
 				"ban": "Ban user",
 				"colUserId": "User ID",
-				"lift": "Lift ban"
+				"lift": "Lift ban",
+				"rankError": "You cannot act on a user with an equal or higher rank."
 			},
 			"ip": {
 				"title": "IP Management",
@@ -3771,7 +3772,8 @@
 					"border2pxsolidred": "border: 2px solid red;",
 					"CustomHTML": "Custom HTML",
 					"AddcustomHTMLthatinjectsintothepageforthisscopeUseforcustombannersscriptsorcontentblocks": "Add custom HTML that injects into the page for this scope. Use for custom banners, scripts, or content blocks."
-				}
+				},
+				"saveError": "The theme change could not be saved."
 			},
 			"media": {
 				"title": "Media Library",

src/messages/bg.json

@@ -1633,7 +1633,8 @@
 				"reasonPlaceholder": "Reason for the ban",
 				"ban": "Ban user",
 				"colUserId": "User ID",
-				"lift": "Lift ban"
+				"lift": "Lift ban",
+				"rankError": "You cannot act on a user with an equal or higher rank."
 			},
 			"ip": {
 				"title": "IP управление",
@@ -3848,7 +3849,8 @@
 					"border2pxsolidred": "border: 2px solid red;",
 					"CustomHTML": "Custom HTML",
 					"AddcustomHTMLthatinjectsintothepageforthisscopeUseforcustombannersscriptsorcontentblocks": "Add custom HTML that injects into the page for this scope. Use for custom banners, scripts, or content blocks."
-				}
+				},
+				"saveError": "The theme change could not be saved."
 			},
 			"media": {
 				"title": "Медийна библиотека",

src/messages/cs.json

@@ -1633,7 +1633,8 @@
 				"reasonPlaceholder": "Reason for the ban",
 				"ban": "Ban user",
 				"colUserId": "User ID",
-				"lift": "Lift ban"
+				"lift": "Lift ban",
+				"rankError": "You cannot act on a user with an equal or higher rank."
 			},
 			"ip": {
 				"title": "Správa IP",
@@ -3848,7 +3849,8 @@
 					"border2pxsolidred": "border: 2px solid red;",
 					"CustomHTML": "Custom HTML",
 					"AddcustomHTMLthatinjectsintothepageforthisscopeUseforcustombannersscriptsorcontentblocks": "Add custom HTML that injects into the page for this scope. Use for custom banners, scripts, or content blocks."
-				}
+				},
+				"saveError": "The theme change could not be saved."
 			},
 			"media": {
 				"title": "Knihovna médií",

src/messages/da.json

@@ -1633,7 +1633,8 @@
 				"reasonPlaceholder": "Reason for the ban",
 				"ban": "Ban user",
 				"colUserId": "User ID",
-				"lift": "Lift ban"
+				"lift": "Lift ban",
+				"rankError": "Du kan ikke udføre handling på en bruger med samme eller højere rang."
 			},
 			"ip": {
 				"title": "IP Management",
@@ -3848,7 +3849,8 @@
 					"border2pxsolidred": "border: 2px solid red;",
 					"CustomHTML": "Custom HTML",
 					"AddcustomHTMLthatinjectsintothepageforthisscopeUseforcustombannersscriptsorcontentblocks": "Add custom HTML that injects into the page for this scope. Use for custom banners, scripts, or content blocks."
-				}
+				},
+				"saveError": "Temaændringen kunne ikke gemmes."
 			},
 			"media": {
 				"title": "Mediebibliotek",

src/messages/de.json

@@ -1603,7 +1603,8 @@
 				"reasonPlaceholder": "Reason for the ban",
 				"ban": "Ban user",
 				"colUserId": "User ID",
-				"lift": "Lift ban"
+				"lift": "Lift ban",
+				"rankError": "Sie können keine Aktion an einem Benutzer mit gleichem oder höherem Rang ausführen."
 			},
 			"ip": {
 				"title": "IP-Verwaltung",
@@ -3818,7 +3819,8 @@
 					"border2pxsolidred": "border: 2px solid red;",
 					"CustomHTML": "Custom HTML",
 					"AddcustomHTMLthatinjectsintothepageforthisscopeUseforcustombannersscriptsorcontentblocks": "Add custom HTML that injects into the page for this scope. Use for custom banners, scripts, or content blocks."
-				}
+				},
+				"saveError": "Die Design-Änderung konnte nicht gespeichert werden."
 			},
 			"media": {
 				"title": "Medienbibliothek",

src/messages/el.json

@@ -1633,7 +1633,8 @@
 				"reasonPlaceholder": "Reason for the ban",
 				"ban": "Ban user",
 				"colUserId": "User ID",
-				"lift": "Lift ban"
+				"lift": "Lift ban",
+				"rankError": "You cannot act on a user with an equal or higher rank."
 			},
 			"ip": {
 				"title": "Διαχείριση IP",
@@ -3848,7 +3849,8 @@
 					"border2pxsolidred": "border: 2px solid red;",
 					"CustomHTML": "Custom HTML",
 					"AddcustomHTMLthatinjectsintothepageforthisscopeUseforcustombannersscriptsorcontentblocks": "Add custom HTML that injects into the page for this scope. Use for custom banners, scripts, or content blocks."
-				}
+				},
+				"saveError": "The theme change could not be saved."
 			},
 			"media": {
 				"title": "Βιβλιοθήκη πολυμέσων",

src/messages/en.json

@@ -1982,7 +1982,8 @@
 				"reasonPlaceholder": "Reason for the ban",
 				"ban": "Ban user",
 				"colUserId": "User ID",
-				"lift": "Lift ban"
+				"lift": "Lift ban",
+				"rankError": "You cannot act on a user with an equal or higher rank."
 			},
 			"ip": {
 				"title": "IP Management",
@@ -4620,7 +4621,8 @@
 					"border2pxsolidred": "border: 2px solid red;",
 					"CustomHTML": "Custom HTML",
 					"AddcustomHTMLthatinjectsintothepageforthisscopeUseforcustombannersscriptsorcontentblocks": "Add custom HTML that injects into the page for this scope. Use for custom banners, scripts, or content blocks."
-				}
+				},
+				"saveError": "The theme change could not be saved."
 			},
 			"media": {
 				"title": "Media Library",

src/messages/es.json

@@ -1603,7 +1603,8 @@
 				"reasonPlaceholder": "Reason for the ban",
 				"ban": "Ban user",
 				"colUserId": "User ID",
-				"lift": "Lift ban"
+				"lift": "Lift ban",
+				"rankError": "No puedes actuar sobre un usuario con un rango igual o superior."
 			},
 			"ip": {
 				"title": "Gestión de IP",
@@ -3818,7 +3819,8 @@
 					"border2pxsolidred": "border: 2px solid red;",
 					"CustomHTML": "Custom HTML",
 					"AddcustomHTMLthatinjectsintothepageforthisscopeUseforcustombannersscriptsorcontentblocks": "Add custom HTML that injects into the page for this scope. Use for custom banners, scripts, or content blocks."
-				}
+				},
+				"saveError": "No se pudo guardar el cambio de tema."
 			},
 			"media": {
 				"title": "Biblioteca multimedia",

src/messages/fi.json

@@ -1915,7 +1915,8 @@
 				"reasonPlaceholder": "Reason for the ban",
 				"ban": "Ban user",
 				"colUserId": "User ID",
-				"lift": "Lift ban"
+				"lift": "Lift ban",
+				"rankError": "You cannot act on a user with an equal or higher rank."
 			},
 			"ip": {
 				"title": "IP Management",
@@ -3771,7 +3772,8 @@
 					"border2pxsolidred": "border: 2px solid red;",
 					"CustomHTML": "Custom HTML",
 					"AddcustomHTMLthatinjectsintothepageforthisscopeUseforcustombannersscriptsorcontentblocks": "Add custom HTML that injects into the page for this scope. Use for custom banners, scripts, or content blocks."
-				}
+				},
+				"saveError": "The theme change could not be saved."
 			},
 			"media": {
 				"title": "Media Library",

src/messages/fr.json

@@ -1603,7 +1603,8 @@
 				"reasonPlaceholder": "Reason for the ban",
 				"ban": "Ban user",
 				"colUserId": "User ID",
-				"lift": "Lift ban"
+				"lift": "Lift ban",
+				"rankError": "Vous ne pouvez pas agir sur un utilisateur ayant un rang égal ou supérieur."
 			},
 			"ip": {
 				"title": "Gestion IP",
@@ -3818,7 +3819,8 @@
 					"border2pxsolidred": "border: 2px solid red;",
 					"CustomHTML": "Custom HTML",
 					"AddcustomHTMLthatinjectsintothepageforthisscopeUseforcustombannersscriptsorcontentblocks": "Add custom HTML that injects into the page for this scope. Use for custom banners, scripts, or content blocks."
-				}
+				},
+				"saveError": "La modification du thème n’a pas pu être enregistrée."
 			},
 			"media": {
 				"title": "Médiathèque",

src/messages/hr.json

@@ -1633,7 +1633,8 @@
 				"reasonPlaceholder": "Reason for the ban",
 				"ban": "Ban user",
 				"colUserId": "User ID",
-				"lift": "Lift ban"
+				"lift": "Lift ban",
+				"rankError": "You cannot act on a user with an equal or higher rank."
 			},
 			"ip": {
 				"title": "IP upravljanje",
@@ -3848,7 +3849,8 @@
 					"border2pxsolidred": "border: 2px solid red;",
 					"CustomHTML": "Custom HTML",
 					"AddcustomHTMLthatinjectsintothepageforthisscopeUseforcustombannersscriptsorcontentblocks": "Add custom HTML that injects into the page for this scope. Use for custom banners, scripts, or content blocks."
-				}
+				},
+				"saveError": "The theme change could not be saved."
 			},
 			"media": {
 				"title": "Mediateka",

src/messages/hu.json

@@ -1633,7 +1633,8 @@
 				"reasonPlaceholder": "Reason for the ban",
 				"ban": "Ban user",
 				"colUserId": "User ID",
-				"lift": "Lift ban"
+				"lift": "Lift ban",
+				"rankError": "You cannot act on a user with an equal or higher rank."
 			},
 			"ip": {
 				"title": "IP-kezelés",
@@ -3848,7 +3849,8 @@
 					"border2pxsolidred": "border: 2px solid red;",
 					"CustomHTML": "Custom HTML",
 					"AddcustomHTMLthatinjectsintothepageforthisscopeUseforcustombannersscriptsorcontentblocks": "Add custom HTML that injects into the page for this scope. Use for custom banners, scripts, or content blocks."
-				}
+				},
+				"saveError": "The theme change could not be saved."
 			},
 			"media": {
 				"title": "Médiatár",

src/messages/it.json

@@ -1951,7 +1951,8 @@
 				"reasonPlaceholder": "Motivo del ban",
 				"ban": "Banna utente",
 				"colUserId": "ID utente",
-				"lift": "Revoca ban"
+				"lift": "Revoca ban",
+				"rankError": "Non puoi agire su un utente con un rango pari o superiore."
 			},
 			"ip": {
 				"title": "Gestione IP",
@@ -4346,7 +4347,8 @@
 					"border2pxsolidred": "border: 2px solid red;",
 					"CustomHTML": "Custom HTML",
 					"AddcustomHTMLthatinjectsintothepageforthisscopeUseforcustombannersscriptsorcontentblocks": "Add custom HTML that injects into the page for this scope. Use for custom banners, scripts, or content blocks."
-				}
+				},
+				"saveError": "Non è stato possibile salvare la modifica del tema."
 			},
 			"media": {
 				"title": "Libreria media",

src/messages/ja.json

@@ -1915,7 +1915,8 @@
 				"reasonPlaceholder": "Reason for the ban",
 				"ban": "Ban user",
 				"colUserId": "User ID",
-				"lift": "Lift ban"
+				"lift": "Lift ban",
+				"rankError": "You cannot act on a user with an equal or higher rank."
 			},
 			"ip": {
 				"title": "IP Management",
@@ -3771,7 +3772,8 @@
 					"border2pxsolidred": "border: 2px solid red;",
 					"CustomHTML": "Custom HTML",
 					"AddcustomHTMLthatinjectsintothepageforthisscopeUseforcustombannersscriptsorcontentblocks": "Add custom HTML that injects into the page for this scope. Use for custom banners, scripts, or content blocks."
-				}
+				},
+				"saveError": "The theme change could not be saved."
 			},
 			"media": {
 				"title": "Media Library",

src/messages/nl.json

@@ -1982,7 +1982,8 @@
 				"reasonPlaceholder": "Reason for the ban",
 				"ban": "Ban user",
 				"colUserId": "User ID",
-				"lift": "Lift ban"
+				"lift": "Lift ban",
+				"rankError": "U kunt geen actie uitvoeren op een gebruiker met een gelijke of hogere rang."
 			},
 			"ip": {
 				"title": "IP-beheer",
@@ -4349,7 +4350,8 @@
 					"border2pxsolidred": "border: 2px solid red;",
 					"CustomHTML": "Custom HTML",
 					"AddcustomHTMLthatinjectsintothepageforthisscopeUseforcustombannersscriptsorcontentblocks": "Add custom HTML that injects into the page for this scope. Use for custom banners, scripts, or content blocks."
-				}
+				},
+				"saveError": "De themawijziging kon niet worden opgeslagen."
 			},
 			"media": {
 				"title": "Mediabibliotheek",

src/messages/no.json

@@ -1633,7 +1633,8 @@
 				"reasonPlaceholder": "Reason for the ban",
 				"ban": "Ban user",
 				"colUserId": "User ID",
-				"lift": "Lift ban"
+				"lift": "Lift ban",
+				"rankError": "You cannot act on a user with an equal or higher rank."
 			},
 			"ip": {
 				"title": "IP-administrasjon",
@@ -3848,7 +3849,8 @@
 					"border2pxsolidred": "border: 2px solid red;",
 					"CustomHTML": "Custom HTML",
 					"AddcustomHTMLthatinjectsintothepageforthisscopeUseforcustombannersscriptsorcontentblocks": "Add custom HTML that injects into the page for this scope. Use for custom banners, scripts, or content blocks."
-				}
+				},
+				"saveError": "The theme change could not be saved."
 			},
 			"media": {
 				"title": "Mediebibliotek",

src/messages/pl.json

@@ -1633,7 +1633,8 @@
 				"reasonPlaceholder": "Reason for the ban",
 				"ban": "Ban user",
 				"colUserId": "User ID",
-				"lift": "Lift ban"
+				"lift": "Lift ban",
+				"rankError": "Nie możesz działać na użytkownika z rangą równą lub wyższą."
 			},
 			"ip": {
 				"title": "Zarządzanie IP",
@@ -3848,7 +3849,8 @@
 					"border2pxsolidred": "border: 2px solid red;",
 					"CustomHTML": "Custom HTML",
 					"AddcustomHTMLthatinjectsintothepageforthisscopeUseforcustombannersscriptsorcontentblocks": "Add custom HTML that injects into the page for this scope. Use for custom banners, scripts, or content blocks."
-				}
+				},
+				"saveError": "Nie udało się zapisać zmiany motywu."
 			},
 			"media": {
 				"title": "Biblioteka multimediów",

src/messages/pt.json

@@ -1633,7 +1633,8 @@
 				"reasonPlaceholder": "Reason for the ban",
 				"ban": "Ban user",
 				"colUserId": "User ID",
-				"lift": "Lift ban"
+				"lift": "Lift ban",
+				"rankError": "Não pode agir sobre um utilizador com um posto igual ou superior."
 			},
 			"ip": {
 				"title": "Gerenciamento de IP",
@@ -3848,7 +3849,8 @@
 					"border2pxsolidred": "border: 2px solid red;",
 					"CustomHTML": "Custom HTML",
 					"AddcustomHTMLthatinjectsintothepageforthisscopeUseforcustombannersscriptsorcontentblocks": "Add custom HTML that injects into the page for this scope. Use for custom banners, scripts, or content blocks."
-				}
+				},
+				"saveError": "Não foi possível guardar a alteração do tema."
 			},
 			"media": {
 				"title": "Biblioteca de mídia",

src/messages/ro.json

@@ -1633,7 +1633,8 @@
 				"reasonPlaceholder": "Reason for the ban",
 				"ban": "Ban user",
 				"colUserId": "User ID",
-				"lift": "Lift ban"
+				"lift": "Lift ban",
+				"rankError": "Nu poți acționa asupra unui utilizator cu un rang egal sau superior."
 			},
 			"ip": {
 				"title": "Managementul IP",
@@ -3848,7 +3849,8 @@
 					"border2pxsolidred": "border: 2px solid red;",
 					"CustomHTML": "Custom HTML",
 					"AddcustomHTMLthatinjectsintothepageforthisscopeUseforcustombannersscriptsorcontentblocks": "Add custom HTML that injects into the page for this scope. Use for custom banners, scripts, or content blocks."
-				}
+				},
+				"saveError": "Modificarea temei nu a putut fi salvată."
 			},
 			"media": {
 				"title": "Biblioteca media",

src/messages/ru.json

@@ -1631,7 +1631,8 @@
 				"reasonPlaceholder": "Reason for the ban",
 				"ban": "Ban user",
 				"colUserId": "User ID",
-				"lift": "Lift ban"
+				"lift": "Lift ban",
+				"rankError": "Нельзя действовать на пользователя с рангом равным или выше вашего."
 			},
 			"ip": {
 				"title": "IP Management",
@@ -3846,7 +3847,8 @@
 					"border2pxsolidred": "border: 2px solid red;",
 					"CustomHTML": "Custom HTML",
 					"AddcustomHTMLthatinjectsintothepageforthisscopeUseforcustombannersscriptsorcontentblocks": "Add custom HTML that injects into the page for this scope. Use for custom banners, scripts, or content blocks."
-				}
+				},
+				"saveError": "Не удалось сохранить изменение темы."
 			},
 			"media": {
 				"title": "Media Library",

src/messages/sk.json

@@ -1633,7 +1633,8 @@
 				"reasonPlaceholder": "Reason for the ban",
 				"ban": "Ban user",
 				"colUserId": "User ID",
-				"lift": "Lift ban"
+				"lift": "Lift ban",
+				"rankError": "You cannot act on a user with an equal or higher rank."
 			},
 			"ip": {
 				"title": "Správa IP",
@@ -3848,7 +3849,8 @@
 					"border2pxsolidred": "border: 2px solid red;",
 					"CustomHTML": "Custom HTML",
 					"AddcustomHTMLthatinjectsintothepageforthisscopeUseforcustombannersscriptsorcontentblocks": "Add custom HTML that injects into the page for this scope. Use for custom banners, scripts, or content blocks."
-				}
+				},
+				"saveError": "The theme change could not be saved."
 			},
 			"media": {
 				"title": "Knižnica médií",

src/messages/sr.json

@@ -1633,7 +1633,8 @@
 				"reasonPlaceholder": "Reason for the ban",
 				"ban": "Ban user",
 				"colUserId": "User ID",
-				"lift": "Lift ban"
+				"lift": "Lift ban",
+				"rankError": "You cannot act on a user with an equal or higher rank."
 			},
 			"ip": {
 				"title": "ИП менаџмент",
@@ -3848,7 +3849,8 @@
 					"border2pxsolidred": "border: 2px solid red;",
 					"CustomHTML": "Custom HTML",
 					"AddcustomHTMLthatinjectsintothepageforthisscopeUseforcustombannersscriptsorcontentblocks": "Add custom HTML that injects into the page for this scope. Use for custom banners, scripts, or content blocks."
-				}
+				},
+				"saveError": "The theme change could not be saved."
 			},
 			"media": {
 				"title": "Медиа Либрари",

src/messages/sv.json

@@ -1633,7 +1633,8 @@
 				"reasonPlaceholder": "Reason for the ban",
 				"ban": "Ban user",
 				"colUserId": "User ID",
-				"lift": "Lift ban"
+				"lift": "Lift ban",
+				"rankError": "You cannot act on a user with an equal or higher rank."
 			},
 			"ip": {
 				"title": "IP-hantering",
@@ -3848,7 +3849,8 @@
 					"border2pxsolidred": "border: 2px solid red;",
 					"CustomHTML": "Custom HTML",
 					"AddcustomHTMLthatinjectsintothepageforthisscopeUseforcustombannersscriptsorcontentblocks": "Add custom HTML that injects into the page for this scope. Use for custom banners, scripts, or content blocks."
-				}
+				},
+				"saveError": "The theme change could not be saved."
 			},
 			"media": {
 				"title": "Mediebibliotek",

src/messages/tr.json

@@ -1633,7 +1633,8 @@
 				"reasonPlaceholder": "Reason for the ban",
 				"ban": "Ban user",
 				"colUserId": "User ID",
-				"lift": "Lift ban"
+				"lift": "Lift ban",
+				"rankError": "You cannot act on a user with an equal or higher rank."
 			},
 			"ip": {
 				"title": "IP Yönetimi",
@@ -3848,7 +3849,8 @@
 					"border2pxsolidred": "border: 2px solid red;",
 					"CustomHTML": "Custom HTML",
 					"AddcustomHTMLthatinjectsintothepageforthisscopeUseforcustombannersscriptsorcontentblocks": "Add custom HTML that injects into the page for this scope. Use for custom banners, scripts, or content blocks."
-				}
+				},
+				"saveError": "The theme change could not be saved."
 			},
 			"media": {
 				"title": "Medya Kitaplığı",

src/messages/uk.json

@@ -1633,7 +1633,8 @@
 				"reasonPlaceholder": "Reason for the ban",
 				"ban": "Ban user",
 				"colUserId": "User ID",
-				"lift": "Lift ban"
+				"lift": "Lift ban",
+				"rankError": "You cannot act on a user with an equal or higher rank."
 			},
 			"ip": {
 				"title": "Управління IP",
@@ -3848,7 +3849,8 @@
 					"border2pxsolidred": "border: 2px solid red;",
 					"CustomHTML": "Custom HTML",
 					"AddcustomHTMLthatinjectsintothepageforthisscopeUseforcustombannersscriptsorcontentblocks": "Add custom HTML that injects into the page for this scope. Use for custom banners, scripts, or content blocks."
-				}
+				},
+				"saveError": "The theme change could not be saved."
 			},
 			"media": {
 				"title": "Медіатека",