fix: harden admin actions, search, sanitization and repo hygiene

- Split approve/dismiss application workflows with distinct audit logs,
  rate-limited guards and real error logging
- Validate article status/date/id input and stop resetting publishedAt
  on every update
- Validate guild updates (state, forum enums, non-empty name) behind
  rate-limited guard
- Fix scheduled-article publishing (ignore NULL dates, set updatedAt,
  type-safe predicates)
- Harden admin search API (LIKE escaping, query cap, per-user
  rate limit, round-robin result cap) and fix search dialog
  abort/res.ok/loading races
- Lock down HTML sanitizer to an allowlist profile and add XSS tests
- Improve mobile nav accessibility (unique id, dialog role, focus
  management, scroll lock, outside close)
- Log swallowed server errors instead of silent catch blocks
- Remove dead eslint config, drop unused dompurify deps, restore knip
  CI step, add Playwright config with smoke spec

src/actions/admin-articles.ts

@@ -10,10 +10,28 @@ import {
 	WebsiteArticleReactions,
 	WebsiteArticles,
 } from "@/lib/db";
+import { formPositiveBigInt } from "@/lib/form-data";
 import { slugify } from "@/lib/format";
 import { PERMS } from "@/lib/permissions";
 import { notify } from "@/lib/services/webhook";
 
+const ARTICLE_STATUSES = ["published", "scheduled", "draft"] as const;
+type ArticleStatus = (typeof ARTICLE_STATUSES)[number];
+
+function parseArticleStatus(raw: unknown): ArticleStatus {
+	const value = String(raw ?? "published").trim();
+	return (ARTICLE_STATUSES as readonly string[]).includes(value)
+		? (value as ArticleStatus)
+		: "published";
+}
+
+function parsePublishAt(raw: unknown): Date | null {
+	const value = String(raw ?? "").trim();
+	if (!value) return null;
+	const date = new Date(value);
+	return Number.isNaN(date.getTime()) ? null : date;
+}
+
 async function uniqueSlug(title: string): Promise<string> {
 	const base = slugify(title);
 	let slug = base;
@@ -44,13 +62,18 @@ export async function createArticle(formData: FormData): Promise<void> {
 		.normalize("NFC")
 		.trim();
 	const rawSlug = String(formData.get("slug") ?? "").trim();
-	const status = String(formData.get("status") ?? "published");
+	const status = parseArticleStatus(formData.get("status"));
 	const rawPublishAt = String(formData.get("publishAt") ?? "").trim();
 	if (!title) return;
+	if (status === "scheduled" && !parsePublishAt(rawPublishAt)) {
+		redirect(
+			"/admin/articles/new?error=Scheduled articles need a valid publish date.",
+		);
+	}
 
 	try {
 		const now = new Date();
-		const publishAt = rawPublishAt ? new Date(rawPublishAt) : null;
+		const publishAt = parsePublishAt(rawPublishAt);
 		const slug = rawSlug ? await uniqueSlug(rawSlug) : await uniqueSlug(title);
 		await db.insert(WebsiteArticles).values({
 			slug,
@@ -61,7 +84,7 @@ export async function createArticle(formData: FormData): Promise<void> {
 			userId: staff.id,
 			createdAt: now,
 			updatedAt: now,
-			status: status || "published",
+			status,
 			publishAt,
 			publishedAt: status === "published" ? now : null,
 		});
@@ -83,12 +106,28 @@ export async function createArticle(formData: FormData): Promise<void> {
 
 export async function updateArticle(formData: FormData): Promise<void> {
 	await requirePermission(PERMS.NEWS_EDIT);
-	const id = BigInt(String(formData.get("id")));
+	const id = formPositiveBigInt(formData, "id");
+	if (!id) redirect("/admin/articles?error=Missing article id");
 	const rawSlug = String(formData.get("slug") ?? "").trim();
-	const status = String(formData.get("status") ?? "published");
+	const status = parseArticleStatus(formData.get("status"));
 	const rawPublishAt = String(formData.get("publishAt") ?? "").trim();
+	if (status === "scheduled" && !parsePublishAt(rawPublishAt)) {
+		redirect(
+			"/admin/articles?error=Scheduled articles need a valid publish date.",
+		);
+	}
 	try {
-		const publishAt = rawPublishAt ? new Date(rawPublishAt) : null;
+		const publishAt = parsePublishAt(rawPublishAt);
+		const [existing] = await db
+			.select({
+				status: WebsiteArticles.status,
+				publishedAt: WebsiteArticles.publishedAt,
+			})
+			.from(WebsiteArticles)
+			.where(eq(WebsiteArticles.id, id))
+			.limit(1);
+		const publishedAt =
+			status === "published" ? (existing?.publishedAt ?? new Date()) : null;
 		await db
 			.update(WebsiteArticles)
 			.set({
@@ -110,7 +149,7 @@ export async function updateArticle(formData: FormData): Promise<void> {
 					.slice(0, 255),
 				status,
 				publishAt,
-				publishedAt: status === "published" ? new Date() : undefined,
+				publishedAt,
 				updatedAt: new Date(),
 			})
 			.where(eq(WebsiteArticles.id, id));
@@ -123,7 +162,8 @@ export async function updateArticle(formData: FormData): Promise<void> {
 
 export async function deleteArticle(formData: FormData): Promise<void> {
 	const staff = await requirePermission(PERMS.NEWS_EDIT);
-	const id = BigInt(String(formData.get("id")));
+	const id = formPositiveBigInt(formData, "id");
+	if (!id) redirect("/admin/articles?error=Missing article id");
 	const [article] = await db
 		.select({ title: WebsiteArticles.title })
 		.from(WebsiteArticles)