feat: harden atoms-nexst against review findings (37 items)

Second review pass covering security, performance, admin tooling and the
public/room flows. All HIGH and MEDIUM findings from the audit are resolved;
nothing in this commit changes the visible feature set.

Authentication & session security
- CSP is now set on the request headers in the proxy, which is what Next.js
  uses to derive the render nonce, so the nonce is effective.
- 2FA: an already-enabled user cannot re-enroll, the setup endpoint is
  rate-limited per account, and confirmed codes are persisted so the second
  secret no longer silently never applies.
- Password reset revokes the ticket, authTicket and all personal access
  tokens, and bumps the token version so existing sessions die. The same
  revocation is now wired into the staff-side password reset.
- /reset and /verify return a stable error code instead of raw text; the
  mail lookups are ordered by id so duplicates cannot vary between runs.
- Resending the verification mail gets a per-address cooldown on top of the
  per-user limit.
- Issue API tokens with the narrower radio/ticket ability set instead of "*".

Authorization & input handling
- Mid-rank staff can no longer keep dynamically granted non-view admin.*
  permissions: existing grants are revoked by migration and the grant lookup
  is restricted to "%.view". Rank guards use the dynamic super-admin check.
- Alerting a user is permission-checked and audited like the other tools.
- Material mutations (giveCredits/giveDuckets/giveDiamonds, the admin user
  actions route, bulk user actions) are capped and rank-guarded, and bulk
  ids are bounded.
- updateRoom / updateRoomItem write through a field allowlist, and items
  may only be edited through their own room.
- Classnames reaching the filesystem are validated before use so a crafted
  value cannot escape the asset directories.
- The word filter now also covers offline mails, guild forum threads and
  replies, and user mottos.
- Media uploads are validated by magic bytes, /api/media requires the page
  edit permission, APP_URL must be configured once mail is enabled, and the
  diagnostics error route checks the fetch site header.

Admin tooling
- Secret settings render masked and cannot be overwritten with a blank or
  an arbitrary raw key; radio credentials are new password inputs.
- Commandocentrum balance changes are audited.
- Admin list pagination reads the caller's per-page instead of the max, and
  the log exporter caps offset and search length.

Performance
- Catalog translations are cached per module, with a cheap revision hash;
  the public online count uses a stale window instead of hammering the DB.
- The cache warmup now primes the payload the home route actually reads.
- TopHeader batches its queries into one round trip, and LCP avatars load
  eagerly.
- motion/react and sonner are no longer part of the root layout; the nav
  dropdown and mobile nav panels are lazy client chunks. Anonymous visitors
  again get the navigation chrome, and public pages get an edge cacheable
  response.

Accessibility
- Nested <main> elements in phase pages became <section>; the page entrance
  and route progress animations are pure CSS that respect reduced motion.

src/actions/admin-media.ts

@@ -4,11 +4,32 @@ import { mkdir, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { revalidatePath } from "next/cache";
 import { requirePermission } from "@/lib/admin/guard";
+import { validateSiteImageUpload } from "@/lib/images/site-image-upload";
 import { MEDIA_ROOT, resolveMediaPath } from "@/lib/media-storage";
 import { PERMS } from "@/lib/permissions";
 
-const MAX_SIZE = 5 * 1024 * 1024; // 5MB
-const ALLOWED = ["image/png", "image/jpeg", "image/gif", "image/webp"];
+/**
+ * Store an uploaded media file under MEDIA_ROOT.
+ *
+ * The extension always comes from the *detected* format (magic bytes + a full
+ * sharp decode), never from `file.name` or the browser-supplied MIME type:
+ * trusting either lets arbitrary bytes land on disk with an attacker-chosen name
+ * that the media route would then serve.
+ */
+async function storeUploadedMedia(
+	file: File,
+): Promise<{ ok: true; name: string } | { ok: false; error: string }> {
+	const validated = await validateSiteImageUpload(file);
+	if (!validated.success) return { ok: false, error: validated.error };
+	const baseDir = MEDIA_ROOT;
+	await mkdir(baseDir, { recursive: true });
+	const name = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}.${validated.extension}`;
+	const filePath = resolveMediaPath(name);
+	if (!filePath.startsWith(baseDir + path.sep))
+		return { ok: false, error: "Invalid path" };
+	await writeFile(filePath, validated.bytes);
+	return { ok: true, name };
+}
 
 export async function uploadMedia(
 	formData: FormData,
@@ -16,25 +37,9 @@ export async function uploadMedia(
 	await requirePermission(PERMS.PAGES_EDIT);
 	const file = formData.get("file") as File | null;
 	if (!file || file.size === 0) return { ok: false, error: "No file provided" };
-	if (file.size > MAX_SIZE)
-		return { ok: false, error: "File too large (max 5MB)" };
-	if (!ALLOWED.includes(file.type))
-		return {
-			ok: false,
-			error: "Invalid file type. Allowed: PNG, JPEG, GIF, WebP",
-		};
 
-	const baseDir = MEDIA_ROOT;
-	// eslint-disable-next-line security/detect-non-literal-fs-filename
-	await mkdir(baseDir, { recursive: true });
-
-	const ext = file.name.split(".").pop() ?? "png";
-	const name = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}.${ext}`;
-	const bytes = await file.arrayBuffer();
-	const filePath = resolveMediaPath(name);
-	if (!filePath.startsWith(baseDir + path.sep)) throw new Error("Invalid path");
-	// eslint-disable-next-line security/detect-non-literal-fs-filename
-	await writeFile(filePath, Buffer.from(bytes));
+	const stored = await storeUploadedMedia(file);
+	if (!stored.ok) return { ok: false, error: stored.error };
 
 	revalidatePath("/api/media");
 	revalidatePath("/admin/media");
@@ -45,6 +50,8 @@ export async function deleteMedia(name: string): Promise<void> {
 	await requirePermission(PERMS.PAGES_EDIT);
 	const { unlink } = await import("node:fs/promises");
 	const baseDir = MEDIA_ROOT;
+	// A name that is not a bare file name never reaches the unlink.
+	if (name.includes("/") || name.includes("\\") || name.includes("..")) return;
 	const filePath = resolveMediaPath(name);
 	if (!filePath.startsWith(baseDir + path.sep)) return;
 	try {
@@ -62,22 +69,11 @@ export async function uploadMediaAndReturn(
 	await requirePermission(PERMS.PAGES_EDIT);
 	const file = formData.get("file") as File | null;
 	if (!file || file.size === 0) return "";
-	if (file.size > MAX_SIZE) return "";
-	if (!ALLOWED.includes(file.type)) return "";
 
-	const baseDir = MEDIA_ROOT;
-	// eslint-disable-next-line security/detect-non-literal-fs-filename
-	await mkdir(baseDir, { recursive: true });
-
-	const ext = file.name.split(".").pop() ?? "png";
-	const name = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}.${ext}`;
-	const bytes = await file.arrayBuffer();
-	const filePath = resolveMediaPath(name);
-	if (!filePath.startsWith(baseDir + path.sep)) return "";
-	// eslint-disable-next-line security/detect-non-literal-fs-filename
-	await writeFile(filePath, Buffer.from(bytes));
+	const stored = await storeUploadedMedia(file);
+	if (!stored.ok) return "";
 
 	revalidatePath("/api/media");
 	revalidatePath("/admin/media");
-	return `/api/media/${name}`;
+	return `/api/media/${stored.name}`;
 }

src/actions/admin-settings.ts

@@ -14,10 +14,19 @@ import {
 import { PERMS } from "@/lib/permissions";
 import { clearOfficialHabboFurnidataCache } from "@/lib/services/habbo-furnidata-cache";
 import { clearBadgeCache } from "@/lib/services/habboassets";
+import {
+	isSecretSettingKey,
+	SECRET_PLACEHOLDER,
+} from "@/lib/services/setting-secrets";
 import { siteSettings } from "@/lib/services/site-settings";
 
 const managedKeySet = new Set(MANAGED_SETTING_KEYS);
 
+// Raw keys only the CMS core is allowed to own. Writing an arbitrary key from
+// the generic "advanced key/value" form previously meant a staff member could
+// overwrite `turnstile_secret`, `force_staff_2fa` or `min_staff_rank`.
+const RAW_SETTING_KEY_RE = /^[a-z0-9][a-z0-9_.-]{0,127}$/;
+
 function normalizeSettingValue(key: string, value: string): string {
 	if (key === HABBO_GAMEDATA_HOTEL_SETTING_KEY) {
 		return normalizeHabboGamedataHotel(value);
@@ -71,11 +80,12 @@ export async function updateSetting(formData: FormData): Promise<void> {
 	const key = String(formData.get("key") ?? "")
 		.normalize("NFC")
 		.trim();
-	const value = normalizeSettingValue(
-		key,
-		String(formData.get("value") ?? "").normalize("NFC"),
-	);
-	if (!key) return;
+	const raw = String(formData.get("value") ?? "").normalize("NFC");
+	if (!key || !RAW_SETTING_KEY_RE.test(key)) return;
+	// Blank on a secret means "keep what is stored", so the UI can render a
+	// placeholder without the risk of wiping the credential.
+	if (isSecretSettingKey(key) && raw === SECRET_PLACEHOLDER) return;
+	const value = isSecretSettingKey(key) ? raw : normalizeSettingValue(key, raw);
 	await db
 		.insert(WebsiteSetting)
 		.values({ key, value })
@@ -90,7 +100,7 @@ export async function createSetting(formData: FormData): Promise<void> {
 	const key = String(formData.get("key") ?? "")
 		.normalize("NFC")
 		.trim()
-		.slice(0, 255);
+		.slice(0, 128);
 	const value = normalizeSettingValue(
 		key,
 		String(formData.get("value") ?? "").normalize("NFC"),
@@ -99,7 +109,17 @@ export async function createSetting(formData: FormData): Promise<void> {
 		.normalize("NFC")
 		.trim()
 		.slice(0, 255);
-	if (!key) return;
+	// Managed keys go through `saveManagedSettings`; anything else must be a
+	// clearly namespaced custom key, and lockout/security settings are never
+	// writable through the free-form form.
+	if (!key || !RAW_SETTING_KEY_RE.test(key)) return;
+	if (
+		key === "force_staff_2fa" ||
+		key === "min_staff_rank" ||
+		key === "maintenance_enabled"
+	) {
+		return;
+	}
 	await db
 		.insert(WebsiteSetting)
 		.values({ key, value, comment: comment || null })

src/actions/bulk-users.test.ts

@@ -41,7 +41,11 @@ const {
 });
 
 vi.mock("@/lib/admin/guard", () => ({ requirePermission: vi.fn() }));
-vi.mock("@/lib/permissions", () => ({ PERMS: { USERS_EDIT: "users.edit" } }));
+vi.mock("@/lib/permissions", () => ({
+	PERMS: { USERS_EDIT: "users.edit" },
+	// Staff (rank 7) may act on anyone below the hotel's top rank.
+	getHighestRank: vi.fn(() => Promise.resolve(10)),
+}));
 vi.mock("@/lib/db", () => ({
 	db: {
 		delete: vi.fn(() => ({ where: deleteWhere })),
@@ -109,7 +113,10 @@ beforeEach(() => {
 	onDuplicateKeyUpdate.mockResolvedValue([{ affectedRows: 1 }]);
 	updateWhere.mockResolvedValue([{ affectedRows: 1 }]);
 	selectLimit.mockResolvedValue([]);
-	selectWhereResolved.mockResolvedValue([]);
+	// Rank rows for the per-id rank guard: every target sits below staff rank 7.
+	selectWhereResolved.mockResolvedValue([{ rank: 1 }]);
+	// Max slot of existing badges (consumed by the badge loop, not the guard).
+	selectWhereResolved.mockResolvedValueOnce([{ rank: 1 }]);
 });
 
 describe("bulkUnban", () => {

src/actions/bulk-users.ts

@@ -1,6 +1,7 @@
 "use server";
 
 import { and, eq, inArray, max, sql } from "drizzle-orm";
+import { isDynamicSuperAdmin } from "@/lib/admin/authorization-policy";
 import { requirePermission } from "@/lib/admin/guard";
 import {
 	Ban,
@@ -11,18 +12,69 @@ import {
 	UsersCurrency,
 	UsersSettings,
 } from "@/lib/db";
-import { PERMS } from "@/lib/permissions";
+import { getHighestRank, PERMS } from "@/lib/permissions";
 import type { ActionResult } from "@/lib/safe-action-shared";
 import { rcon } from "@/lib/services/rcon";
 import { logStaffActivity } from "@/lib/services/staff-activity";
 
+/**
+ * Bulk actions are plain server actions whose arguments come from the client,
+ * so every one of them validates the payload and the target ranks first. The
+ * helpers below are the whole "is this allowed" contract.
+ */
+const MAX_BULK_USERS = 200;
+
+function parseUserIds(raw: unknown): number[] {
+	if (!Array.isArray(raw)) return [];
+	const ids = raw
+		.map((v) => (typeof v === "number" ? v : Number(v)))
+		.filter((v) => Number.isInteger(v) && v > 0);
+	return [...new Set(ids)].slice(0, MAX_BULK_USERS);
+}
+
+function toPositiveInt(raw: unknown): number | null {
+	const n = typeof raw === "number" ? raw : Number(raw);
+	return Number.isInteger(n) && n > 0 ? n : null;
+}
+
+function parseAmount(raw: unknown, max = 1_000_000): number | null {
+	const n = typeof raw === "number" ? raw : Number(raw);
+	return Number.isInteger(n) && n > 0 && n <= max ? n : null;
+}
+
+function parseDuration(raw: unknown): number {
+	const n = typeof raw === "number" ? raw : Number(raw);
+	return Number.isInteger(n) && n > 0 ? Math.min(n, 60 * 60 * 24 * 365) : 0;
+}
+
+async function guardBulkTargets(
+	staff: { id: number; rank: number },
+	userIds: number[],
+): Promise<void> {
+	const highestRank = await getHighestRank();
+	const superAdmin = isDynamicSuperAdmin(staff.rank, highestRank);
+	if (superAdmin || userIds.length === 0) return;
+	const rows = await db
+		.select({ rank: User.rank })
+		.from(User)
+		.where(inArray(User.id, userIds));
+	const blocked = rows.filter((r) => r.rank >= staff.rank);
+	if (blocked.length > 0) {
+		throw new Error(
+			"Cannot act on a user at or above your rank — those ids were skipped",
+		);
+	}
+}
+
 export async function bulkUnban({
 	userIds,
 }: {
 	userIds: number[];
 }): Promise<ActionResult<{ unbanned: number; total: number }>> {
 	const staff = await requirePermission(PERMS.USERS_EDIT);
-	const result = await db.delete(Ban).where(inArray(Ban.userId, userIds));
+	const ids = parseUserIds(userIds);
+	await guardBulkTargets(staff, ids);
+	const result = await db.delete(Ban).where(inArray(Ban.userId, ids));
 	const unbanned = Number(result[0]?.affectedRows ?? 0);
 	await logStaffActivity({
 		staffId: staff.id,
@@ -30,10 +82,7 @@ export async function bulkUnban({
 		description: `Unbanned ${unbanned} user(s)`,
 		targetType: "user",
 	});
-	return {
-		ok: true as const,
-		data: { unbanned, total: userIds.length },
-	};
+	return { ok: true as const, data: { unbanned, total: ids.length } };
 }
 
 export async function bulkBan({
@@ -46,10 +95,14 @@ export async function bulkBan({
 	duration: number;
 }): Promise<ActionResult<{ banned: number }>> {
 	const staff = await requirePermission(PERMS.USERS_EDIT);
+	const ids = parseUserIds(userIds);
+	const seconds = parseDuration(duration);
+	const reasonText = typeof reason === "string" ? reason.slice(0, 255) : "";
+	await guardBulkTargets(staff, ids);
 	const now = Math.floor(Date.now() / 1000);
 	let banned = 0;
 
-	for (const userId of userIds) {
+	for (const userId of ids) {
 		try {
 			await db.insert(Ban).values({
 				userId,
@@ -57,8 +110,8 @@ export async function bulkBan({
 				machineId: "",
 				userStaffId: staff.id,
 				timestamp: now,
-				banExpire: duration > 0 ? now + duration : 0,
-				banReason: reason,
+				banExpire: seconds > 0 ? now + seconds : 0,
+				banReason: reasonText,
 				type: "account",
 			});
 			banned++;
@@ -92,33 +145,37 @@ export async function bulkGiveCurrency({
 	}>
 > {
 	const staff = await requirePermission(PERMS.USERS_EDIT);
+	const ids = parseUserIds(userIds);
+	const value = parseAmount(amount);
+	if (!value) throw new Error("Invalid amount");
+	await guardBulkTargets(staff, ids);
 	let given = 0;
 	const failedIds: Array<{ userId: number; reason: string }> = [];
 
-	for (const userId of userIds) {
+	for (const userId of ids) {
 		try {
 			if (type === "credits") {
 				await db
 					.update(User)
-					.set({ credits: sql`${User.credits} + ${amount}` })
+					.set({ credits: sql`${User.credits} + ${value}` })
 					.where(eq(User.id, userId));
-				await rcon.giveCredits(userId, amount);
+				await rcon.giveCredits(userId, value);
 			} else if (type === "pixels") {
 				await db
 					.insert(UsersCurrency)
-					.values({ userId, type: 0, amount })
+					.values({ userId, type: 0, amount: value })
 					.onDuplicateKeyUpdate({
-						set: { amount: sql`${UsersCurrency.amount} + ${amount}` },
+						set: { amount: sql`${UsersCurrency.amount} + ${value}` },
 					});
-				await rcon.giveDuckets(userId, amount);
+				await rcon.giveDuckets(userId, value);
 			} else if (type === "points") {
 				await db
 					.insert(UsersCurrency)
-					.values({ userId, type: 101, amount })
+					.values({ userId, type: 101, amount: value })
 					.onDuplicateKeyUpdate({
-						set: { amount: sql`${UsersCurrency.amount} + ${amount}` },
+						set: { amount: sql`${UsersCurrency.amount} + ${value}` },
 					});
-				await rcon.givePointsGotw(userId, amount);
+				await rcon.givePointsGotw(userId, value);
 			}
 			given++;
 		} catch {
@@ -129,7 +186,7 @@ export async function bulkGiveCurrency({
 	await logStaffActivity({
 		staffId: staff.id,
 		action: "bulk_give_currency",
-		description: `Gave ${amount} ${type} to ${given} user(s)`,
+		description: `Gave ${value} ${type} to ${given} user(s)`,
 		targetType: "user",
 	});
 	return {
@@ -152,19 +209,21 @@ export async function bulkGiveBadge({
 	}>
 > {
 	const staff = await requirePermission(PERMS.USERS_EDIT);
+	const ids = parseUserIds(userIds);
+	const code =
+		typeof badgeCode === "string" ? badgeCode.trim().slice(0, 64) : "";
+	if (!code) throw new Error("Invalid badge code");
+	await guardBulkTargets(staff, ids);
 	let given = 0;
 	const failedIds: Array<{ userId: number; reason: string }> = [];
 
-	for (const userId of userIds) {
+	for (const userId of ids) {
 		try {
 			const [existing] = await db
 				.select({ id: UsersBadges.id })
 				.from(UsersBadges)
 				.where(
-					and(
-						eq(UsersBadges.userId, userId),
-						eq(UsersBadges.badgeCode, badgeCode),
-					),
+					and(eq(UsersBadges.userId, userId), eq(UsersBadges.badgeCode, code)),
 				)
 				.limit(1);
 			if (!existing) {
@@ -173,8 +232,10 @@ export async function bulkGiveBadge({
 					.from(UsersBadges)
 					.where(eq(UsersBadges.userId, userId));
 				const slotId = (agg?.maxSlot ?? 0) + 1;
-				await db.insert(UsersBadges).values({ userId, slotId, badgeCode });
-				await rcon.giveBadge(userId, badgeCode);
+				await db
+					.insert(UsersBadges)
+					.values({ userId, slotId, badgeCode: code });
+				await rcon.giveBadge(userId, code);
 			}
 			given++;
 		} catch {
@@ -211,12 +272,17 @@ export async function bulkAdjustCurrency({
 	}>
 > {
 	const staff = await requirePermission(PERMS.USERS_EDIT);
+	const ids = parseUserIds(userIds);
 	if (!Number.isFinite(amount) || amount === 0) {
 		return { ok: false as const, error: "Amount must be a non-zero number" };
 	}
+	if (Math.abs(Math.trunc(amount)) > 1_000_000) {
+		return { ok: false as const, error: "Amount is too large" };
+	}
+	await guardBulkTargets(staff, ids);
 
 	if (amount > 0) {
-		const given = await bulkGiveCurrency({ userIds, amount, type });
+		const given = await bulkGiveCurrency({ userIds: ids, amount, type });
 		if (!given.ok) return given;
 		if (!given.data) {
 			return { ok: false as const, error: "Currency adjustment failed" };
@@ -235,7 +301,7 @@ export async function bulkAdjustCurrency({
 	let adjusted = 0;
 	const failedIds: Array<{ userId: number; reason: string }> = [];
 
-	for (const userId of userIds) {
+	for (const userId of ids) {
 		try {
 			if (type === "credits") {
 				const [user] = await db
@@ -299,8 +365,11 @@ export async function setTradeLock({
 	untilUnix: number;
 }): Promise<ActionResult<{ userId: number; untilUnix: number }>> {
 	const staff = await requirePermission(PERMS.USERS_EDIT);
-	const until = Math.max(0, Math.trunc(untilUnix));
+	const id = toPositiveInt(userId);
+	if (!id) return { ok: false as const, error: "Invalid user" };
+	const until = Math.max(0, Math.min(Math.trunc(untilUnix), 2_000_000_000));
 	const locked = until > 0;
+	await guardBulkTargets(staff, [id]);
 
 	const [user] = await db
 		.select({
@@ -309,7 +378,7 @@ export async function setTradeLock({
 			online: User.online,
 		})
 		.from(User)
-		.where(eq(User.id, userId))
+		.where(eq(User.id, id))
 		.limit(1);
 	if (!user) {
 		return { ok: false as const, error: "User not found" };
@@ -331,7 +400,7 @@ export async function setTradeLock({
 				.where(eq(Sanctions.id, existing.id));
 		} else {
 			await tx.insert(Sanctions).values({
-				habboId: userId,
+				habboId: id,
 				tradeLockedUntil: until,
 				reason: locked ? "Trade lock (CMS)" : "",
 			});
@@ -369,5 +438,5 @@ export async function setTradeLock({
 		targetId: userId,
 	});
 
-	return { ok: true as const, data: { userId, untilUnix: until } };
+	return { ok: true as const, data: { userId: id, untilUnix: until } };
 }

src/actions/commandocentrum.ts

@@ -7,12 +7,30 @@ import { db, queryRows, User } from "@/lib/db";
 import { PERMS } from "@/lib/permissions";
 import { adminAction } from "@/lib/safe-action";
 import { ActionError, actionOk } from "@/lib/safe-action-shared";
+import { logAudit } from "@/lib/services/audit";
 import { rcon } from "@/lib/services/rcon";
 
 const PATH = "/admin/commandocentrum";
 
 const RCON_FAIL = "RCON command failed. Is the emulator running?";
 
+/** Currency amounts are capped: unbounded values break the hotel economy. */
+const MAX_CURRENCY = 1_000_000;
+
+/** Every mutation here gets an audit entry; rank changes and RCON most of all. */
+function auditAction(
+	userId: number,
+	action: string,
+	targetId: number,
+	after: Record<string, unknown>,
+): void {
+	try {
+		logAudit({ userId, action, target: "User", targetId, after });
+	} catch {
+		/* auditing must never fail the command it describes */
+	}
+}
+
 async function requireRconOk(ok: boolean): Promise<void> {
 	if (!ok) throw new ActionError(RCON_FAIL);
 }
@@ -120,9 +138,16 @@ const giveCreditsSchema = z.object({
 export const giveCredits = adminAction(
 	{ permission: PERMS.RCON_EXECUTE, schema: giveCreditsSchema },
 	async (ctx) => {
+		if (ctx.data.credits > MAX_CURRENCY) {
+			throw new ActionError(`Amount is too large (max ${MAX_CURRENCY})`);
+		}
 		await requireRconOk(
 			await rcon.giveCredits(ctx.data.userId, ctx.data.credits),
 		);
+		auditAction(Number(ctx.session.user.id), "give_credits", ctx.data.userId, {
+			userId: ctx.data.userId,
+			amount: ctx.data.credits,
+		});
 		revalidatePath(PATH);
 		return actionOk();
 	},
@@ -137,9 +162,16 @@ const giveAmountSchema = z.object({
 export const giveDuckets = adminAction(
 	{ permission: PERMS.RCON_EXECUTE, schema: giveAmountSchema },
 	async (ctx) => {
+		if (ctx.data.amount > MAX_CURRENCY) {
+			throw new ActionError(`Amount is too large (max ${MAX_CURRENCY})`);
+		}
 		await requireRconOk(
 			await rcon.giveDuckets(ctx.data.userId, ctx.data.amount),
 		);
+		auditAction(Number(ctx.session.user.id), "give_duckets", ctx.data.userId, {
+			userId: ctx.data.userId,
+			amount: ctx.data.amount,
+		});
 		revalidatePath(PATH);
 		return actionOk();
 	},
@@ -149,9 +181,16 @@ export const giveDuckets = adminAction(
 export const giveDiamonds = adminAction(
 	{ permission: PERMS.RCON_EXECUTE, schema: giveAmountSchema },
 	async (ctx) => {
+		if (ctx.data.amount > MAX_CURRENCY) {
+			throw new ActionError(`Amount is too large (max ${MAX_CURRENCY})`);
+		}
 		await requireRconOk(
 			await rcon.giveDiamonds(ctx.data.userId, ctx.data.amount),
 		);
+		auditAction(Number(ctx.session.user.id), "give_diamonds", ctx.data.userId, {
+			userId: ctx.data.userId,
+			amount: ctx.data.amount,
+		});
 		revalidatePath(PATH);
 		return actionOk();
 	},

src/actions/messenger.test.ts

@@ -10,8 +10,13 @@ const state = vi.hoisted(() => ({
 	deletes: [] as unknown[],
 	affectedDelete: 1,
 	emptyDeleteResult: false,
+	isAllowed: vi.fn(async () => ({ ok: true })),
 }));
 
+// The real moderation module loads the word filter through the (mocked) db,
+// which would silently change the rows the offline-message assertions read.
+vi.mock("@/lib/services/moderation", () => ({ isAllowed: state.isAllowed }));
+
 vi.mock("@/lib/db", async () => {
 	const schema = await import("@/db/schema");
 	const { createFakeDb } = await import("@/test/fake-db");
@@ -315,6 +320,18 @@ describe("sendOfflineMessage", () => {
 		expect(redirected()).toBe("/messages?send_error=invalid");
 	});
 
+	it("rejects content blocked by the word filter before storing it", async () => {
+		state.friendships = [{ id: 1 }];
+		state.isAllowed.mockResolvedValue({ ok: false, reason: "bad" });
+		await redirects(() =>
+			sendOfflineMessage(fakeForm({ friendId: "2", message: "rude words" })),
+		);
+		expect(state.isAllowed).toHaveBeenCalledWith("rude words");
+		expect(state.inserts).toHaveLength(0);
+		expect(redirected()).toBe("/messages?send_error=invalid");
+		state.isAllowed.mockResolvedValue({ ok: true });
+	});
+
 	it("stores an offline message for a friend", async () => {
 		state.friendships = [{ id: 1 }];
 		await redirects(() =>

src/actions/messenger.ts

@@ -12,6 +12,7 @@ import {
 	User,
 } from "@/lib/db";
 import { clientIp, rateLimit } from "@/lib/rate-limit";
+import { isAllowed } from "@/lib/services/moderation";
 
 type FriendOutcome =
 	| "accepted"
@@ -376,6 +377,8 @@ export async function sendOfflineMessage(formData: FormData): Promise<void> {
 						.limit(1);
 					if (!recipient) {
 						outcome = "invalid";
+					} else if (!(await isAllowed(message)).ok) {
+						outcome = "invalid";
 					} else {
 						await db.insert(MessengerOffline).values({
 							userId: friendId,

src/actions/password-reset.test.ts

@@ -1,14 +1,14 @@
 // @ts-nocheck
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
-const { selectLimit, insertOnDup, mockSendMail, mockRedirect } = vi.hoisted(
-	() => ({
+const { selectLimit, selectWhere, insertOnDup, mockSendMail, mockRedirect } =
+	vi.hoisted(() => ({
 		selectLimit: vi.fn(),
 		insertOnDup: vi.fn().mockResolvedValue({}),
+		selectWhere: vi.fn(() => Promise.resolve([] as Array<{ id: number }>)),
 		mockSendMail: vi.fn(),
 		mockRedirect: vi.fn(),
-	}),
-);
+	}));
 
 vi.mock("next/navigation", () => ({
 	redirect: (...args: unknown[]) => {
@@ -24,6 +24,17 @@ vi.mock("@/lib/db", () => {
 				from: vi.fn(() => ({
 					where: vi.fn(() => ({
 						limit: selectLimit,
+						// Matches the deterministic `.orderBy(asc(User.id))` list
+						// reads used to resolve duplicate addresses.
+						orderBy: vi.fn(() => ({
+							// biome-ignore lint/suspicious/noThenProperty: Drizzle query thenable mock
+							then(
+								resolve: (v: unknown) => void,
+								reject: (e: unknown) => void,
+							) {
+								return Promise.resolve(selectWhere()).then(resolve, reject);
+							},
+						})),
 					})),
 				})),
 			})),
@@ -70,13 +81,14 @@ beforeEach(() => {
 describe("requestReset", () => {
 	it("sends a reset email when the user exists", async () => {
 		selectLimit.mockResolvedValue([{ id: 1 }]);
+		selectWhere.mockResolvedValue([{ id: 1 }]);
 
 		const fd = new FormData();
 		fd.set("email", "[email protected]");
 
 		await expect(requestReset(fd)).rejects.toThrow("redirect");
 
-		expect(selectLimit).toHaveBeenCalled();
+		expect(selectWhere).toHaveBeenCalled();
 		expect(insertOnDup).toHaveBeenCalled();
 		expect(mockSendMail).toHaveBeenCalledWith(
 			"[email protected]",
@@ -87,6 +99,7 @@ describe("requestReset", () => {
 
 	it("does not send email when user is not found", async () => {
 		selectLimit.mockResolvedValue([]);
+		selectWhere.mockResolvedValue([]);
 
 		const fd = new FormData();
 		fd.set("email", "[email protected]");

src/actions/password-reset.ts

@@ -1,11 +1,14 @@
 "use server";
 
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
-import { eq } from "drizzle-orm";
+import { asc, eq } from "drizzle-orm";
 import { redirect } from "next/navigation";
 import { env } from "@/env";
+import { invalidateLoginCache } from "@/lib/auth/login-core";
 import { hashPassword } from "@/lib/auth/password";
+import { revokeUserCredentials } from "@/lib/auth/session-revocation";
 import { db, PasswordReset, User } from "@/lib/db";
+import { logger } from "@/lib/logger";
 import { clientIp, rateLimit } from "@/lib/rate-limit";
 import { logServerError } from "@/lib/server-log";
 import { captchaConfig, verifyCaptcha } from "@/lib/services/captcha";
@@ -17,6 +20,17 @@ function sha256(s: string): string {
 	return createHash("sha256").update(s).digest("hex");
 }
 
+/**
+ * Back to the reset form with a *code*, never with the human-readable message:
+ * a raw `?error=` value would be rendered on our own domain, which is a
+ * perfect phishing skeleton. The page maps each code to a translation.
+ */
+function errorRedirect(email: string, token: string, code: string): never {
+	return redirect(
+		`/reset?email=${encodeURIComponent(email)}&token=${encodeURIComponent(token)}&error=${code}`,
+	);
+}
+
 export async function requestReset(formData: FormData): Promise<void> {
 	const email = String(formData.get("email") ?? "")
 		.normalize("NFC")
@@ -40,12 +54,23 @@ export async function requestReset(formData: FormData): Promise<void> {
 	// Always respond the same way so we don't reveal which emails exist.
 	if (allowed && /^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email)) {
 		try {
-			const [user] = await db
+			const matches = await db
 				.select({ id: User.id })
 				.from(User)
 				.where(eq(User.mail, email))
-				.limit(1);
+				.orderBy(asc(User.id));
+			if (matches.length > 1) {
+				logger.warn("Password reset address is not unique", {
+					email,
+					accountCount: matches.length,
+					using: matches[0]?.id,
+				});
+			}
+			const user = matches[0];
 			if (user) {
+				// Duplicate addresses exist on legacy databases; resetting the
+				// *oldest* account keeps the choice deterministic instead of
+				// "whatever row the engine returns first".
 				const token = randomBytes(32).toString("hex");
 				const hashed = sha256(token);
 				const createdAt = new Date();
@@ -80,13 +105,11 @@ export async function resetPassword(formData: FormData): Promise<void> {
 
 	// Throttle reset attempts per IP (5 per 15 min) to prevent token brute-force.
 	if (!(await rateLimit(`resetpwd:${await clientIp()}`, 5, 15 * 60_000)).ok) {
-		redirect(
-			`/reset?email=${encodeURIComponent(email)}&token=${encodeURIComponent(token)}&error=${encodeURIComponent("Too many attempts — try again later")}`,
-		);
+		redirect(errorRedirect(email, token, "ratelimit"));
 	}
 
-	let error: string | null = null;
-	if (password.length < 12) error = "Password must be at least 12 characters";
+	let error: "password" | "invalid" | "failed" | null = null;
+	if (password.length < 12) error = "password";
 
 	if (!error) {
 		try {
@@ -107,20 +130,29 @@ export async function resetPassword(formData: FormData): Promise<void> {
 				row != null && a.length === b.length && timingSafeEqual(a, b);
 
 			if (!row || !fresh || !match) {
-				error = "This reset link is invalid or has expired";
+				error = "invalid";
 			} else {
-				const [user] = await db
+				const matches = await db
 					.select({ id: User.id })
 					.from(User)
 					.where(eq(User.mail, email))
-					.limit(1);
+					.orderBy(asc(User.id));
+				const user = matches[0];
 				if (!user) {
-					error = "Account not found";
+					error = "invalid";
 				} else {
-					await db
-						.update(User)
-						.set({ password: await hashPassword(password) })
-						.where(eq(User.id, user.id));
+					const newHash = await hashPassword(password);
+					// A password change has to end every existing session: the
+					// popular reason for resetting is a compromised account, and a
+					// stolen cookie/API token must not outlive the reset.
+					await Promise.all([
+						db
+							.update(User)
+							.set({ password: newHash })
+							.where(eq(User.id, user.id)),
+						revokeUserCredentials(user.id),
+					]);
+					await invalidateLoginCache(email);
 					await db
 						.delete(PasswordReset)
 						.where(eq(PasswordReset.email, email))
@@ -132,14 +164,12 @@ export async function resetPassword(formData: FormData): Promise<void> {
 				}
 			}
 		} catch {
-			error = "Could not reset the password — try again";
+			error = "failed";
 		}
 	}
 
 	if (error) {
-		redirect(
-			`/reset?email=${encodeURIComponent(email)}&token=${encodeURIComponent(token)}&error=${encodeURIComponent(error)}`,
-		);
+		redirect(errorRedirect(email, token, error));
 	}
 	redirect("/login?reset=1");
 }

src/actions/permissions.ts

@@ -175,8 +175,10 @@ export const setCmsPermissions = adminAction(
 );
 
 /**
- * Re-apply the same grant repair as migration 0018:
- * - ranks with admin.dashboard get all admin.*
+ * Re-apply the grant repair from migration 0018/0034:
+ * - ranks with admin.dashboard get all admin.*.view (read-only: the sidebar
+ *   needs to open, nothing more — a blanket `admin.%` grant here is what
+ *   promoted rank 6 to full admin)
  * - ranks >= 6 get admin.*.view + dashboard
  * - ranks >= 7 get edit/manage/execute tools used by the sidebar
  */
@@ -187,7 +189,9 @@ export const repairAdminNavAclGrants = adminAction(
 			INSERT INTO \`acl_model_permissions\` (\`model_type\`, \`model_id\`, \`permission_id\`)
 			SELECT 'Role', ar.id, ap.id
 			FROM \`acl_roles\` ar
-			JOIN \`acl_permissions\` ap ON ap.slug LIKE 'admin.%'
+			-- View slugs only: widening this to all admin.* turned "can open the
+			-- panel" into "is a full admin" for every mid rank (see 0034).
+			JOIN \`acl_permissions\` ap ON ap.slug LIKE 'admin.%' AND ap.slug LIKE '%.view'
 			WHERE EXISTS (
 			  SELECT 1
 			  FROM \`acl_model_permissions\` amp

src/actions/rooms.test.ts

@@ -76,14 +76,17 @@ describe("rooms actions", () => {
 		});
 		state.del.mockResolvedValue([{ affectedRows: 1 }]);
 		state.update.mockResolvedValue([{ affectedRows: 1 }]);
+		// The item/room ownership lookups must find their row.
+		state.roomRows = [{ name: "Lobby" }, { id: 4 }];
 	});
 
 	it("requires the ROOMS_EDIT permission for updateRoomItem", async () => {
-		await updateRoomItem({ roomId: 9, itemId: 4, custom: "x" });
+		// `custom` is not an allow-listed column, so it must never reach `.set()`.
+		await updateRoomItem({ roomId: 9, itemId: 4, rot: 4, custom: "x" });
 		expect(state.requirePermission).toHaveBeenCalledWith("admin.room.edit");
 		expect(state.update).toHaveBeenCalledWith(
 			Items,
-			{ custom: "x" },
+			{ rot: 4 },
 			expect.anything(),
 		);
 		expect(state.logStaffActivity).toHaveBeenCalledWith(

src/actions/rooms.ts

@@ -9,16 +9,63 @@ import { rcon } from "@/lib/services/rcon";
 import { logStaffActivity } from "@/lib/services/staff-activity";
 import { notify } from "@/lib/services/webhook";
 
+// Only these columns may be patched from the client. Spreading the whole payload
+// into `.set()` let a caller rewrite roomId/userId/extraData of any row, which
+// is mass assignment and IDOR in one.
+const ROOM_ITEM_FIELDS = [
+	"wallPos",
+	"x",
+	"y",
+	"z",
+	"rot",
+	"extraData",
+	"wiredData",
+	"limitedData",
+	"guildId",
+] as const;
+
+const ROOM_FIELDS = ["name", "description", "state", "usersMax"] as const;
+
+function pickAllowed(
+	fields: Record<string, unknown>,
+	allowed: readonly string[],
+): Record<string, unknown> {
+	const out: Record<string, unknown> = {};
+	for (const key of allowed) {
+		if (Object.hasOwn(fields, key) && fields[key] !== undefined) {
+			out[key] = fields[key];
+		}
+	}
+	return out;
+}
+
+function toPositiveInt(value: unknown): number | null {
+	const n = typeof value === "number" ? value : Number(value);
+	return Number.isInteger(n) && n > 0 ? n : null;
+}
+
 export async function updateRoomItem(payload: Record<string, unknown>) {
 	const staff = await requirePermission(PERMS.ROOMS_EDIT);
-	const { roomId, itemId, ...data } = payload as {
-		roomId: number;
-		itemId: number;
-		[key: string]: unknown;
-	};
+	const roomId = toPositiveInt(payload.roomId);
+	const itemId = toPositiveInt(payload.itemId);
+	if (!roomId || !itemId) {
+		throw new Error("Invalid room or item id");
+	}
+	// The item must belong to the room the staff member is editing.
+	const [item] = await db
+		.select({ id: Items.id })
+		.from(Items)
+		.where(and(eq(Items.id, itemId), eq(Items.roomId, roomId)))
+		.limit(1);
+	if (!item) throw new Error("Item not found in this room");
+
 	await db
 		.update(Items)
-		.set(data as Partial<typeof Items.$inferInsert>)
+		.set(
+			pickAllowed(payload, ROOM_ITEM_FIELDS) as Partial<
+				typeof Items.$inferInsert
+			>,
+		)
 		.where(eq(Items.id, itemId));
 	await logStaffActivity({
 		staffId: staff.id,
@@ -117,24 +164,20 @@ export async function deleteRoom({ id }: { id: number }) {
 	revalidatePath("/admin/rooms");
 }
 
-export async function updateRoom({
-	id,
-	...data
-}: {
-	id: number;
-	name?: string;
-	description?: string;
-	state?: string;
-	usersMax?: number;
-}) {
+export async function updateRoom({ id, ...data }: Record<string, unknown>) {
 	const staff = await requirePermission(PERMS.ROOMS_EDIT);
-	await db.update(Rooms).set(data).where(eq(Rooms.id, id));
+	const roomId = toPositiveInt(id);
+	if (!roomId) throw new Error("Invalid room id");
+	await db
+		.update(Rooms)
+		.set(pickAllowed(data, ROOM_FIELDS) as Partial<typeof Rooms.$inferInsert>)
+		.where(eq(Rooms.id, roomId));
 	await logStaffActivity({
 		staffId: staff.id,
 		action: "room_update",
-		description: `Updated room #${id}`,
+		description: `Updated room #${roomId}`,
 		targetType: "room",
-		targetId: id,
+		targetId: roomId,
 	});
-	revalidatePath(`/admin/rooms/${id}`);
+	revalidatePath(`/admin/rooms/${roomId}`);
 }

src/actions/social.test.ts

@@ -14,8 +14,13 @@ const state = vi.hoisted(() => ({
 	selectQueue: [] as Queue,
 	rows: [] as Array<Record<string, unknown>>,
 	failInsert: false,
+	isAllowed: vi.fn(async () => ({ ok: true })),
 }));
 
+// The real moderation module loads the word filter through the (mocked) db
+// select queue, which would shift the rows the forum assertions rely on.
+vi.mock("@/lib/services/moderation", () => ({ isAllowed: state.isAllowed }));
+
 vi.mock("next/cache", () => ({ revalidatePath: state.revalidatePath }));
 vi.mock("next/navigation", () => ({
 	redirect: (path: string) => {
@@ -210,6 +215,7 @@ describe("postThread", () => {
 		state.failInsert = false;
 		state.selectQueue = [];
 		state.rows = [];
+		state.isAllowed.mockResolvedValue({ ok: true });
 		state.transaction.mockImplementation(
 			async (fn: (tx: unknown) => Promise<unknown>, txDb: unknown) => fn(txDb),
 		);
@@ -283,6 +289,18 @@ describe("postThread", () => {
 		expect(state.insert).not.toHaveBeenCalled();
 	});
 
+	it("rejects content blocked by the word filter before hitting the db", async () => {
+		state.isAllowed.mockResolvedValue({ ok: false, reason: "bad" });
+		state.selectQueue = [[{ id: 10 }]];
+		await expect(postThread(threadForm())).rejects.toThrow(
+			"/guilds/10/forum/new?error=invalid",
+		);
+		expect(state.isAllowed).toHaveBeenCalledWith(
+			"Welcome thread Hello from the community",
+		);
+		expect(state.insert).not.toHaveBeenCalled();
+	});
+
 	it("reports not_found when the guild does not exist", async () => {
 		state.selectQueue = [[]];
 		await expect(postThread(threadForm())).rejects.toThrow(
@@ -324,6 +342,7 @@ describe("replyToThread", () => {
 		state.failInsert = false;
 		state.selectQueue = [];
 		state.rows = [];
+		state.isAllowed.mockResolvedValue({ ok: true });
 		state.transaction.mockImplementation(
 			async (fn: (tx: unknown) => Promise<unknown>, txDb: unknown) => fn(txDb),
 		);
@@ -361,6 +380,16 @@ describe("replyToThread", () => {
 		expect(state.update.mock.calls[0][1]).toMatchObject({ postsCount: 1 });
 	});
 
+	it("rejects a reply blocked by the word filter before hitting the db", async () => {
+		state.isAllowed.mockResolvedValue({ ok: false, reason: "bad" });
+		state.selectQueue = [[{ id: 20, locked: 0, postsCount: 3 }]];
+		await expect(replyToThread(replyForm())).rejects.toThrow(
+			"/guilds/10/forum/20?error=invalid",
+		);
+		expect(state.isAllowed).toHaveBeenCalledWith("A thoughtful reply");
+		expect(state.insert).not.toHaveBeenCalled();
+	});
+
 	it("rejects missing or non-positive ids by redirecting to /guilds", async () => {
 		await expect(replyToThread(replyForm({ guildId: "abc" }))).rejects.toThrow(
 			"/guilds",

src/actions/social.ts

@@ -13,6 +13,7 @@ import {
 	MessengerFriendships,
 } from "@/lib/db";
 import { clientIp, rateLimit } from "@/lib/rate-limit";
+import { isAllowed } from "@/lib/services/moderation";
 
 // Guild forum subjects are VARCHAR(255); the comment/message body lives in
 // guilds_forums_comments.message which is TEXT. Keep the first post's message
@@ -235,6 +236,8 @@ export async function postThread(formData: FormData): Promise<void> {
 					.slice(0, MESSAGE_MAX);
 				if (!subject || !message) {
 					outcome = "invalid";
+				} else if (!(await isAllowed(`${subject} ${message}`)).ok) {
+					outcome = "invalid";
 				} else {
 					const now = Math.floor(Date.now() / 1000);
 
@@ -326,6 +329,8 @@ export async function replyToThread(formData: FormData): Promise<void> {
 					.slice(0, MESSAGE_MAX);
 				if (!message) {
 					outcome = "invalid";
+				} else if (!(await isAllowed(message)).ok) {
+					outcome = "invalid";
 				} else {
 					const now = Math.floor(Date.now() / 1000);
 

src/actions/twofactor.ts

@@ -78,6 +78,22 @@ async function verifyTwoFactorCode(
 export async function beginTwoFactor(): Promise<void> {
 	const id = await sessionUserId();
 	if (!env.APP_KEY) redirect("/settings/2fa?error=noappkey");
+
+	if (!(await rateLimit(`2fa-begin:${id}`, 5, 30_000)).ok)
+		redirect("/settings/2fa?error=ratelimit");
+
+	// Re-running this action while 2FA is confirmed would be a silent *downgrade*
+	// (the new secret is stored unconfirmed, and unconfirmed means "login gate
+	// off"), so the existing setup has to be disabled through the proper flow
+	// first: a valid code, not just an authenticated session.
+	const [current] = await db
+		.select({ twoFactorConfirmedAt: User.twoFactorConfirmedAt })
+		.from(User)
+		.where(eq(User.id, id))
+		.limit(1);
+	if (current?.twoFactorConfirmedAt)
+		redirect("/settings/2fa?error=alreadyenabled");
+
 	const secret = generateTotpSecret();
 	const encrypted = new LaravelEncrypter(env.APP_KEY).encrypt(secret);
 	const codes = generateRecoveryCodes();
@@ -104,12 +120,19 @@ export async function confirmTwoFactor(formData: FormData): Promise<void> {
 		.normalize("NFC")
 		.trim();
 
-	const { ok } = await verifyTwoFactorCode(id, code);
+	const { ok, updatedRecoveryCodes } = await verifyTwoFactorCode(id, code);
 	if (!ok) redirect("/settings/2fa?error=badcode");
 
+	// A recovery code spends itself on use, so persist the remainder together
+	// with the confirmation instead of dropping the caller's own update.
 	await db
 		.update(User)
-		.set({ twoFactorConfirmedAt: new Date() })
+		.set({
+			twoFactorConfirmedAt: new Date(),
+			...(updatedRecoveryCodes !== undefined
+				? { twoFactorRecoveryCodes: updatedRecoveryCodes }
+				: {}),
+		})
 		.where(eq(User.id, id));
 	redirect("/settings/2fa?enabled=1");
 }

src/actions/user-settings.test.ts

@@ -8,6 +8,7 @@ const state = vi.hoisted(() => ({
 	updateCall: undefined as unknown,
 	rconSetMotto: vi.fn(),
 	failDbUpdate: false,
+	isAllowed: vi.fn(async () => ({ ok: true })),
 }));
 
 const databaseErrorClass = vi.hoisted(
@@ -63,6 +64,10 @@ vi.mock("@/lib/services/rcon", () => ({
 	rcon: { setMotto: state.rconSetMotto },
 }));
 
+vi.mock("@/lib/services/moderation", () => ({
+	isAllowed: state.isAllowed,
+}));
+
 const mockRevalidatePath = vi.hoisted(() => vi.fn());
 vi.mock("next/cache", () => ({ revalidatePath: mockRevalidatePath }));
 
@@ -98,6 +103,7 @@ beforeEach(() => {
 	state.updateCall = undefined;
 	state.rconSetMotto.mockResolvedValue(true);
 	state.failDbUpdate = false;
+	state.isAllowed.mockResolvedValue({ ok: true });
 });
 
 describe("updateMotto", () => {
@@ -141,6 +147,18 @@ describe("updateMotto", () => {
 	});
 });
 
+describe("updateMotto word filter", () => {
+	it("rejects a motto blocked by the word filter before persisting", async () => {
+		state.isAllowed.mockResolvedValue({ ok: false, reason: "bad" });
+		await expect(updateMotto(mockingForm("bad motto"))).rejects.toThrow(
+			databaseErrorClass,
+		);
+		expect(state.isAllowed).toHaveBeenCalledWith("bad motto");
+		expect(state.updateCall).toBeUndefined();
+		expect(state.rconSetMotto).not.toHaveBeenCalled();
+	});
+});
+
 describe("updateMottoAction", () => {
 	it("denies unauthenticated callers", async () => {
 		state.auth.mockResolvedValue(null);

src/actions/user-settings.ts

@@ -6,6 +6,7 @@ import { z } from "zod";
 import { db, User } from "@/lib/db";
 import { actionOk, authAction } from "@/lib/foundation/action";
 import { DatabaseError } from "@/lib/foundation/errors";
+import { isAllowed } from "@/lib/services/moderation";
 import { rcon } from "@/lib/services/rcon";
 
 const MOTTO_MAX = 127;
@@ -16,7 +17,14 @@ const mottoSchema = z.object({
 		.max(MOTTO_MAX, `Motto must be at most ${MOTTO_MAX} characters`),
 });
 
+async function assertMottoAllowed(motto: string): Promise<void> {
+	if (!(await isAllowed(motto)).ok) {
+		throw new DatabaseError("Motto not allowed");
+	}
+}
+
 const updateMottoAction = authAction({ schema: mottoSchema }, async (ctx) => {
+	await assertMottoAllowed(ctx.data.motto);
 	try {
 		await db
 			.update(User)

src/actions/users.test.ts

@@ -62,6 +62,9 @@ vi.mock("@/lib/permissions", () => ({
 		USERS_BAN: "users.ban",
 		USERS_RESET_PASSWORD: "users.reset_password",
 	},
+	// Staff in the fixtures is rank 7 and the hotel's top rank is 10, so rank
+	// guards act as "below-your-own-rank only".
+	getHighestRank: vi.fn(() => Promise.resolve(10)),
 }));
 
 vi.mock("@/lib/safe-action", () => ({
@@ -77,6 +80,10 @@ vi.mock("@/lib/services/audit", () => ({
 	logAudit: vi.fn(),
 }));
 
+vi.mock("@/lib/auth/session-revocation", () => ({
+	revokeUserCredentials: vi.fn(() => Promise.resolve()),
+}));
+
 vi.mock("@/lib/services/webhook", () => ({
 	notify: vi.fn(),
 }));

src/actions/users.ts

@@ -3,8 +3,10 @@
 import crypto from "node:crypto";
 import { and, eq } from "drizzle-orm";
 import { z } from "zod";
+import { isDynamicSuperAdmin } from "@/lib/admin/authorization-policy";
 import { invalidateLoginCache } from "@/lib/auth";
 import { hashPassword } from "@/lib/auth/password";
+import { revokeUserCredentials } from "@/lib/auth/session-revocation";
 import {
 	Ban,
 	db,
@@ -13,7 +15,7 @@ import {
 	UsersCurrency,
 	UsersSettings,
 } from "@/lib/db";
-import { PERMS } from "@/lib/permissions";
+import { getHighestRank, PERMS } from "@/lib/permissions";
 import { adminAction } from "@/lib/safe-action";
 import { ActionError, actionOk } from "@/lib/safe-action-shared";
 import { logAudit } from "@/lib/services/audit";
@@ -54,8 +56,9 @@ export const createUser = adminAction(
 	{ permission: PERMS.USERS_EDIT, schema: createUserSchema },
 	async (ctx) => {
 		const { username, mail, password, rank, motto } = ctx.data;
-
-		if (rank >= ctx.session.user.rank && ctx.session.user.rank < 7) {
+		const actorRank = ctx.session.user.rank;
+		const highestRank = await getHighestRank();
+		if (rank >= actorRank && !isDynamicSuperAdmin(actorRank, highestRank)) {
 			throw new ActionError("Cannot assign rank equal or higher than your own");
 		}
 
@@ -130,7 +133,7 @@ export const updateUser = adminAction(
 		if (
 			userData.rank !== undefined &&
 			userData.rank >= ctx.session.user.rank &&
-			ctx.session.user.rank < 7
+			!isDynamicSuperAdmin(ctx.session.user.rank, await getHighestRank())
 		) {
 			throw new ActionError("Cannot assign rank equal or higher than your own");
 		}
@@ -144,7 +147,15 @@ export const updateUser = adminAction(
 			motto: string;
 			credits: number;
 			pixels: number;
+			mailVerified?: string;
 		}>;
+		// A changed address has to prove itself again: leaving mail_verified
+		// set would keep every mail send (resets, notifications) pointed at an
+		// inbox nobody confirmed, and would silently bypass the "verified
+		// accounts only" gate.
+		if (patch.mail !== undefined && patch.mail !== targetUser.mail) {
+			patch.mailVerified = "0";
+		}
 		if (Object.keys(patch).length > 0) {
 			await db.update(User).set(patch).where(eq(User.id, id));
 		}
@@ -331,7 +342,14 @@ async function guardRank(targetUserId: number, sessionRank: number) {
 		.where(eq(User.id, targetUserId))
 		.limit(1);
 	if (!target) throw new ActionError("User not found");
-	if (target.rank >= sessionRank && sessionRank < 7) {
+	// The owner is whoever holds the hotel's highest rank *today*. The old
+	// `sessionRank < 7` shortcut handed every rank-7 account owner powers on
+	// any hotel whose top rank is 8+, which makes it a plain escalation.
+	const highestRank = await getHighestRank();
+	if (
+		target.rank >= sessionRank &&
+		!isDynamicSuperAdmin(sessionRank, highestRank)
+	) {
 		throw new ActionError("Cannot modify user with equal or higher rank");
 	}
 	return target;
@@ -358,6 +376,9 @@ export const resetPassword = adminAction(
 			.update(User)
 			.set({ password: hashed })
 			.where(eq(User.id, ctx.data.userId));
+		// A staff-issued password must also end the user's live sessions: this
+		// action exists precisely for "account compromised" situations.
+		await revokeUserCredentials(ctx.data.userId);
 		invalidateLoginCache(target.username);
 
 		logAudit({
@@ -419,9 +440,19 @@ const alertUserSchema = z.object({
 export const alertUser = adminAction(
 	{ permission: PERMS.USERS_EDIT, schema: alertUserSchema },
 	async (ctx) => {
+		const target = await guardRank(ctx.data.userId, ctx.session.user.rank);
 		const success = await rcon.alertUser(ctx.data.userId, ctx.data.message);
 		if (!success)
 			throw new ActionError("Failed to send alert. Is the emulator running?");
+
+		logAudit({
+			userId: ctx.session.user.id,
+			action: "user_alert",
+			target: "User",
+			targetId: ctx.data.userId,
+			after: { message: ctx.data.message, username: target.username },
+		});
+
 		return actionOk();
 	},
 );

src/actions/verify.ts

@@ -36,6 +36,11 @@ export async function resendVerification(
 	if (!(await rateLimit(`verify:resend:${ip}`, 3, 10 * 60_000)).ok) {
 		return { ok: false, error: "rateLimited" };
 	}
+	// Same cooldown keyed on the address, so rotating IPs cannot be used to
+	// mail-bomb an arbitrary inbox with "verify your email".
+	if (!(await rateLimit(`verify:resend:email:${email}`, 3, 10 * 60_000)).ok) {
+		return { ok: false, error: "rateLimited" };
+	}
 
 	try {
 		const [user] = await db

src/app/(site)/apply/staff/page.tsx

@@ -110,7 +110,7 @@ export default async function ApplyStaffPage({
 	const appliedRankIds = new Set(myApps.map((a) => a.rankId));
 
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			{submitted === "1" ? (
 				<div role="status" style={feedbackStyle("success")}>
 					{t("success.submitted")}
@@ -233,6 +233,6 @@ export default async function ApplyStaffPage({
 					})}
 				</div>
 			)}
-		</main>
+		</section>
 	);
 }

src/app/(site)/apply/team/page.tsx

@@ -89,7 +89,7 @@ export default async function ApplyTeamPage({
 	const appliedTeamIds = new Set(myApps.map((a) => a.rankId));
 
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			{submitted === "1" ? (
 				<div role="status" style={feedbackStyle("success")}>
 					{t("success.submitted")}
@@ -199,6 +199,6 @@ export default async function ApplyTeamPage({
 					})}
 				</div>
 			)}
-		</main>
+		</section>
 	);
 }

src/app/(site)/badges/page.tsx

@@ -30,7 +30,7 @@ export default async function BadgesPage() {
 		.catch(() => []);
 
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			<ContentCard icon="🏅" title={t("title")} subtitle={t("subtitle")} />
 
 			<ContentCard padded={badges.length === 0}>
@@ -76,6 +76,6 @@ export default async function BadgesPage() {
 					</div>
 				)}
 			</ContentCard>
-		</main>
+		</section>
 	);
 }

src/app/(site)/banned/page.tsx

@@ -52,7 +52,7 @@ export default async function BannedPage() {
 				});
 
 	return (
-		<main style={{ maxWidth: 560, margin: "2rem auto" }}>
+		<section style={{ maxWidth: 560, margin: "2rem auto" }}>
 			<ContentCard icon="🚫" title={t("title")} subtitle={t("subtitle")}>
 				<p style={{ marginTop: 0 }}>{t("body")}</p>
 				{reason ? (
@@ -65,6 +65,6 @@ export default async function BannedPage() {
 					{t("contactStaff")}
 				</p>
 			</ContentCard>
-		</main>
+		</section>
 	);
 }

src/app/(site)/community/page.tsx

@@ -54,7 +54,7 @@ export default function CommunityPage() {
 	const t = useTranslations("pages.community");
 
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			<ContentCard icon="🌍" title={t("title")} subtitle={t("subtitle")} />
 
 			<div className="card-grid sm-2 lg-3">
@@ -84,6 +84,6 @@ export default function CommunityPage() {
 					</Link>
 				))}
 			</div>
-		</main>
+		</section>
 	);
 }

src/app/(site)/developers/page.tsx

@@ -398,7 +398,7 @@ export default function DevelopersPage() {
 	const totalEndpoints = GROUPS.reduce((n, g) => n + g.endpoints.length, 0);
 
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			<ContentCard
 				icon="🧩"
 				title="Developer API"
@@ -479,6 +479,6 @@ export default function DevelopersPage() {
 					</div>
 				</ContentCard>
 			))}
-		</main>
+		</section>
 	);
 }

src/app/(site)/draw-badge/page.tsx

@@ -102,7 +102,7 @@ export default async function DrawBadgePage({
 	}
 
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			<ContentCard
 				icon="🎨"
 				title="Draw a Badge"
@@ -231,6 +231,6 @@ export default async function DrawBadgePage({
 					</div>
 				)}
 			</ContentCard>
-		</main>
+		</section>
 	);
 }

src/app/(site)/events/[slugOrId]/page.tsx

@@ -142,7 +142,7 @@ export default async function EventDetailPage({
 	else if (isFull) disabledReason = t("eventFull");
 
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			<p className="muted" style={{ margin: 0 }}>
 				<Link href="/events">{t("back")}</Link>
 			</p>
@@ -259,6 +259,6 @@ export default async function EventDetailPage({
 					</ul>
 				</ContentCard>
 			) : null}
-		</main>
+		</section>
 	);
 }

src/app/(site)/events/page.tsx

@@ -69,7 +69,7 @@ async function EventsPage({
 	const href = (page: number) =>
 		`/events?${new URLSearchParams({ status: result?.status ?? "all", week: result?.week ?? "", mine: params.mine ?? "", page: String(page) })}`;
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			<ContentCard icon="📅" title={t("title")} subtitle={t("subtitle")} />
 
 			<ContentCard>
@@ -272,7 +272,7 @@ async function EventsPage({
 					</nav>
 				</ContentCard>
 			)}
-		</main>
+		</section>
 	);
 }
 

src/app/(site)/forgot/page.tsx

@@ -1,3 +1,4 @@
+import type { Metadata } from "next";
 import { headers } from "next/headers";
 import { getTranslations } from "next-intl/server";
 import { requestReset } from "@/actions/password-reset";
@@ -6,6 +7,15 @@ import Link from "@/components/link";
 import { ContentCard } from "@/components/public/ui";
 import { captchaConfig } from "@/lib/services/captcha";
 
+export async function generateMetadata(): Promise<Metadata> {
+	const t = await getTranslations("pages.forgot");
+	return {
+		title: t("title"),
+		description: t("subtitle"),
+		robots: { index: false, follow: false },
+	};
+}
+
 export default async function ForgotPage({
 	searchParams,
 }: {
@@ -17,12 +27,39 @@ export default async function ForgotPage({
 	const nonce = (await headers()).get("x-nonce") ?? undefined;
 
 	return (
-		<main style={{ maxWidth: 420, margin: "2rem auto" }}>
+		<section style={{ maxWidth: 420, margin: "2rem auto" }}>
 			<ContentCard icon="🔑" title={t("title")} subtitle={t("subtitle")}>
 				{sent ? (
-					<p className="muted" style={{ textAlign: "center", margin: 0 }}>
-						{t("sentNotice")}
-					</p>
+					<>
+						<p className="muted" style={{ textAlign: "center", margin: 0 }}>
+							{t("sentNotice")}
+						</p>
+						{/* A mail that never arrived must be retryable from here,
+						    otherwise the visitor is stuck on a dead end. */}
+						<form
+							action={requestReset}
+							style={{ display: "grid", gap: "0.7rem", marginTop: "1rem" }}
+						>
+							<input
+								name="email"
+								type="email"
+								placeholder={t("emailPlaceholder")}
+								autoComplete="email"
+								required
+							/>
+							<CaptchaWidget
+								captcha={{
+									provider: cfg.provider,
+									siteKey: cfg.siteKey || undefined,
+									field: cfg.field || undefined,
+								}}
+								nonce={nonce}
+							/>
+							<button type="submit" className="btn btn-primary">
+								{t("sendAnotherLink")}
+							</button>
+						</form>
+					</>
 				) : (
 					<form
 						action={requestReset}
@@ -66,6 +103,6 @@ export default async function ForgotPage({
 					<Link href="/login">{t("backToLogin")}</Link>
 				</p>
 			</ContentCard>
-		</main>
+		</section>
 	);
 }

src/app/(site)/friends/page.tsx

@@ -102,7 +102,7 @@ export default async function FriendsPage({
 					: null;
 
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			{removed === "1" ? (
 				<div role="status" style={feedbackStyle("success")}>
 					{t("success.removed")}
@@ -180,6 +180,6 @@ export default async function FriendsPage({
 					</div>
 				)}
 			</ContentCard>
-		</main>
+		</section>
 	);
 }

src/app/(site)/guilds/[id]/forum/[threadId]/page.tsx

@@ -103,11 +103,11 @@ export default async function GuildForumThreadPage({
 	} catch (error) {
 		publicReadFailure("guild.thread")(error);
 		return (
-			<main className="page-grid">
+			<section className="page-grid">
 				<ContentCard>
 					<PublicLoadError href={`/guilds/${guildId}/forum/${threadId}`} />
 				</ContentCard>
-			</main>
+			</section>
 		);
 	}
 
@@ -173,7 +173,7 @@ export default async function GuildForumThreadPage({
 							: null;
 
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			{replied === "1" ? (
 				<div role="status" style={feedbackStyle("success")}>
 					{t("success.replied")}
@@ -317,6 +317,6 @@ export default async function GuildForumThreadPage({
 					{t("loginToReply")} <Link href="/login">{t("loginLink")}</Link>
 				</p>
 			)}
-		</main>
+		</section>
 	);
 }

src/app/(site)/guilds/[id]/forum/new/page.tsx

@@ -70,7 +70,7 @@ export default async function NewThreadPage({
 						: null;
 
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			{errorMessage ? (
 				<div role="alert" style={feedbackStyle("error")}>
 					{errorMessage}
@@ -132,6 +132,6 @@ export default async function NewThreadPage({
 					</div>
 				</form>
 			</ContentCard>
-		</main>
+		</section>
 	);
 }

src/app/(site)/guilds/[id]/forum/page.tsx

@@ -67,11 +67,11 @@ export default async function GuildForumPage({
 	} catch (error) {
 		publicReadFailure("guild.forum")(error);
 		return (
-			<main className="page-grid">
+			<section className="page-grid">
 				<ContentCard>
 					<PublicLoadError href={`/guilds/${guildId}/forum`} />
 				</ContentCard>
-			</main>
+			</section>
 		);
 	}
 
@@ -135,7 +135,7 @@ export default async function GuildForumPage({
 	const usernameById = new Map(users.map((u) => [u.id, u.username]));
 
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			{posted === "1" ? (
 				<div role="status" style={feedbackStyle("success")}>
 					{t("success.posted")}
@@ -240,6 +240,6 @@ export default async function GuildForumPage({
 					</table>
 				)}
 			</ContentCard>
-		</main>
+		</section>
 	);
 }

src/app/(site)/guilds/[id]/page.tsx

@@ -55,11 +55,11 @@ export default async function GuildPage({
 	} catch (error) {
 		publicReadFailure("guild.detail")(error);
 		return (
-			<main className="page-grid">
+			<section className="page-grid">
 				<ContentCard>
 					<PublicLoadError href={`/guilds/${guildId}`} />
 				</ContentCard>
-			</main>
+			</section>
 		);
 	}
 
@@ -139,7 +139,7 @@ export default async function GuildPage({
 	const created = formatDate(new Date(guild.dateCreated * 1000), "date");
 
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			<p style={{ margin: 0 }}>
 				<Link href="/guilds">{t("allGuilds")}</Link>
 			</p>
@@ -251,6 +251,6 @@ export default async function GuildPage({
 					</div>
 				)}
 			</ContentCard>
-		</main>
+		</section>
 	);
 }

src/app/(site)/guilds/page.tsx

@@ -50,7 +50,7 @@ export default async function GuildsPage() {
 	const guilds = await getGuilds();
 
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			<ContentCard icon="🚪" title={t("title")} subtitle={t("subtitle")} />
 
 			<ContentCard padded={!guilds?.length}>
@@ -98,6 +98,6 @@ export default async function GuildsPage() {
 					</div>
 				)}
 			</ContentCard>
-		</main>
+		</section>
 	);
 }

src/app/(site)/help/[category]/page.tsx

@@ -103,7 +103,7 @@ export default async function HelpCategoryPage({
 	const hasButton = Boolean(cat.buttonText && cat.buttonText.trim() !== "");
 
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			<p style={{ margin: 0 }}>
 				<Link href="/help">{t("back")}</Link>
 			</p>
@@ -162,6 +162,6 @@ export default async function HelpCategoryPage({
 					</div>
 				</ContentCard>
 			) : null}
-		</main>
+		</section>
 	);
 }

src/app/(site)/help/page.tsx

@@ -127,7 +127,7 @@ export default async function HelpCenterPage() {
 	}
 
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			<ContentCard
 				icon="❓"
 				title={t("title")}
@@ -278,6 +278,6 @@ export default async function HelpCenterPage() {
 					</div>
 				)}
 			</ContentCard>
-		</main>
+		</section>
 	);
 }

src/app/(site)/help/tickets/[id]/page.tsx

@@ -157,7 +157,7 @@ export default async function HelpTicketDetailPage({
 	];
 
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			{replied === "1" ? (
 				<div role="status" style={feedbackStyle("success")}>
 					{t("success.replied")}
@@ -302,6 +302,6 @@ export default async function HelpTicketDetailPage({
 					{t("closedHint")}
 				</p>
 			)}
-		</main>
+		</section>
 	);
 }

src/app/(site)/help/tickets/page.tsx

@@ -67,7 +67,7 @@ export default async function HelpTicketsPage({
 						: null;
 
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			{created === "1" ? (
 				<div role="status" style={feedbackStyle("success")}>
 					{t("success.created")}
@@ -167,6 +167,6 @@ export default async function HelpTicketsPage({
 					</table>
 				)}
 			</ContentCard>
-		</main>
+		</section>
 	);
 }

src/app/(site)/layout.tsx

@@ -31,19 +31,18 @@ export default async function SiteLayout({
 	return (
 		<>
 			<CloudsField />
-			{session?.user?.id ? (
-				<>
-					<div data-theme-block="top_header">
-						<TopHeader session={session} />
-					</div>
-					<div data-theme-block="site_header">
-						<SiteHeader />
-					</div>
-					<div data-theme-block="navigation">
-						<Navigation session={session} />
-					</div>
-				</>
-			) : null}
+			{/* Site chrome is public: hiding it all for anonymous visitors used to
+			    strand them — from /news, /leaderboard or /shop there was no way to
+			    reach any other page at all. */}
+			<div data-theme-block="top_header">
+				<TopHeader session={session} />
+			</div>
+			<div data-theme-block="site_header">
+				<SiteHeader />
+			</div>
+			<div data-theme-block="navigation">
+				<Navigation session={session} />
+			</div>
 			<main>
 				<div
 					data-theme-block="content_grid"

src/app/(site)/leaderboard/page.tsx

@@ -10,6 +10,7 @@ import {
 import { UserAvatarThumbnail } from "@/components/shared/user-avatar-thumbnail";
 import { cached } from "@/lib/cache";
 import { db, User, UsersCurrency, UsersSettings } from "@/lib/db";
+import { loadProfilePrivacyMap } from "@/lib/services/profile-privacy";
 
 export async function generateMetadata(): Promise<Metadata> {
 	const t = await getTranslations("pages.leaderboard");
@@ -52,7 +53,17 @@ function formatValue(key: TabKey, value: number): string {
 	return value.toLocaleString();
 }
 
-type Row = { username: string; look: string; value: number };
+type Row = { userId: number; username: string; look: string; value: number };
+
+/**
+ * Users who hid their wallet must not appear in the currency tabs: the profile
+ * page already honours that, and a leaderboard that ignores it makes the
+ * setting meaningless.
+ */
+async function withoutHiddenWallets(rows: Row[]): Promise<Row[]> {
+	const privacy = await loadProfilePrivacyMap(rows.map((r) => r.userId));
+	return rows.filter((r) => privacy.get(r.userId)?.wallet !== false);
+}
 
 async function loadCreditsRows(): Promise<Row[]> {
 	try {
@@ -62,6 +73,7 @@ async function loadCreditsRows(): Promise<Row[]> {
 			() =>
 				db
 					.select({
+						id: User.id,
 						username: User.username,
 						look: User.look,
 						credits: User.credits,
@@ -71,11 +83,14 @@ async function loadCreditsRows(): Promise<Row[]> {
 					.limit(20),
 			{ staleMs: 120000 },
 		);
-		return users.map((u) => ({
-			username: u.username,
-			look: u.look,
-			value: u.credits,
-		}));
+		return await withoutHiddenWallets(
+			users.map((u) => ({
+				userId: u.id,
+				username: u.username,
+				look: u.look,
+				value: u.credits,
+			})),
+		);
 	} catch {
 		return [];
 	}
@@ -89,6 +104,7 @@ async function loadCurrencyRows(type: number): Promise<Row[]> {
 			() =>
 				db
 					.select({
+						userId: User.id,
 						username: User.username,
 						look: User.look,
 						value: UsersCurrency.amount,
@@ -99,7 +115,7 @@ async function loadCurrencyRows(type: number): Promise<Row[]> {
 					.orderBy(desc(UsersCurrency.amount))
 					.limit(20),
 			{ staleMs: 120000 },
-		);
+		).then(withoutHiddenWallets);
 	} catch {
 		return [];
 	}
@@ -116,6 +132,7 @@ async function loadSettingsRows(
 			() =>
 				db
 					.select({
+						userId: User.id,
 						username: User.username,
 						look: User.look,
 						value: column,
@@ -166,7 +183,7 @@ export default async function LeaderboardPage({
 			: null;
 
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			<ContentCard
 				icon="📊"
 				title={t("title")}
@@ -245,6 +262,6 @@ export default async function LeaderboardPage({
 					</div>
 				)}
 			</ContentCard>
-		</main>
+		</section>
 	);
 }

src/app/(site)/login/page.tsx

@@ -1,4 +1,4 @@
-import { count, desc, eq } from "drizzle-orm";
+import { desc, eq } from "drizzle-orm";
 import type { Metadata } from "next";
 import { headers } from "next/headers";
 import Image from "next/image";
@@ -13,9 +13,11 @@ import { SurfaceCard } from "@/components/surface-card";
 import { auth } from "@/lib/auth";
 import { safeRedirectPath } from "@/lib/auth/safe-redirect";
 import { cached } from "@/lib/cache";
+
 import { db, User } from "@/lib/db";
 import { resolveHotelName } from "@/lib/hotel-name";
 import { captchaConfig } from "@/lib/services/captcha";
+import { cachedOnlineCount } from "@/lib/services/public-counters";
 import { siteSettings } from "@/lib/services/site-settings";
 
 export async function generateMetadata(): Promise<Metadata> {
@@ -34,7 +36,11 @@ export async function generateMetadata(): Promise<Metadata> {
 export default async function LoginPage({
 	searchParams,
 }: {
-	searchParams: Promise<{ from?: string; registered?: string }>;
+	searchParams: Promise<{
+		from?: string;
+		registered?: string;
+		reset?: string;
+	}>;
 }) {
 	const t = await getTranslations("pages.login");
 	const [hotelName, cfg, logo] = await Promise.all([
@@ -53,19 +59,13 @@ export default async function LoginPage({
 	if (session?.user?.id) redirect(redirectTo);
 
 	const [online, recentUsers, latestUsers] = await Promise.all([
-		cached("online_count", 10_000, () =>
-			db
-				.select({ total: count() })
-				.from(User)
-				.where(eq(User.online, "1"))
-				.then((rows) => rows[0]?.total ?? 0),
-		).catch(() => 0),
+		cachedOnlineCount().catch(() => 0),
 		cached(
 			"auth_online_users",
 			10_000,
 			() =>
 				db
-					.select({ username: User.username, look: User.look })
+					.select({ id: User.id, username: User.username, look: User.look })
 					.from(User)
 					.where(eq(User.online, "1"))
 					.limit(8),
@@ -76,7 +76,7 @@ export default async function LoginPage({
 			30_000,
 			() =>
 				db
-					.select({ username: User.username, look: User.look })
+					.select({ id: User.id, username: User.username, look: User.look })
 					.from(User)
 					.orderBy(desc(User.accountCreated))
 					.limit(8),
@@ -96,6 +96,16 @@ export default async function LoginPage({
 			>
 				{t("registeredSuccess")}
 			</p>
+		) : sp.reset === "1" ? (
+			// `?reset=1` comes from a successful password reset; saying so matters
+			// because the visitor just changed their password and a silent form
+			// reads like the reset failed.
+			<p
+				role="status"
+				className="auth-alert auth-alert--success animate-fade-in-up m-0 mb-4"
+			>
+				{t("passwordChanged")}
+			</p>
 		) : undefined;
 
 	return (

src/app/(site)/logo/page.tsx

@@ -30,7 +30,7 @@ export default async function LogoPage() {
 			),
 	);
 	return (
-		<main
+		<section
 			style={{
 				display: "grid",
 				gap: "1.5rem",
@@ -45,6 +45,6 @@ export default async function LogoPage() {
 			/>
 
 			<LogoGenerator initialText={initialText} canSaveToSite={canSaveToSite} />
-		</main>
+		</section>
 	);
 }

src/app/(site)/maintenance/page.tsx

@@ -14,7 +14,7 @@ export default async function MaintenancePage() {
 	]);
 
 	return (
-		<main style={{ maxWidth: 560, margin: "2rem auto" }}>
+		<section style={{ maxWidth: 560, margin: "2rem auto" }}>
 			<ContentCard
 				icon="🛠️"
 				title={t("title", { hotel })}
@@ -25,6 +25,6 @@ export default async function MaintenancePage() {
 					{t("staffCanLogIn")}
 				</p>
 			</ContentCard>
-		</main>
+		</section>
 	);
 }

src/app/(site)/marketplace/page.tsx

@@ -82,7 +82,7 @@ export default async function MarketplacePage() {
 	const total = offers.reduce((sum, o) => sum + o.price, 0);
 
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			<ContentCard icon="🛍️" title={t("title")} subtitle={t("subtitle")}>
 				<div className="stat-grid">
 					<StatBlock
@@ -148,6 +148,6 @@ export default async function MarketplacePage() {
 					</div>
 				)}
 			</ContentCard>
-		</main>
+		</section>
 	);
 }

src/app/(site)/me/page.tsx

@@ -47,14 +47,14 @@ async function MePage({
 		data = await loadUserDashboard(userId);
 	} catch {
 		return (
-			<main>
+			<section>
 				<SurfaceCard className="p-6">
 					<p role="alert">{t("loadError")}</p>
 					<Link href="/me" className="btn btn-outline">
 						{t("retry")}
 					</Link>
 				</SurfaceCard>
-			</main>
+			</section>
 		);
 	}
 	// Daily reward state (settings + schedule + the user's last claim). Never
@@ -63,14 +63,14 @@ async function MePage({
 	const user = data.userRows[0];
 	if (!user)
 		return (
-			<main>
+			<section>
 				<SurfaceCard className="p-6">
 					<p role="alert">{t("loadError")}</p>
 					<Link href="/login" className="btn btn-outline">
 						{t("login")}
 					</Link>
 				</SurfaceCard>
-			</main>
+			</section>
 		);
 	const {
 		hotelName,
@@ -145,7 +145,7 @@ async function MePage({
 			? error
 			: "error";
 	return (
-		<main className={styles.dashboard}>
+		<section className={styles.dashboard}>
 			{claimed && (
 				<p role="status" className={styles.feedback}>
 					{t("claimed")}
@@ -181,6 +181,8 @@ async function MePage({
 					width={100}
 					height={140}
 					className={styles.avatar}
+					loading="eager"
+					fetchPriority="high"
 				/>
 				<div className={styles.identity}>
 					<p className="muted">{t("welcome", { hotel: hotelName })}</p>
@@ -469,7 +471,7 @@ async function MePage({
 					</SurfaceCard>
 				</aside>
 			</div>
-		</main>
+		</section>
 	);
 }
 

src/app/(site)/messages/page.tsx

@@ -177,7 +177,7 @@ export default async function MessagesPage({
 							: null;
 
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			{accepted === "1" ? (
 				<div role="status" style={feedbackStyle("success")}>
 					{t("success.accepted")}
@@ -391,6 +391,6 @@ export default async function MessagesPage({
 					</div>
 				)}
 			</ContentCard>
-		</main>
+		</section>
 	);
 }

src/app/(site)/news/[...slug]/page.tsx

@@ -94,7 +94,7 @@ async function ArticlePage({
 	} catch {
 		logger.error("Public article lookup failed", { module: "news" });
 		return (
-			<main className="page-grid">
+			<section className="page-grid">
 				<ContentCard icon="📰" title={t("loadError")}>
 					<p role="alert">{t("loadError")}</p>
 					<a
@@ -104,7 +104,7 @@ async function ArticlePage({
 						{t("retry")}
 					</a>
 				</ContentCard>
-			</main>
+			</section>
 		);
 	}
 	if (!article) notFound();
@@ -159,7 +159,7 @@ async function ArticlePage({
 								: null;
 
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			{comment === "posted" ? (
 				<div role="status" style={feedbackStyle("success")}>
 					{t("success.posted")}
@@ -196,7 +196,16 @@ async function ArticlePage({
 						src={article.image}
 						alt=""
 						decoding="async"
-						style={{ width: "100%", borderRadius: 10, margin: "0 0 1rem" }}
+						loading="eager"
+						// Reserve the box: an unbounded hero image shifts the whole
+						// article down once the bitmap decodes.
+						style={{
+							width: "100%",
+							aspectRatio: "16 / 9",
+							objectFit: "cover",
+							borderRadius: 10,
+							margin: "0 0 1rem",
+						}}
 					/>
 				) : null}
 				{/* Article body is rich HTML (atom uses TinyMCE) — sanitised server-side. */}
@@ -414,7 +423,7 @@ async function ArticlePage({
 					)}
 				</ContentCard>
 			</section>
-		</main>
+		</section>
 	);
 }
 

src/app/(site)/news/page.tsx

@@ -31,7 +31,7 @@ async function NewsPage({
 		`/news?${new URLSearchParams({ q: result?.search ?? params.q ?? "", order: result?.order ?? "newest", page: String(page) })}`;
 
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			<ContentCard icon="📰" title={t("title")} subtitle={t("subtitle")} />
 
 			<ContentCard>
@@ -186,7 +186,7 @@ async function NewsPage({
 					</nav>
 				</ContentCard>
 			)}
-		</main>
+		</section>
 	);
 }
 

src/app/(site)/page.tsx

@@ -1,4 +1,4 @@
-import { count, desc, eq } from "drizzle-orm";
+import { desc, eq } from "drizzle-orm";
 import { ArrowRight, ChevronDown } from "lucide-react";
 import type { Metadata } from "next";
 import { headers } from "next/headers";
@@ -25,7 +25,9 @@ import { formatDate } from "@/lib/format-date";
 import { resolveHotelName } from "@/lib/hotel-name";
 import { captchaConfig } from "@/lib/services/captcha";
 import { getNewsList } from "@/lib/services/news-list";
+import { loadProfilePrivacyMap } from "@/lib/services/profile-privacy";
 import {
+	cachedOnlineCount,
 	countArticles,
 	countPhotos,
 	countRooms,
@@ -183,13 +185,7 @@ async function getHotelData() {
 		recentUsers,
 		recentPhotos,
 	] = await Promise.all([
-		cached("online_count", 10_000, () =>
-			db
-				.select({ total: count() })
-				.from(User)
-				.where(eq(User.online, "1"))
-				.then((rows) => rows[0]?.total ?? 0),
-		).catch(publicReadFailure("home.online")),
+		cachedOnlineCount().catch(publicReadFailure("home.online")),
 		cached("total_users", 300_000, countUsers, { staleMs: 300000 }).catch(
 			publicReadFailure("home.users"),
 		),
@@ -210,7 +206,7 @@ async function getHotelData() {
 			15_000,
 			() =>
 				db
-					.select({ username: User.username, look: User.look })
+					.select({ id: User.id, username: User.username, look: User.look })
 					.from(User)
 					.where(eq(User.online, "1"))
 					.limit(12),
@@ -259,11 +255,22 @@ export default async function Home() {
 		totalPhotos,
 		articleCount,
 		articles,
-		recentUsers,
+		recentUsers: rawRecentUsers,
 		recentPhotos,
 		logo,
 	} = await getHotelData();
 
+	// Users who hide their online state must not surface in the "who is online"
+	// rails on the homepage either.
+	const recentUserPrivacy = await loadProfilePrivacyMap(
+		(rawRecentUsers ?? []).map((u) => u.id),
+	);
+	const recentUsers =
+		rawRecentUsers === null
+			? null
+			: rawRecentUsers.filter(
+					(u) => recentUserPrivacy.get(u.id)?.online !== false,
+				);
 	const captcha = await captchaConfig();
 	const nonce = (await headers()).get("x-nonce") ?? undefined;
 

src/app/(site)/photos/page.tsx

@@ -10,6 +10,7 @@ import { ContentCard, EmptyState } from "@/components/public/ui";
 import { cached } from "@/lib/cache";
 import { CameraWeb, db } from "@/lib/db";
 import { formatDate } from "@/lib/format-date";
+import { loadProfilePrivacyMap } from "@/lib/services/profile-privacy";
 import { publicReadFailure } from "@/lib/services/public-read";
 
 export async function generateMetadata(): Promise<Metadata> {
@@ -53,9 +54,16 @@ export default async function PhotosPage() {
 		photos = publicReadFailure("photos")(error);
 	}
 
+	// Users can hide their photos everywhere, not only on their profile.
+	const photoOwners = [...new Set((photos ?? []).map((p) => p.userId))];
+	const photoPrivacy = await loadProfilePrivacyMap(photoOwners);
+	const visiblePhotos = (photos ?? []).filter(
+		(p) => photoPrivacy.get(p.userId)?.photos !== false,
+	);
+
 	// Pre-shape for the client lightbox: translate captions server-side so the
 	// client component stays free of i18n/db dependencies.
-	const items: LightboxPhoto[] = (photos ?? []).map((p) => ({
+	const items: LightboxPhoto[] = visiblePhotos.map((p) => ({
 		id: String(p.id),
 		url: p.url,
 		alt: t("photoAlt", { id: p.userId }),
@@ -64,7 +72,7 @@ export default async function PhotosPage() {
 	}));
 
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			<ContentCard icon="📸" title={t("title")} subtitle={t("subtitle")} />
 
 			<ContentCard padded={items.length === 0}>
@@ -76,6 +84,6 @@ export default async function PhotosPage() {
 					<PhotoLightbox photos={items} />
 				)}
 			</ContentCard>
-		</main>
+		</section>
 	);
 }

src/app/(site)/polls/[id]/page.tsx

@@ -96,7 +96,7 @@ export default async function PollDetailPage({
 	}
 
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			<p className="muted" style={{ margin: 0 }}>
 				<Link href="/polls">{t("back")}</Link>
 			</p>
@@ -248,6 +248,6 @@ export default async function PollDetailPage({
 					</div>
 				</ContentCard>
 			) : null}
-		</main>
+		</section>
 	);
 }

src/app/(site)/polls/page.tsx

@@ -60,7 +60,7 @@ export default async function PollsPage() {
 	}));
 
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			<ContentCard icon="📊" title={t("title")} subtitle={t("subtitle")} />
 
 			<ContentCard padded={polls.length === 0}>
@@ -122,6 +122,6 @@ export default async function PollsPage() {
 					</div>
 				)}
 			</ContentCard>
-		</main>
+		</section>
 	);
 }

src/app/(site)/radio/apply/page.tsx

@@ -65,7 +65,7 @@ export default async function RadioApplyPage({
 		: null;
 
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			{submitted === "1" ? (
 				<div role="status" style={feedbackStyle("success")}>
 					{t("success.submitted")}
@@ -199,6 +199,6 @@ export default async function RadioApplyPage({
 					</button>
 				</form>
 			</ContentCard>
-		</main>
+		</section>
 	);
 }

src/app/(site)/radio/contests/[id]/page.tsx

@@ -33,7 +33,7 @@ export default async function RadioContestDetailPage({
 	const active = contest.isActive ? "Active" : "Ended";
 
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			<p className="muted" style={{ margin: 0 }}>
 				<Link href="/radio/contests">← Back to contests</Link>
 			</p>
@@ -90,6 +90,6 @@ export default async function RadioContestDetailPage({
 					</tbody>
 				</table>
 			</ContentCard>
-		</main>
+		</section>
 	);
 }

src/app/(site)/radio/contests/page.tsx

@@ -23,7 +23,7 @@ export default async function RadioContestsPage() {
 		.catch(() => []);
 
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			<ContentCard icon="🎉" title={t("title")} subtitle={t("subtitle")} />
 
 			<ContentCard padded={contests.length === 0}>
@@ -71,6 +71,6 @@ export default async function RadioContestsPage() {
 					</div>
 				)}
 			</ContentCard>
-		</main>
+		</section>
 	);
 }

src/app/(site)/radio/giveaways/[id]/page.tsx

@@ -38,7 +38,7 @@ export default async function RadioGiveawayDetailPage({
 			: null);
 
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			<p className="muted" style={{ margin: 0 }}>
 				<Link href="/radio/giveaways">← Back to giveaways</Link>
 			</p>
@@ -95,6 +95,6 @@ export default async function RadioGiveawayDetailPage({
 					</tbody>
 				</table>
 			</ContentCard>
-		</main>
+		</section>
 	);
 }

src/app/(site)/radio/giveaways/page.tsx

@@ -25,7 +25,7 @@ export default async function RadioGiveawaysPage() {
 		.catch(() => []);
 
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			<ContentCard icon="🎁" title={t("title")} subtitle={t("subtitle")} />
 
 			<ContentCard padded={giveaways.length === 0}>
@@ -78,6 +78,6 @@ export default async function RadioGiveawaysPage() {
 					</div>
 				)}
 			</ContentCard>
-		</main>
+		</section>
 	);
 }

src/app/(site)/radio/leaderboard/page.tsx

@@ -38,7 +38,7 @@ export default async function RadioLeaderboardPage() {
 	const rows = await loadRows();
 
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			<ContentCard icon="🏆" title={t("title")} subtitle={t("subtitle")} />
 
 			<ContentCard padded={rows.length === 0}>
@@ -85,6 +85,6 @@ export default async function RadioLeaderboardPage() {
 					</table>
 				)}
 			</ContentCard>
-		</main>
+		</section>
 	);
 }

src/app/(site)/radio/page.tsx

@@ -120,7 +120,7 @@ export default async function RadioPage() {
 	const isLive = Boolean(streamUrl);
 
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			{/* ── Header: live stream + now playing ─────────────────────── */}
 			<ContentCard
 				icon="📻"
@@ -262,6 +262,6 @@ export default async function RadioPage() {
 					</table>
 				)}
 			</ContentCard>
-		</main>
+		</section>
 	);
 }

src/app/(site)/radio/schedule/page.tsx

@@ -74,7 +74,7 @@ export default async function RadioSchedulePage() {
 	const hasAny = schedules.length > 0;
 
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			<ContentCard icon="🗓️" title={t("title")} subtitle={t("subtitle")} />
 
 			<ContentCard padded={!hasAny}>
@@ -126,6 +126,6 @@ export default async function RadioSchedulePage() {
 					</table>
 				)}
 			</ContentCard>
-		</main>
+		</section>
 	);
 }

src/app/(site)/radio/shouts/page.tsx

@@ -73,7 +73,7 @@ export default async function RadioShoutsPage({
 						: null;
 
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			{posted === "1" ? (
 				<div role="status" style={feedbackStyle("success")}>
 					{t("success.posted")}
@@ -166,6 +166,6 @@ export default async function RadioShoutsPage({
 					</div>
 				)}
 			</ContentCard>
-		</main>
+		</section>
 	);
 }

src/app/(site)/rankings/page.tsx

@@ -62,7 +62,7 @@ export default async function RankingsPage() {
 	}
 
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			<ContentCard icon="🏆" title={t("title")} subtitle={t("subtitle")} />
 
 			<ContentCard padded={!users?.length}>
@@ -104,6 +104,6 @@ export default async function RankingsPage() {
 					</div>
 				)}
 			</ContentCard>
-		</main>
+		</section>
 	);
 }

src/app/(site)/rares/[category]/page.tsx

@@ -96,7 +96,7 @@ export default async function RareCategoryPage({
 		badgeBase && cat.badge ? `${badgeBase}/${cat.badge}.gif` : "";
 
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			<ContentCard
 				icon={badgeSrc ? undefined : "💎"}
 				title={
@@ -194,6 +194,6 @@ export default async function RareCategoryPage({
 					</div>
 				)}
 			</ContentCard>
-		</main>
+		</section>
 	);
 }

src/app/(site)/rares/page.tsx

@@ -65,7 +65,7 @@ export default async function RareValuesPage() {
 	}
 
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			<ContentCard icon="💎" title={t("title")} subtitle={t("subtitle")} />
 
 			{categories.length === 0 ? (
@@ -116,6 +116,6 @@ export default async function RareValuesPage() {
 					})}
 				</div>
 			)}
-		</main>
+		</section>
 	);
 }

src/app/(site)/redeem/page.tsx

@@ -29,7 +29,7 @@ export default async function RedeemPage() {
 	if (!user) redirect("/login");
 
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			<ContentCard icon="🎟️" title={t("title")} subtitle={t("subtitle")} />
 
 			<div className="card-grid sm-2">
@@ -63,6 +63,6 @@ export default async function RedeemPage() {
 					</p>
 				</ContentCard>
 			</div>
-		</main>
+		</section>
 	);
 }

src/app/(site)/register/page.tsx

@@ -1,4 +1,4 @@
-import { count, desc, eq } from "drizzle-orm";
+import { desc, eq } from "drizzle-orm";
 import type { Metadata } from "next";
 import { headers } from "next/headers";
 import Image from "next/image";
@@ -12,9 +12,11 @@ import { RegisterForm } from "@/components/auth/register-form";
 import { SurfaceCard } from "@/components/surface-card";
 import { auth } from "@/lib/auth";
 import { cached } from "@/lib/cache";
+
 import { db, User } from "@/lib/db";
 import { resolveHotelName } from "@/lib/hotel-name";
 import { captchaConfig } from "@/lib/services/captcha";
+import { cachedOnlineCount } from "@/lib/services/public-counters";
 import { siteSettings } from "@/lib/services/site-settings";
 
 export async function generateMetadata(): Promise<Metadata> {
@@ -42,19 +44,13 @@ export default async function RegisterPage() {
 	if (session?.user?.id) redirect("/me");
 
 	const [online, recentUsers, latestUsers] = await Promise.all([
-		cached("online_count", 10_000, () =>
-			db
-				.select({ total: count() })
-				.from(User)
-				.where(eq(User.online, "1"))
-				.then((rows) => rows[0]?.total ?? 0),
-		).catch(() => 0),
+		cachedOnlineCount().catch(() => 0),
 		cached(
 			"auth_online_users",
 			10_000,
 			() =>
 				db
-					.select({ username: User.username, look: User.look })
+					.select({ id: User.id, username: User.username, look: User.look })
 					.from(User)
 					.where(eq(User.online, "1"))
 					.limit(8),
@@ -65,7 +61,7 @@ export default async function RegisterPage() {
 			30_000,
 			() =>
 				db
-					.select({ username: User.username, look: User.look })
+					.select({ id: User.id, username: User.username, look: User.look })
 					.from(User)
 					.orderBy(desc(User.accountCreated))
 					.limit(8),

src/app/(site)/reset/page.tsx

@@ -1,8 +1,26 @@
+import type { Metadata } from "next";
 import { getTranslations } from "next-intl/server";
 import { resetPassword } from "@/actions/password-reset";
 import Link from "@/components/link";
 import { ContentCard } from "@/components/public/ui";
 
+export async function generateMetadata(): Promise<Metadata> {
+	const t = await getTranslations("pages.reset");
+	return {
+		title: t("title"),
+		description: t("subtitle"),
+		// Single-use links: never indexable.
+		robots: { index: false, follow: false },
+	};
+}
+
+const ERROR_KEYS: Record<string, string> = {
+	password: "passwordMinLength",
+	ratelimit: "tooManyAttempts",
+	invalid: "invalidLink",
+	failed: "failed",
+};
+
 export default async function ResetPage({
 	searchParams,
 }: {
@@ -10,9 +28,12 @@ export default async function ResetPage({
 }) {
 	const t = await getTranslations("pages.reset");
 	const { email = "", token = "", error } = await searchParams;
+	// Only codes the action can produce are mapped — anything else stays silent
+	// instead of being echoed back onto our own domain.
+	const errorKey = error ? (ERROR_KEYS[error] ?? null) : null;
 
 	return (
-		<main style={{ maxWidth: 420, margin: "2rem auto" }}>
+		<section style={{ maxWidth: 420, margin: "2rem auto" }}>
 			<ContentCard icon="🔐" title={t("title")} subtitle={t("subtitle")}>
 				<form action={resetPassword} style={{ display: "grid", gap: "0.7rem" }}>
 					<input type="hidden" name="email" value={email} />
@@ -28,15 +49,16 @@ export default async function ResetPage({
 						{t("resetPassword")}
 					</button>
 				</form>
-				{error ? (
+				{errorKey ? (
 					<p
+						role="alert"
 						style={{
 							color: "var(--color-danger)",
 							textAlign: "center",
 							marginBottom: 0,
 						}}
 					>
-						{error}
+						{t(errorKey)}
 					</p>
 				) : null}
 				<p
@@ -46,6 +68,6 @@ export default async function ResetPage({
 					<Link href="/login">{t("backToLogin")}</Link>
 				</p>
 			</ContentCard>
-		</main>
+		</section>
 	);
 }

src/app/(site)/room/[id]/page.tsx

@@ -101,7 +101,7 @@ export default async function RoomPage({
 		.filter(Boolean);
 
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			<p style={{ margin: 0 }}>
 				<Link href="/" className="btn btn-outline">
 					← Back to the hotel
@@ -166,6 +166,6 @@ export default async function RoomPage({
 					Enter the hotel to visit {room.name || `room #${room.id}`} in 3D.
 				</EmptyState>
 			</ContentCard>
-		</main>
+		</section>
 	);
 }

src/app/(site)/search/page.tsx

@@ -5,6 +5,7 @@ import { LocalEventTime } from "@/components/public/local-event-time";
 import { ContentCard, EmptyState } from "@/components/public/ui";
 import { UserAvatarThumbnail } from "@/components/shared/user-avatar-thumbnail";
 import { withPublicPagePerformance } from "@/lib/public-page-performance";
+import { loadProfilePrivacyMap } from "@/lib/services/profile-privacy";
 import { loadPublicSearch } from "@/lib/services/public-search";
 
 export async function generateMetadata(): Promise<Metadata> {
@@ -29,6 +30,11 @@ async function SearchPage({ searchParams }: { searchParams: Promise<Params> }) {
 		eventsPage: Number(params.eventsPage ?? 1),
 	});
 	const query = result?.query ?? "";
+	// Users who hide their online state must not have it surfaced here either —
+	// the listing, not just the profile, is what makes it enumerable.
+	const userRows =
+		result?.users.status === "fulfilled" ? result.users.value.rows : [];
+	const userPrivacy = await loadProfilePrivacyMap(userRows.map((u) => u.id));
 	const pagination = (
 		kind: "users" | "rooms" | "news" | "events",
 		data: { page: number; lastPage: number; total: number },
@@ -65,7 +71,7 @@ async function SearchPage({ searchParams }: { searchParams: Promise<Params> }) {
 		);
 	};
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			<ContentCard title={t("title")} subtitle={t("subtitle")} icon="🔎" />
 			<ContentCard>
 				<form
@@ -119,7 +125,12 @@ async function SearchPage({ searchParams }: { searchParams: Promise<Params> }) {
 														{user.username}
 													</span>
 													<span className="text-xs muted">
-														{t(user.online === "1" ? "online" : "offline")}
+														{t(
+															user.online === "1" &&
+																userPrivacy.get(user.id)?.online !== false
+																? "online"
+																: "offline",
+														)}
 													</span>
 												</Link>
 											))}
@@ -220,7 +231,7 @@ async function SearchPage({ searchParams }: { searchParams: Promise<Params> }) {
 					</section>
 				</>
 			)}
-		</main>
+		</section>
 	);
 }
 

src/app/(site)/settings/2fa/page.tsx

@@ -73,7 +73,7 @@ export default async function TwoFactorPage({
 	}
 
 	return (
-		<main
+		<section
 			style={{
 				display: "grid",
 				gap: "1.5rem",
@@ -149,6 +149,11 @@ export default async function TwoFactorPage({
 						{t("rateLimit")}
 					</p>
 				) : null}
+				{sp.error === "alreadyenabled" ? (
+					<p style={{ color: "var(--color-danger)", marginTop: 0 }}>
+						{t("alreadyEnabled")}
+					</p>
+				) : null}
 
 				{!hasAppKey ? (
 					<p style={{ margin: 0 }}>
@@ -217,6 +222,6 @@ export default async function TwoFactorPage({
 					</>
 				)}
 			</ContentCard>
-		</main>
+		</section>
 	);
 }

src/app/(site)/settings/sessions/page.tsx

@@ -78,7 +78,7 @@ export default async function SessionsPage({
 	}
 
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			{signedOutAll === "1" ? (
 				<p
 					role="status"
@@ -169,6 +169,6 @@ export default async function SessionsPage({
 					</table>
 				</ContentCard>
 			) : null}
-		</main>
+		</section>
 	);
 }

src/app/(site)/shop/page.tsx

@@ -154,7 +154,7 @@ export default async function ShopPage({
 		: undefined;
 
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			{boughtMessage ? (
 				<div role="status" style={feedbackStyle("success")}>
 					{boughtMessage}
@@ -340,6 +340,6 @@ export default async function ShopPage({
 					</div>
 				)}
 			</ContentCard>
-		</main>
+		</section>
 	);
 }

src/app/(site)/shop/topup/page.tsx

@@ -41,7 +41,7 @@ export default async function TopUpPage({
 	const rate = creditsPerUnit();
 
 	return (
-		<main className="page-grid">
+		<section className="page-grid">
 			<ContentCard icon="💳" title={t("title")} subtitle={t("subtitle")} />
 
 			{sp.status === "cancel" ? (
@@ -92,6 +92,6 @@ export default async function TopUpPage({
 					</p>
 				</ContentCard>
 			</div>
-		</main>
+		</section>
 	);
 }

src/app/(site)/staff/page.tsx

@@ -59,7 +59,7 @@ export default async function StaffPage() {
 	]);
 
 	return (
-		<main className={styles.page}>
+		<section className={styles.page}>
 			<SurfaceCard className={styles.hero}>
 				<div>
 					<h1>{t("title")}</h1>
@@ -151,6 +151,6 @@ export default async function StaffPage() {
 					</section>
 				)
 			)}
-		</main>
+		</section>
 	);
 }

src/app/(site)/u/[username]/page.tsx

@@ -338,7 +338,7 @@ async function ProfilePage({
 	const badgeByCode = new Map(badgeDetails.map((b) => [b.badgeKey, b]));
 
 	return (
-		<main className={`page-grid ${styles.profile}`}>
+		<section className={`page-grid ${styles.profile}`}>
 			{friend === "sent" ? (
 				<div role="status" style={feedbackStyle("success")}>
 					{t("success.sent")}
@@ -373,6 +373,8 @@ async function ProfilePage({
 						width={100}
 						height={150}
 						className={styles.avatar}
+						loading="eager"
+						fetchPriority="high"
 					/>
 					<div className={styles.identity}>
 						<h1 style={{ margin: "0 0 0.25rem" }}>{user.username}</h1>
@@ -692,7 +694,7 @@ async function ProfilePage({
 					</ContentCard>
 				</div>
 			</div>
-		</main>
+		</section>
 	);
 }
 

src/app/(site)/verify/page.tsx

@@ -1,5 +1,6 @@
-import { eq } from "drizzle-orm";
+import { asc, eq } from "drizzle-orm";
 import { CheckCircle2, Clock, MailX } from "lucide-react";
+import type { Metadata } from "next";
 import { getTranslations } from "next-intl/server";
 import { ResendVerificationForm } from "@/components/auth/resend-verification-form";
 import Link from "@/components/link";
@@ -7,6 +8,16 @@ import { SurfaceCard } from "@/components/surface-card";
 import { isValidVerificationToken } from "@/lib/auth/email-verification";
 import { db, User } from "@/lib/db";
 
+export async function generateMetadata(): Promise<Metadata> {
+	const t = await getTranslations("pages.verify");
+	return {
+		title: t("verifiedTitle"),
+		description: t("invalidSubtitle"),
+		// Token links are single-use; the page itself has nothing to index.
+		robots: { index: false, follow: false },
+	};
+}
+
 type Status = "verified" | "already" | "invalid" | "unavailable";
 
 function StatusCard({
@@ -31,7 +42,7 @@ function StatusCard({
 	const tint = tintMap[color] ?? tintMap.blue;
 
 	return (
-		<main className="flex min-h-[60vh] items-center justify-center px-4">
+		<section className="flex min-h-[60vh] items-center justify-center px-4">
 			<SurfaceCard className="w-full max-w-md">
 				<div
 					className="flex items-center gap-2.5 border-b px-5 py-4"
@@ -76,7 +87,7 @@ function StatusCard({
 					{children}
 				</div>
 			</SurfaceCard>
-		</main>
+		</section>
 	);
 }
 
@@ -98,11 +109,14 @@ export default async function VerifyPage({
 		const ok = await isValidVerificationToken(normalisedEmail, token);
 		if (ok) {
 			try {
-				const [user] = await db
+				// Legacy databases allow duplicate addresses; always resolve the
+				// oldest account so the link cannot verify a different one.
+				const matches = await db
 					.select({ id: User.id, mailVerified: User.mailVerified })
 					.from(User)
 					.where(eq(User.mail, normalisedEmail))
-					.limit(1);
+					.orderBy(asc(User.id));
+				const user = matches[0];
 				if (!user) {
 					status = "invalid";
 				} else if (user.mailVerified === "1") {
@@ -173,6 +187,21 @@ export default async function VerifyPage({
 					<p className="text-sm" style={{ color: "var(--color-text-muted)" }}>
 						{t("unavailableBody")}
 					</p>
+					{/* Transient failure: offer both the retry path and the way out
+					    instead of leaving the visitor stranded on this card. */}
+					<ResendVerificationForm />
+					<Link
+						href="/login"
+						className={`${linkClass} !shadow-none`}
+						style={{
+							background: "transparent",
+							color: "var(--color-text-readable)",
+							border:
+								"2px solid color-mix(in srgb, var(--color-text-muted) 20%, transparent)",
+						}}
+					>
+						{t("backToLogin")}
+					</Link>
 				</StatusCard>
 			)}
 

src/app/admin-next/hotel/nitro-cleanup/page.tsx

@@ -1,5 +1,11 @@
+import { AdminToaster } from "@/components/admin/admin-toaster";
 import { NitroCleanupPanel } from "@/components/admin/studio/nitro-cleanup-panel";
 
 export default function HousekeepingHotelNitroCleanupPage() {
-	return <NitroCleanupPanel />;
+	return (
+		<>
+			<NitroCleanupPanel />
+			<AdminToaster />
+		</>
+	);
 }

src/app/admin/layout.tsx

@@ -6,6 +6,7 @@ import type { ReactNode } from "react";
 import { AdminHubChrome } from "@/components/admin/admin-hub-chrome";
 import { AdminMobileWrapper } from "@/components/admin/admin-mobile-wrapper";
 import { AdminSidebarNav } from "@/components/admin/admin-sidebar-nav";
+import { AdminToaster } from "@/components/admin/admin-toaster";
 import { AdminTopbar } from "@/components/admin/admin-topbar";
 import { LanguageSwitcher } from "@/components/language-switcher";
 import Link from "@/components/link";
@@ -54,6 +55,7 @@ export default async function AdminLayout({
 					</section>
 				</div>
 			</AdminMobileWrapper>
+			<AdminToaster />
 		</>
 	);
 }

src/app/admin/logs/_lib/load-ignored-logs.ts

@@ -32,7 +32,8 @@ function parsePageParams(
 ) {
 	const sp = new URLSearchParams(rawParams);
 	const parsed = parseListParams(sp);
-	const perPage = Number(rawParams.perPage) || defaultPerPage;
+	// parseListParams clamps perPage to 1..100 — use it instead of the raw value.
+	const perPage = parsed.perPage || defaultPerPage;
 	return { search: parsed.search.trim(), page: parsed.page, perPage };
 }
 
@@ -63,8 +64,10 @@ async function loadLogList<RawRow, Row>(
 		rawParams,
 		input.defaultPerPage ?? 50,
 	);
-	const offset = (page - 1) * perPage;
-	const like = `%${search}%`;
+	// Cap the offset: `?page=1000000` otherwise builds a multi-hundred-million
+	// row scan before returning an empty page.
+	const offset = Math.min((page - 1) * perPage, 100_000);
+	const like = `%${search.slice(0, 100)}%`;
 	const where = search ? sql`WHERE ${spec.searchWhere(like)}` : sql``;
 
 	const [rawRowsResult, countRows] = await Promise.all([

src/app/admin/radio/settings/page.tsx

@@ -7,7 +7,7 @@ import { StatusCard } from "@/components/admin/dashboard";
 import { Button } from "@/components/ui/button";
 import { db, WebsiteSetting } from "@/lib/db";
 
-type Field = { key: string; comment: string };
+type Field = { key: string; comment: string; secret?: boolean };
 type Group = { title: string; fields: Field[] };
 
 const GROUPS: Group[] = [
@@ -19,7 +19,11 @@ const GROUPS: Group[] = [
 			{ key: "radio_stream_backup_url", comment: "Backup stream URL" },
 			{ key: "radio_azurecast_base_url", comment: "AzureCast base URL" },
 			{ key: "radio_azurecast_station_id", comment: "AzureCast station ID" },
-			{ key: "radio_azurecast_api_key", comment: "AzureCast API key" },
+			{
+				key: "radio_azurecast_api_key",
+				comment: "AzureCast API key",
+				secret: true,
+			},
 			{ key: "radio_azurecast_port", comment: "AzureCast stream port" },
 			{
 				key: "radio_azurecast_protocol",
@@ -41,9 +45,14 @@ const GROUPS: Group[] = [
 			{
 				key: "radio_sambroadcaster_password",
 				comment: "Sambroadcaster password",
+				secret: true,
 			},
 			{ key: "radio_virtual_dj_url", comment: "Virtual DJ URL" },
-			{ key: "radio_virtual_dj_password", comment: "Virtual DJ password" },
+			{
+				key: "radio_virtual_dj_password",
+				comment: "Virtual DJ password",
+				secret: true,
+			},
 			{ key: "radio_djs_api_url", comment: "DJs API URL" },
 		],
 	},
@@ -331,7 +340,11 @@ const GROUPS: Group[] = [
 	{
 		title: "Discord webhook & custom code",
 		fields: [
-			{ key: "radio_discord_webhook_url", comment: "Discord webhook URL" },
+			{
+				key: "radio_discord_webhook_url",
+				comment: "Discord webhook URL",
+				secret: true,
+			},
 			{
 				key: "radio_discord_enabled",
 				comment: "Enable Discord notifications (0=no, 1=yes)",
@@ -467,7 +480,15 @@ export default async function AdminRadioSettingsPage() {
 									<input
 										id={`f_${field.key}`}
 										name={field.key}
-										defaultValue={values.get(field.key) ?? ""}
+										// Credentials are masked and blank means "keep".
+										type={field.secret ? "password" : "text"}
+										autoComplete="off"
+										placeholder={
+											field.secret ? "Leave blank to keep" : undefined
+										}
+										defaultValue={
+											field.secret ? "" : (values.get(field.key) ?? "")
+										}
 										style={{ width: "100%" }}
 									/>
 									{field.comment ? (

src/app/admin/settings/advanced-settings-panel.tsx

@@ -14,8 +14,10 @@ import { MANAGED_SETTING_KEYS } from "./cms-settings-config";
 
 interface SettingRow {
 	key: string;
+	/** Masked for secrets — the real value never reaches the client. */
 	value: string;
 	comment: string | null;
+	secret?: boolean;
 }
 
 export function AdvancedSettingsPanel({
@@ -126,7 +128,7 @@ export function AdvancedSettingsPanel({
 									</>
 								) : (
 									<code className="flex-1 text-xs break-all text-muted-foreground">
-										{s.value}
+										{s.secret ? "•• hidden ••" : s.value}
 									</code>
 								)}
 							</div>

src/app/admin/settings/page.tsx

@@ -5,6 +5,10 @@ import { getTranslations } from "next-intl/server";
 import { AdminPageShell } from "@/components/admin/admin-page-shell";
 import { db, WebsiteSetting } from "@/lib/db";
 import { canAccess, getAdminContext, PERMS } from "@/lib/permissions";
+import {
+	isSecretSettingKey,
+	SECRET_PLACEHOLDER,
+} from "@/lib/services/setting-secrets";
 import { AdvancedSettingsPanel } from "./advanced-settings-panel";
 import { FIELD_DEFAULTS, MANAGED_SETTING_KEYS } from "./cms-settings-config";
 import { CmsSettingsForm } from "./cms-settings-form";
@@ -61,10 +65,14 @@ export default async function AdminSettings() {
 				<CmsSettingsForm values={values} canEdit={canEdit} />
 
 				<AdvancedSettingsPanel
+					// Credentials never leave the server: a reader with only
+					// SETTINGS_VIEW must not receive captcha/radio secrets in the
+					// payload, and an editor sees a "keep stored value" placeholder.
 					settings={settings.map((s) => ({
 						key: s.key,
-						value: s.value,
+						value: isSecretSettingKey(s.key) ? SECRET_PLACEHOLDER : s.value,
 						comment: s.comment,
+						secret: isSecretSettingKey(s.key),
 					}))}
 					canEdit={canEdit}
 				/>

src/app/api/admin/import/furni/route.ts

@@ -5,7 +5,7 @@ import { invalidateCatalogTotals } from "@/features/catalog/server/catalog-total
 import { apiError, apiOk } from "@/lib/api";
 import { withAdmin } from "@/lib/api-handler";
 import { db, ItemsBase, queryRows } from "@/lib/db";
-import { normalizeClassname } from "@/lib/furni/classname";
+import { isSafeAssetName, normalizeClassname } from "@/lib/furni/classname";
 import { localFurnitureStatus } from "@/lib/furni/local-presence";
 import { PERMS } from "@/lib/permissions";
 import { logAudit } from "@/lib/services/audit";
@@ -709,9 +709,20 @@ export const PATCH = withAdmin(
 			[];
 
 		for (const item of items) {
-			const starIdx = item.classname.indexOf("*");
+			const normalised = item.classname.trim();
+			// The classname is joined straight into a `.nitro` file path, so a
+			// separator/looking payload must never get that far.
+			if (!isSafeAssetName(normalised)) {
+				results.push({
+					classname: item.classname,
+					ok: false,
+					warning: "Invalid classname",
+				});
+				continue;
+			}
+			const starIdx = normalised.indexOf("*");
 			const baseClassname =
-				starIdx !== -1 ? item.classname.substring(0, starIdx) : item.classname;
+				starIdx !== -1 ? normalised.substring(0, starIdx) : normalised;
 			const nitroPath = path.join(
 				/*turbopackIgnore: true*/ nitroDir,
 				`${baseClassname}.nitro`,

src/app/api/admin/users/actions/route.ts

@@ -6,11 +6,20 @@ import { PERMS } from "@/lib/permissions";
 import { rcon } from "@/lib/services/rcon";
 import { logStaffActivity } from "@/lib/services/staff-activity";
 
+/** Currency grants are capped: an unbounded `amount` minted an economy-breaking
+ *  balance with a single request. */
+function positiveAmount(amount: number): boolean {
+	return Number.isInteger(amount) && amount > 0 && amount <= MAX_CURRENCY_GRANT;
+}
+
+const MAX_CURRENCY_GRANT = 1_000_000;
+
 export const POST = withAdmin(
 	{ permission: PERMS.USERS_EDIT },
 	async (request, context) => {
 		const staffId = context.session.user.id;
 		const staffRank = context.session.user.rank;
+		const isSuper = context.permissions.isSuperAdmin;
 		const formData = await request.formData();
 		const userId = Number(formData.get("userId"));
 		const username = String(formData.get("username") || "");
@@ -23,6 +32,33 @@ export const POST = withAdmin(
 			);
 		}
 
+		// Every branch below acts on a live account, so the rank guard that the
+		// set_rank branch already applies belongs to all of them: staff may not
+		// act on users at or above their own rank unless they are the hotel's
+		// dynamic owner.
+		if (action !== "set_rank") {
+			const [target] = await db
+				.select({ rank: User.rank })
+				.from(User)
+				.where(eq(User.id, userId))
+				.limit(1);
+			if (!target) {
+				return NextResponse.json(
+					{ success: false, message: "User not found" },
+					{ status: 404 },
+				);
+			}
+			if (!isSuper && target.rank >= staffRank) {
+				return NextResponse.json(
+					{
+						success: false,
+						message: "Cannot act on a user at or above your rank",
+					},
+					{ status: 403 },
+				);
+			}
+		}
+
 		if (action === "set_rank") {
 			const rank = Number(formData.get("rank") || "0");
 			if (!Number.isInteger(rank) || rank < 1) {
@@ -141,7 +177,7 @@ export const POST = withAdmin(
 
 		if (action === "give_credits") {
 			const credits = Number(formData.get("credits") || "0");
-			if (!credits || credits <= 0) {
+			if (!positiveAmount(credits)) {
 				return NextResponse.json(
 					{ success: false, message: "Invalid credit amount" },
 					{ status: 400 },
@@ -166,7 +202,7 @@ export const POST = withAdmin(
 
 		if (action === "give_duckets") {
 			const amount = Number(formData.get("amount") || "0");
-			if (!amount || amount <= 0) {
+			if (!positiveAmount(amount)) {
 				return NextResponse.json(
 					{ success: false, message: "Invalid duckets amount" },
 					{ status: 400 },
@@ -188,7 +224,7 @@ export const POST = withAdmin(
 
 		if (action === "give_diamonds") {
 			const amount = Number(formData.get("amount") || "0");
-			if (!amount || amount <= 0) {
+			if (!positiveAmount(amount)) {
 				return NextResponse.json(
 					{ success: false, message: "Invalid diamonds amount" },
 					{ status: 400 },
@@ -213,7 +249,7 @@ export const POST = withAdmin(
 
 		if (action === "give_points") {
 			const amount = Number(formData.get("amount") || "0");
-			if (!amount || amount <= 0) {
+			if (!positiveAmount(amount)) {
 				return NextResponse.json(
 					{ success: false, message: "Invalid points amount" },
 					{ status: 400 },

src/app/api/diagnostics/errors/route.ts

@@ -23,6 +23,12 @@ export async function POST(request: Request) {
 		!request.headers.get("content-type")?.startsWith("application/json")
 	)
 		return new Response(null, { status: 403 });
+	// The IP bucket is rotatable, so also require the browser's own fetch
+	// metadata: a script hammering this endpoint from another site is
+	// `cross-site`, while a real in-page reporter is never.
+	const fetchSite = request.headers.get("sec-fetch-site");
+	if (fetchSite && fetchSite !== "same-origin" && fetchSite !== "none")
+		return new Response(null, { status: 403 });
 	const limit = await rateLimit(`cms-error:${await clientIp()}`, 20, 60000);
 	if (!limit.ok) return new Response(null, { status: 429 });
 	const reader = request.body?.getReader();

src/app/api/home/route.ts

@@ -1,11 +1,7 @@
-import { and, count, desc, eq, or, sql } from "drizzle-orm";
 import { env } from "@/env";
 import { apiJson } from "@/lib/api";
-import { db, User, WebsiteArticles } from "@/lib/db";
-import { resolveHotelName } from "@/lib/hotel-name";
 import { logger } from "@/lib/logger";
-import { apiCacheKey, cacheSafe } from "@/lib/redis-cache";
-import { cacheNews } from "@/lib/services/news-cache";
+import { cachedHomePayload } from "@/lib/services/home-payload";
 
 /**
  * GET /api/home — combined landing payload: the latest 4 website_articles and
@@ -14,39 +10,7 @@ import { cacheNews } from "@/lib/services/news-cache";
  */
 export async function GET(_req: Request) {
 	try {
-		const data = await cacheNews(apiCacheKey("home"), 15_000, async () => {
-			const [articles, onlineRows, hotelName] = await Promise.all([
-				db
-					.select({
-						id: WebsiteArticles.id,
-						title: WebsiteArticles.title,
-						slug: WebsiteArticles.slug,
-						shortStory: WebsiteArticles.shortStory,
-						image: WebsiteArticles.image,
-						createdAt: WebsiteArticles.createdAt,
-					})
-					.from(WebsiteArticles)
-					.where(
-						and(
-							eq(WebsiteArticles.status, "published"),
-							or(
-								sql`${WebsiteArticles.publishAt} IS NULL`,
-								sql`${WebsiteArticles.publishAt} <= NOW()`,
-							),
-						),
-					)
-					.orderBy(desc(WebsiteArticles.createdAt))
-					.limit(4),
-				db.select({ total: count() }).from(User).where(eq(User.online, "1")),
-				resolveHotelName(),
-			]);
-			return cacheSafe({
-				articles,
-				online: onlineRows[0]?.total ?? 0,
-				hotelName,
-			});
-		});
-		return apiJson(data);
+		return apiJson(await cachedHomePayload());
 	} catch (error) {
 		logger.error("Public news query failed", { module: "news", error });
 		return apiJson(

src/app/api/leaderboard/route.ts

@@ -14,11 +14,29 @@ const CURRENCY_TYPE: Record<Exclude<LeaderboardType, "credits">, number> = {
 	duckets: 0,
 };
 
-type Row = { rank: number; username: string; look: string; value: number };
+type Row = {
+	rank: number;
+	userId: number;
+	username: string;
+	look: string;
+	value: number;
+};
+
+/** Hidden-wallet users must not be listed, exactly like on the page. */
+async function withoutHiddenWallets<T extends { userId: number }>(
+	rows: T[],
+): Promise<T[]> {
+	const { loadProfilePrivacyMap } = await import(
+		"@/lib/services/profile-privacy"
+	);
+	const privacy = await loadProfilePrivacyMap(rows.map((r) => r.userId));
+	return rows.filter((r) => privacy.get(r.userId)?.wallet !== false);
+}
 
 async function loadCreditsRows(): Promise<Row[]> {
 	const users = await db
 		.select({
+			userId: User.id,
 			username: User.username,
 			look: User.look,
 			credits: User.credits,
@@ -26,8 +44,9 @@ async function loadCreditsRows(): Promise<Row[]> {
 		.from(User)
 		.orderBy(desc(User.credits))
 		.limit(20);
-	return users.map((u, i) => ({
+	return (await withoutHiddenWallets(users)).map((u, i) => ({
 		rank: i + 1,
+		userId: u.userId,
 		username: u.username,
 		look: u.look,
 		value: u.credits,
@@ -55,15 +74,24 @@ async function loadCurrencyRows(type: number): Promise<Row[]> {
 				top.map((t) => t.userId),
 			),
 		);
-	const byId = new Map(users.map((u) => [u.id, u]));
+	const allowed = await withoutHiddenWallets(top);
+	const allowedIds = new Set(allowed.map((t) => t.userId));
+	const byId = new Map(
+		users.filter((u) => allowedIds.has(u.id)).map((u) => [u.id, u]),
+	);
 
-	return top
+	return allowed
 		.map((t) => {
 			const u = byId.get(t.userId);
 			if (!u) return null;
-			return { username: u.username, look: u.look, value: t.amount };
+			return {
+				userId: u.id,
+				username: u.username,
+				look: u.look,
+				value: t.amount,
+			};
 		})
-		.filter((r): r is Omit<Row, "rank"> => r !== null)
+		.filter((r) => r !== null)
 		.map((r, i) => ({ rank: i + 1, ...r }));
 }
 

src/app/api/media/route.ts

@@ -1,13 +1,20 @@
 import { existsSync, readdirSync, statSync } from "node:fs";
 import { resolve } from "node:path";
-import { NextResponse } from "next/server";
+import { apiOk } from "@/lib/api";
+import { withAdmin } from "@/lib/api-handler";
 import { MEDIA_ROOT } from "@/lib/media-storage";
+import { PERMS } from "@/lib/permissions";
 
-export async function GET() {
+/**
+ * Directory listing for the admin media picker. It used to be world-readable and
+ * unrated, which handed every visitor a complete inventory of uploaded media
+ * (logo/favicon paths included) plus their timestamps.
+ */
+export const GET = withAdmin({ permission: PERMS.PAGES_EDIT }, async () => {
 	const dir = MEDIA_ROOT;
 	// eslint-disable-next-line security/detect-non-literal-fs-filename
 	if (!existsSync(dir)) {
-		return NextResponse.json({ files: [] });
+		return apiOk({ files: [] });
 	}
 	// eslint-disable-next-line security/detect-non-literal-fs-filename
 	const files = readdirSync(dir)
@@ -23,5 +30,5 @@ export async function GET() {
 		})
 		.sort((a, b) => b.uploaded - a.uploaded);
 
-	return NextResponse.json({ files });
-}
+	return apiOk({ files });
+});

src/app/api/photos/route.ts

@@ -31,8 +31,20 @@ export async function GET(req: Request) {
 						.limit(take)
 						.offset(skip),
 				]);
+
+				// Photo privacy is a per-user setting, so the API honours it like
+				// the /photos page does.
+				const { loadProfilePrivacyMap } = await import(
+					"@/lib/services/profile-privacy"
+				);
+				const photoPrivacy = await loadProfilePrivacyMap(
+					photos.map((p) => p.userId),
+				);
+
 				return cacheSafe({
-					data: photos,
+					data: photos.filter(
+						(p) => photoPrivacy.get(p.userId)?.photos !== false,
+					),
 					meta: {
 						page,
 						perPage,

src/app/api/radio/shouts/route.ts

@@ -4,6 +4,7 @@ import { bearerUserId } from "@/lib/api-auth";
 import { db, RadioShouts, User } from "@/lib/db";
 import { rateLimit } from "@/lib/rate-limit";
 import { apiCacheKey, redisCache } from "@/lib/redis-cache";
+import { moderateOrThrow } from "@/lib/services/moderation";
 
 // Latest 50 radio shouts with their author's username/look resolved. Mirrors the
 // query behind the public /radio/shouts page (radio_shouts ordered by created_at
@@ -93,6 +94,14 @@ export async function POST(req: Request) {
 		);
 	}
 
+	// The same word filter the server action applies — the API path used to
+	// skip it entirely, so a filtered message could be posted with one fetch.
+	try {
+		await moderateOrThrow(message);
+	} catch (error) {
+		return apiError((error as Error).message, 422);
+	}
+
 	try {
 		const now = new Date();
 		await db.insert(RadioShouts).values({

src/app/api/users/[username]/route.ts

@@ -23,6 +23,7 @@ export async function GET(
 			async () => {
 				const [row] = await db
 					.select({
+						id: User.id,
 						username: User.username,
 						look: User.look,
 						motto: User.motto,
@@ -39,13 +40,21 @@ export async function GET(
 					return null;
 				}
 
+				// Wallet / online visibility are per-user settings; the public API
+				// used to hand both out unconditionally, which made bulk scraping
+				// of hidden wallets possible.
+				const { loadProfilePrivacy } = await import(
+					"@/lib/services/profile-privacy"
+				);
+				const privacy = await loadProfilePrivacy(row.id);
+
 				return cacheSafe({
 					username: row.username,
 					look: row.look,
 					motto: row.motto,
 					rank: row.rank,
-					credits: row.credits,
-					online: row.online === "1",
+					credits: privacy.values.wallet ? row.credits : null,
+					online: privacy.values.online ? row.online === "1" : null,
 					accountCreated: row.accountCreated,
 				});
 			},

src/app/client/page.tsx

@@ -1,12 +1,11 @@
-import { count, eq } from "drizzle-orm";
 import { headers } from "next/headers";
 import { redirect } from "next/navigation";
 import { auth } from "@/lib/auth";
 import { issueSsoTicket } from "@/lib/auth/sso-ticket";
-import { cached } from "@/lib/cache";
 import { resolveClientIp } from "@/lib/client-ip";
-import { db, User } from "@/lib/db";
 import { resolveHotelName } from "@/lib/hotel-name";
+import { cachedOnlineCount } from "@/lib/services/public-counters";
+
 import { siteSettings } from "@/lib/services/site-settings";
 import { ClientView } from "./client-view";
 
@@ -27,13 +26,7 @@ export default async function ClientPage() {
 	// render as fast as possible since the player is waiting for the game.
 	const [ticket, onlineCount] = await Promise.all([
 		issueSsoTicket(userId, hotelName, ip),
-		cached("online_count", 10_000, async () => {
-			const [row] = await db
-				.select({ total: count() })
-				.from(User)
-				.where(eq(User.online, "1"));
-			return row?.total ?? 0;
-		}).catch(() => 0),
+		cachedOnlineCount().catch(() => 0),
 	]);
 
 	return (

src/app/globals.css

@@ -167,6 +167,61 @@ html {
 	text-size-adjust: 100%;
 }
 
+/* ── Route transition (CSS only — no animation runtime on public pages) ── */
+@keyframes page-enter-rise {
+	from {
+		opacity: 0;
+		transform: translate3d(0, 10px, 0);
+	}
+	to {
+		opacity: 1;
+		transform: none;
+	}
+}
+.page-enter {
+	animation: page-enter-rise 240ms ease-out both;
+}
+
+/* ── Route progress indicator ─────────────────────────────────────────── */
+.route-progress {
+	position: fixed;
+	inset: 0 0 auto 0;
+	z-index: 99999;
+	height: 3px;
+	overflow: hidden;
+	background: transparent;
+	pointer-events: none;
+	opacity: 0;
+	transition: opacity 200ms linear;
+}
+.route-progress[data-loading="true"] {
+	opacity: 1;
+}
+@keyframes route-progress-run {
+	from {
+		width: 0%;
+		opacity: 1;
+	}
+	70% {
+		width: 85%;
+		opacity: 1;
+	}
+	to {
+		width: 100%;
+		opacity: 0;
+	}
+}
+.route-progress__bar {
+	display: block;
+	height: 100%;
+	width: 0;
+	background: var(--color-primary);
+	box-shadow: 0 0 10px var(--color-primary);
+}
+.route-progress[data-loading="true"] .route-progress__bar {
+	animation: route-progress-run 400ms ease-in-out both;
+}
+
 @media (prefers-reduced-motion: reduce) {
 	html:focus-within {
 		scroll-behavior: auto;

src/app/layout.tsx

@@ -6,7 +6,6 @@ import { NextIntlClientProvider } from "next-intl";
 import { getLocale, getMessages } from "next-intl/server";
 
 import { type ReactNode, Suspense } from "react";
-import { Toaster } from "sonner";
 import { GlobalProgressBar } from "@/components/global-progress-bar";
 import { PwaRegister } from "@/components/pwa-register";
 import { ScopedThemeVars } from "@/components/scoped-theme-vars";
@@ -106,19 +105,6 @@ export default async function RootLayout({
 					<ThemeScopeDetector />
 					{children}
 					<PwaRegister />
-					<Toaster
-						position="top-right"
-						richColors
-						closeButton
-						toastOptions={{
-							style: {
-								background: "var(--color-surface)",
-								color: "var(--color-text-readable)",
-								border:
-									"1px solid color-mix(in srgb, var(--color-text-muted) 12%, transparent)",
-							},
-						}}
-					/>
 				</NextIntlClientProvider>
 			</body>
 		</html>

src/components/admin/admin-toaster.tsx

@@ -0,0 +1,23 @@
+import { Toaster } from "sonner";
+
+/**
+ * Toast host for the admin surfaces (the only place `toast()` is used). Kept out
+ * of the root layout so public pages don't pay for the Sonner bundle.
+ */
+export function AdminToaster() {
+	return (
+		<Toaster
+			position="top-right"
+			richColors
+			closeButton
+			toastOptions={{
+				style: {
+					background: "var(--color-surface)",
+					color: "var(--color-text-readable)",
+					border:
+						"1px solid color-mix(in srgb, var(--color-text-muted) 12%, transparent)",
+				},
+			}}
+		/>
+	);
+}

src/components/auth/auth-page-frame.tsx

@@ -3,9 +3,11 @@ import { AuthTopBar } from "@/components/auth/auth-top-bar";
 import { Reveal } from "@/components/motion-reveal";
 import { UserAvatarThumbnail } from "@/components/shared/user-avatar-thumbnail";
 import { SurfaceCard } from "@/components/surface-card";
+import { loadProfilePrivacyMap } from "@/lib/services/profile-privacy";
 import { ICON_FRIENDS, ICON_NAV_GOODY, ICON_NAV_ME } from "@/lib/site-icons";
 
 export interface PublicUser {
+	id: number;
 	username: string;
 	look: string;
 }
@@ -56,22 +58,28 @@ interface AuthUsersCardsProps {
  * their left column. Cards with no users render nothing, so a cold database
  * degrades to just the intro panel instead of an empty grid.
  */
-export function AuthUsersCards({
+export async function AuthUsersCards({
 	recentUsers,
 	latestUsers,
 	recentTitle,
 	latestTitle,
 }: AuthUsersCardsProps) {
+	// "Hide my online status" must hold outside the profile too — the roster is
+	// exactly where that setting is worth the most.
+	const privacy = await loadProfilePrivacyMap(recentUsers.map((u) => u.id));
+	const onlineUsers = recentUsers.filter(
+		(u) => privacy.get(u.id)?.online !== false,
+	);
 	return (
 		<>
-			{recentUsers.length > 0 && (
+			{onlineUsers.length > 0 && (
 				<SurfaceCard
 					title={recentTitle}
 					icon={ICON_NAV_GOODY}
 					bodyClassName="p-4"
 					className="card-glow"
 				>
-					<AvatarGrid users={recentUsers} online />
+					<AvatarGrid users={onlineUsers} online />
 				</SurfaceCard>
 			)}
 			{latestUsers.length > 0 && (

src/components/global-progress-bar.tsx

@@ -1,18 +1,19 @@
 "use client";
 
-import { motion, useIsPresent } from "motion/react";
 import { usePathname, useSearchParams } from "next/navigation";
 import { useEffect, useState } from "react";
 
 /**
- * Global smooth progress indicator for page transitions.
- * Uses motion/react for high-performance 60fps animations.
+ * Global progress indicator for page transitions.
+ *
+ * Driven by a CSS class instead of motion/react — the progress bar used to be
+ * the only reason the masonry-free public layout shipped the whole animation
+ * runtime to every visitor. Class names come from globals.css (`.route-progress`).
  */
 export function GlobalProgressBar() {
 	const pathname = usePathname();
 	const searchParams = useSearchParams();
 	const [isLoading, setIsLoading] = useState(false);
-	const isPresent = useIsPresent();
 
 	// biome-ignore lint/correctness/useExhaustiveDependencies: Route changes intentionally restart the indicator timer.
 	useEffect(() => {
@@ -24,17 +25,13 @@ export function GlobalProgressBar() {
 		return () => clearTimeout(timer);
 	}, [pathname, searchParams]);
 
-	if (!isLoading && isPresent) return null;
-
 	return (
-		<div className="fixed top-0 left-0 right-0 z-[99999] h-1 bg-transparent pointer-events-none overflow-hidden">
-			<motion.div
-				className="h-full bg-[var(--color-primary)] shadow-[0_0_10px_var(--color-primary)]"
-				initial={{ width: "0%", opacity: 1 }}
-				animate={{ width: "85%", opacity: 1 }}
-				exit={{ width: "100%", opacity: 0 }}
-				transition={{ duration: 0.3, ease: "easeInOut" }}
-			/>
+		<div
+			aria-hidden="true"
+			data-loading={isLoading ? "true" : "false"}
+			className="route-progress"
+		>
+			<span className="route-progress__bar" />
 		</div>
 	);
 }

src/components/mobile-nav-panel.tsx

@@ -0,0 +1,86 @@
+"use client";
+
+import { AnimatePresence, motion } from "motion/react";
+import Image from "next/image";
+import type { ReactNode } from "react";
+import { mobileMenuVariants } from "@/lib/motion";
+
+/**
+ * Animated mobile menu sheet, split out of `MobileNav` so `motion/react` only
+ * ships once the hamburger menu is opened instead of on every public page.
+ */
+export default function MobileNavPanel({
+	open,
+	menuId,
+	menuRef,
+	brandLabel,
+	closeLabel,
+	children,
+}: {
+	open: boolean;
+	menuId: string;
+	menuRef: React.RefObject<HTMLDivElement | null>;
+	brandLabel: string;
+	closeLabel: string;
+	children: ReactNode;
+}) {
+	return (
+		<AnimatePresence>
+			{open ? (
+				<motion.div
+					id={menuId}
+					role="dialog"
+					aria-modal="true"
+					aria-label={brandLabel || "Navigation menu"}
+					className="absolute left-0 top-full mt-2 w-[min(88vw,360px)] z-50 origin-top-left"
+					style={{ backgroundColor: "transparent" }}
+					variants={mobileMenuVariants}
+					initial="hidden"
+					animate="visible"
+					exit="exit"
+				>
+					<div
+						ref={menuRef}
+						className="flex flex-col gap-y-1 p-2 rounded-2xl border shadow-xl max-h-[calc(100dvh-5rem)] overflow-y-auto overscroll-contain
+						bg-[var(--color-dropdown,var(--color-surface,#fff))]"
+						style={{
+							borderColor:
+								"color-mix(in srgb, var(--color-text-muted) 12%, transparent)",
+							boxShadow:
+								"0 12px 40px color-mix(in srgb, rgb(0 0 0) 22%, transparent)",
+						}}
+					>
+						<div
+							className="flex items-center gap-2 px-3 py-2 mb-1 rounded-xl"
+							style={{
+								backgroundColor:
+									"color-mix(in srgb, var(--color-primary) 12%, transparent)",
+							}}
+						>
+							<Image
+								src="/assets/images/icons/navigation/home.png"
+								alt=""
+								width={22}
+								height={22}
+								className="shrink-0"
+							/>
+							<span
+								className="text-sm font-extrabold uppercase tracking-wide"
+								style={{
+									color: "var(--color-navbar-text-readable, var(--color-text))",
+								}}
+							>
+								{brandLabel}
+							</span>
+							<span className="ml-auto text-[11px] font-semibold uppercase tracking-wider opacity-75">
+								{closeLabel}
+							</span>
+						</div>
+
+						{children}
+					</div>
+				</motion.div>
+			) : null}
+		</AnimatePresence>
+	);
+}