Radicade Public Code

Server/Admin/AdminAuthAPI.cs

@@ -0,0 +1,127 @@
+using Microsoft.AspNetCore.Cors;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using RadicadeServer.Auth;
+using RadicadeServer.DB;
+using RadicadeServer.Utils;
+
+namespace RadicadeServer.Admin;
+
+[Route("admin/auth")]
+[EnableCors("AdminPanel")]
+public class AdminAuthAPI(RecDBContext db) : Controller
+{
+	private CookieOptions SessionCookieOptions => new()
+	{
+		HttpOnly = true,
+		Secure = true,
+		SameSite = SameSiteMode.Strict,
+		MaxAge = AdminSession.Lifetime,
+		Path = "/"
+	};
+
+	public record LoginRequest(string? Username, string? Password);
+
+	[HttpPost("login")]
+	public async Task<IActionResult> Login([FromBody] LoginRequest request)
+	{
+		var username = request.Username?.Trim() ?? "";
+		var ip = Request.GetClientIp();
+
+		if (AdminLoginThrottle.IsLocked(username, ip, out var remaining))
+			return LockoutResponse(remaining);
+
+		if (string.IsNullOrWhiteSpace(username) || string.IsNullOrWhiteSpace(request.Password))
+			return Unauthorized(new { error = "invalid_credentials", message = "Invalid username or password." });
+
+		var user = await db.AdminUsers.FirstOrDefaultAsync(x => x.Username == username);
+
+		if (user == null || !AdminSecurity.VerifyPassword(user.PasswordHash, request.Password))
+		{
+			await Task.Delay(350);
+			AdminLoginThrottle.RecordFailure(username, ip);
+			if (AdminLoginThrottle.IsLocked(username, ip, out remaining))
+				return LockoutResponse(remaining);
+			return Unauthorized(new { error = "invalid_credentials", message = "Invalid username or password." });
+		}
+
+		if (AdminSecurity.NeedsRehash(user.PasswordHash))
+		{
+			user.PasswordHash = AdminSecurity.HashPassword(request.Password);
+			await db.SaveChangesAsync();
+		}
+
+		AdminLoginThrottle.Clear(username, ip);
+		await AdminSession.PruneAsync(db);
+		return await CompleteLoginAsync(user);
+	}
+
+	private async Task<IActionResult> CompleteLoginAsync(AdminUser user)
+	{
+		var token = await AdminSession.CreateAsync(db, user.Id);
+		user.LastLoginAt = DateTime.UtcNow;
+		await db.SaveChangesAsync();
+
+		Response.Cookies.Append(AdminSession.CookieName, token, SessionCookieOptions);
+		return Ok(new { ok = true, user = Identity(user) });
+	}
+
+	[HttpGet("session")]
+	public async Task<IActionResult> Session()
+	{
+		var user = await RequireSessionAsync();
+		if (user == null) return Unauthorized(new { error = "not_authenticated" });
+
+		var (rotated, didRotate) = AdminSession.TryRotate(db, CurrentToken());
+		if (didRotate && !string.IsNullOrEmpty(rotated))
+			Response.Cookies.Append(AdminSession.CookieName, rotated, SessionCookieOptions);
+
+		return Ok(new { user = Identity(user) });
+	}
+
+	[HttpGet("me")]
+	public async Task<IActionResult> Me()
+	{
+		var user = await RequireSessionAsync();
+		if (user == null) return Unauthorized(new { error = "not_authenticated" });
+		return Ok(new { user = Identity(user) });
+	}
+
+	[HttpPost("logout")]
+	public async Task<IActionResult> Logout()
+	{
+		await AdminSession.RevokeAsync(db, CurrentToken());
+		Response.Cookies.Delete(AdminSession.CookieName, new CookieOptions { Path = "/" });
+		return Ok(new { ok = true });
+	}
+
+	private string? CurrentToken() =>
+		Request.Cookies.TryGetValue(AdminSession.CookieName, out var token) ? token : null;
+
+	private async Task<AdminUser?> RequireSessionAsync()
+	{
+		var (ok, userId) = await AdminSession.ValidateAsync(db, CurrentToken());
+		if (!ok) return null;
+
+		return await db.AdminUsers.FirstOrDefaultAsync(x => x.Id == userId);
+	}
+
+	private static object Identity(AdminUser user) => new
+	{
+		id = user.Id,
+		username = user.Username
+	};
+
+	private static string Display(string ip) => string.IsNullOrWhiteSpace(ip) ? "an unknown address" : ip;
+
+	private IActionResult LockoutResponse(TimeSpan remaining)
+	{
+		var seconds = (int)Math.Ceiling(remaining.TotalSeconds);
+		Response.Headers["Retry-After"] = seconds.ToString();
+
+		var message = seconds > 60
+			? $"Too many failed sign-in attempts. Try again in {(int)Math.Ceiling(remaining.TotalMinutes)} minutes."
+			: $"Too many failed sign-in attempts. Try again in {seconds} seconds.";
+		return StatusCode(429, new { error = "locked_out", message, retry_after_seconds = seconds });
+	}
+}

Server/Admin/AdminBoardAPI.cs

@@ -0,0 +1,6 @@
+namespace RadicadeServer.Admin
+{
+	public class AdminBoardAPI
+	{
+	}
+}

Server/Admin/AdminClubAPI.cs

@@ -0,0 +1,74 @@
+using Microsoft.AspNetCore.Cors;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using RadicadeServer.Clubs;
+using RadicadeServer.DB;
+using RadicadeServer.Extensions;
+using RadicadeServer.Utils;
+
+namespace RadicadeServer.Admin
+{
+	[Route("admin/clubs")]
+	[EnableCors("AdminPanel")]
+	public class AdminClubAPI(RecDBContext db) : Controller
+	{
+		private Task<IActionResult?> RejectInvalidKey(string key)
+		{
+			return Task.FromResult<IActionResult?>(key.IsAdminKey() ? null : Unauthorized("Invalid secret"));
+		}
+
+		[HttpPost("upload/image")]
+		public async Task<IActionResult> UploadImage([FromQuery] string key, [FromQuery] long clubId, [FromForm] IFormFile file)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+
+			var clubs = await ClubStore.LoadAsync(db);
+			var club = clubs.FirstOrDefault(x => x.clubId == clubId);
+			if (club == null) return NotFound("Club does not exist.");
+
+			if (file == null || file.Length == 0) return BadRequest("No file provided.");
+
+			var allowed = new[] { ".png", ".jpg", ".jpeg", ".gif", ".webp", ".bmp" };
+			var ext = Path.GetExtension(file.FileName).ToLowerInvariant();
+			if (string.IsNullOrEmpty(ext) || !allowed.Contains(ext))
+				return BadRequest($"Unsupported image format '{(string.IsNullOrEmpty(ext) ? "no extension" : ext)}'. Use png/jpg/jpeg/gif/webp.");
+
+			Directory.CreateDirectory(DBConfig.CDNImages);
+			var name = Guid.NewGuid().ToString() + ext;
+			var path = Path.Join(DBConfig.CDNImages, name);
+
+			using (var stream = new FileStream(path, FileMode.Create))
+			{
+				await file.CopyToAsync(stream);
+			}
+
+			club.imageName = name;
+
+			await ClubStore.SaveAsync(db, clubs);
+
+			return Ok($"Uploaded {name}!\nURL: {DBConfig.ServerUrl}/images/img/{name}");
+		}
+
+		[HttpGet("set/image")]
+		public async Task<IActionResult> SetImage([FromQuery] string key, [FromQuery] long clubId, [FromQuery] string imgName)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+
+			var clubs = await ClubStore.LoadAsync(db);
+			var club = clubs.FirstOrDefault(x => x.clubId == clubId);
+			if (club == null) return NotFound("Club does not exist.");
+
+			imgName = Path.GetFileName(imgName ?? "").Trim();
+
+			if (string.IsNullOrEmpty(imgName)) imgName = ClubStore.DefaultImageName;
+
+			club.imageName = imgName;
+
+			await ClubStore.SaveAsync(db, clubs);
+
+			return Ok($"Set to {imgName}!\nURL: {DBConfig.ServerUrl}/images/img/{imgName}");
+		}
+	}
+}

Server/Admin/AdminConfigAPI.cs

@@ -0,0 +1,56 @@
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Cors;
+using Microsoft.EntityFrameworkCore;
+using RadicadeServer.DB;
+using RadicadeServer.RecNet.Config;
+using RadicadeServer.Utils;
+
+namespace RadicadeServer.Admin
+{
+	[Route("admin/config")]
+	[EnableCors("AdminPanel")]
+	public class AdminConfigAPI(RecDBContext db) : Controller
+	{
+		private Task<IActionResult?> RejectInvalidKey(string key)
+		{
+			return Task.FromResult<IActionResult?>(key.IsAdminKey() ? null : Unauthorized("Invalid secret"));
+		}
+
+		[HttpGet("forcerefresh")]
+		public async Task<IActionResult> ForceRefresh([FromQuery] string key)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+			
+			MainConfig? config = await db.Config.FirstOrDefaultAsync();
+			if (config == null) return StatusCode(500);
+
+			bool didChanges = false;
+
+			if (config.ExpectingReload)
+			{
+				didChanges = true;
+				config.SetAsActive();
+				config.ExpectingReload = false;
+			}
+
+			if (config.RefreshConfig(true))
+				didChanges = true;
+
+			if (didChanges)
+				await db.SaveChangesAsync();
+
+			return Ok(config?.ToActualConfig());
+		}
+
+		[HttpGet("full")]
+		public async Task<IActionResult> GetFullConfig([FromQuery] string key)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+			
+			MainConfig? config = await db.Config.FirstOrDefaultAsync();
+			return Ok(config);
+		}
+	}
+}

Server/Admin/AdminModels.cs

@@ -0,0 +1,67 @@
+using System.ComponentModel.DataAnnotations;
+using System.ComponentModel.DataAnnotations.Schema;
+
+namespace RadicadeServer.Admin;
+
+
+
+
+
+public class AdminUser
+{
+	[Key, DatabaseGenerated(DatabaseGeneratedOption.Identity)]
+	public long Id { get; set; }
+
+	[Required, MaxLength(64)]
+	public string Username { get; set; } = "";
+
+
+
+
+
+	[Required]
+	public string PasswordHash { get; set; } = "";
+
+
+	[MaxLength(64)]
+	public string? TotpSecret { get; set; }
+
+	public bool TotpEnabled { get; set; }
+
+	public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
+
+	public DateTime? LastLoginAt { get; set; }
+}
+
+
+
+
+
+
+
+
+public class AdminSessionRecord
+{
+	[Key, DatabaseGenerated(DatabaseGeneratedOption.Identity)]
+	public long Id { get; set; }
+
+	public long AdminUserId { get; set; }
+
+
+	[Required, MaxLength(64)]
+	public string TokenHash { get; set; } = "";
+
+
+
+	[MaxLength(64)]
+	public string? PreviousTokenHash { get; set; }
+
+	public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
+
+	public DateTime LastSeenAt { get; set; } = DateTime.UtcNow;
+
+
+	public DateTime ExpiresAt { get; set; }
+
+	public DateTime? RevokedAt { get; set; }
+}

Server/Admin/AdminPanelAPI.cs

@@ -0,0 +1,7032 @@
+using Microsoft.AspNetCore.Cors;
+using Microsoft.AspNetCore.Identity;
+using System.Globalization;
+using RadicadeServer.Auth;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using RadicadeServer.API.Notifications;
+using RadicadeServer.Radicade.Discord;
+using RadicadeServer.Radicade.Mail;
+using RadicadeServer.API.Storefront;
+using RadicadeServer.DB;
+using RadicadeServer.RecNet;
+using RadicadeServer.RecNet.Enums.Players.Avatar;
+using RadicadeServer.Extensions;
+using RadicadeServer.RecNet.Accounts;
+using RadicadeServer.RecNet.Accounts.Local;
+using RadicadeServer.RecNet.Auth;
+using RadicadeServer.RecNet.Avatar;
+using RadicadeServer.RecNet.Board;
+using RadicadeServer.RecNet.Enums.Messages;
+using RadicadeServer.RecNet.Enums.Moderation;
+using RadicadeServer.RecNet.Enums;
+using RadicadeServer.RecNet.Enums.Players;
+using RadicadeServer.RecNet.Enums.Rooms;
+using RadicadeServer.RecNet.Config;
+using RadicadeServer.RecNet.VersionCheck;
+using RadicadeServer.RecNet.DB;
+using RadicadeServer.RecNet.Enums.Store;
+using RadicadeServer.RecNet.Maintenance;
+using RadicadeServer.RecNet.Messages;
+using RadicadeServer.RecNet.Moderation;
+using RadicadeServer.RecNet.Notifications;
+using RadicadeServer.RecNet.Progression;
+using RadicadeServer.RecNet.Relationships;
+using RadicadeServer.RecNet.Rooms;
+using RadicadeServer.RecNet.Responses;
+using RadicadeServer.RecNet.Store;
+using RadicadeServer.RecNet.Storefront;
+using RadicadeServer.API.Moderation;
+using RadicadeServer.Clubs;
+using RadicadeServer.Utils;
+
+namespace RadicadeServer.Admin;
+
+[Route("admin/panel")]
+[EnableCors("AdminPanel")]
+public class AdminPanelAPI(RecDBContext db) : Controller
+{
+	private static readonly JsonSerializerOptions JsonOptions = new() { WriteIndented = true };
+	private static readonly object StateLock = new();
+
+
+
+	private static readonly PasswordHasher<PlayerData> PasswordHasher = new();
+
+	private const long RadicadeTeamAccountId = 1;
+	private static string StatePath => Path.Join(DBConfig.PersistentLogs, "admin-panel-state.json");
+
+	private static readonly SemaphoreSlim WeeklySaveGate = new(1);
+
+
+
+    private static List<Gift> WeeklyRewards()
+
+    {
+
+        var options = new JsonSerializerOptions { PropertyNameCaseInsensitive = true };
+
+        var equipment = JsonSerializer.Deserialize<List<Equipment>>(DBConfig.DefaultEquipmentItems, options) ?? [];
+
+        var avatars = JsonSerializer.Deserialize<List<AvatarItem>>(DBConfig.DefaultAvatarCatalog, options) ?? [];
+
+        return equipment.Where(x => !string.IsNullOrWhiteSpace(x.PrefabName) && !string.IsNullOrWhiteSpace(x.ModificationGuid))
+
+            .Select(x => new Gift { EquipmentPrefabName = x.PrefabName, EquipmentModificationGuid = x.ModificationGuid,
+
+                FriendlyName = x.FriendlyName, Tooltip = x.Tooltip, Rarity = x.Rarity, Context = GiftContext.All_Weekly_Challenge_Complete })
+
+            .Concat(avatars.Where(x => !string.IsNullOrWhiteSpace(x.AvatarItemDesc)).Select(x => new Gift {
+
+                AvatarItemDesc = x.AvatarItemDesc, AvatarItemType = (AvatarItemType)x.AvatarItemType,
+
+                FriendlyName = x.FriendlyName, Tooltip = x.Tooltip, Rarity = (Rarity)x.Rarity, Context = GiftContext.All_Weekly_Challenge_Complete }))
+
+            .DistinctBy(WeeklyRewardKey).ToList();
+
+    }
+
+
+
+    private static string WeeklyRewardKey(Gift gift) => !string.IsNullOrWhiteSpace(gift.AvatarItemDesc)
+
+        ? "avatar:" + gift.AvatarItemDesc : "equipment:" + gift.EquipmentPrefabName + ":" + gift.EquipmentModificationGuid;
+
+
+
+    [HttpGet("weekly-challenges/rewards")]
+
+    public async Task<IActionResult> GetWeeklyRewards([FromQuery] string key)
+
+    {
+
+        var rejection = await RejectInvalidKey(key);
+
+        if (rejection != null) return rejection;
+
+        return Ok(WeeklyRewards().Select(g => new { key = WeeklyRewardKey(g),
+
+            kind = string.IsNullOrWhiteSpace(g.AvatarItemDesc) ? "equipment" : "avatar",
+
+            name = string.IsNullOrWhiteSpace(g.FriendlyName) ? WeeklyRewardKey(g) : g.FriendlyName,
+
+            detail = string.IsNullOrWhiteSpace(g.AvatarItemDesc) ? g.EquipmentPrefabName + " · " + g.EquipmentModificationGuid : g.AvatarItemDesc }));
+
+    }
+
+
+
+    [HttpGet("weekly-challenges")]
+
+    public async Task<IActionResult> GetWeeklySchedule([FromQuery] string key)
+
+    {
+
+        var rejection = await RejectInvalidKey(key);
+
+        if (rejection != null) return rejection;
+
+        var weeks = new List<RadicadeServer.RecNet.Progression.Challenges.WeeklyChallengeMap>();
+
+        var now = DateTime.UtcNow;
+
+        for (var i = 0; i < 4; i++) weeks.Add(await WeeklyChallenges.GetDefinitionAsync(db, now.AddDays(i * 7)));
+
+        return Ok(new { weeks, current = weeks[0], next = weeks[1], required = WeeklyChallenges.Required });
+
+    }
+
+
+
+    [HttpPost("weekly-challenges")]
+
+    public async Task<IActionResult> SaveWeeklySchedule([FromQuery] string key, [FromBody] WeeklyScheduleRequest? request)
+
+    {
+
+        var rejection = await RejectInvalidKey(key);
+
+        if (rejection != null) return rejection;
+
+        var current = WeeklyChallenges.CreateMap(DateTime.UtcNow);
+
+        if (request == null) return BadRequest("Choose a weekly schedule.");
+
+        var offset = request.ChallengeMapId - current.ChallengeMapId;
+
+        if (offset < 0 || offset > 3) return Conflict("The weekly schedule changed. Reload the page.");
+
+        var map = WeeklyChallenges.CreateMap(current.StartAt.AddDays(offset * 7));
+
+        if (request.ChallengeIds == null || request.ChallengeIds.Count is < 3 or > 5
+
+            || request.ChallengeIds.Distinct().Count() != request.ChallengeIds.Count)
+
+            return BadRequest("Choose three to five different challenges.");
+
+        if (string.IsNullOrWhiteSpace(request.Title) || request.Title.Length > 100 || request.FallbackTokens is < 1 or > 10000)
+
+            return BadRequest("Enter a title (up to 100 characters) and 1–10,000 fallback tokens.");
+
+        var reward = WeeklyRewards().FirstOrDefault(x => WeeklyRewardKey(x) == request.RewardKey);
+
+        if (reward == null) return BadRequest("Choose an equipment skin or avatar item from the catalog.");
+
+        var library = LoadState().Challenges;
+
+        foreach (var id in request.ChallengeIds)
+
+        {
+
+            var row = library.FirstOrDefault(x => x["id"]?.ToString() == id.ToString(CultureInfo.InvariantCulture));
+
+            var config = row?["config"]?.ToString() ?? "";
+
+            if (row == null || id <= 0 || id > int.MaxValue || string.IsNullOrWhiteSpace(row["name"]?.ToString())
+
+                || !WeeklyChallenges.IsSupportedDefinition(config))
+
+                return BadRequest($"Challenge {id} is missing or unsupported. Edit it using a gameplay preset.");
+
+            map.Challenges.Add(new() { ChallengeId = (int)id, Name = row["name"]!.ToString(),
+
+                Description = row["description"]?.ToString() ?? "", Tooltip = row["tooltip"]?.ToString() ?? "", Config = config });
+
+        }
+
+        map.Enabled = request.Enabled;
+
+        map.ChallengeThemeString = request.Title.Trim();
+
+        map.Gift = reward.ForClient();
+
+        map.FallbackTokens = request.FallbackTokens;
+
+        map.FallbackGiftName = $"{request.FallbackTokens} Tokens";
+
+        map.Revision = Guid.NewGuid().ToString("N");
+
+        await WeeklySaveGate.WaitAsync();
+
+        try
+
+        {
+
+            return await db.Database.CreateExecutionStrategy().ExecuteAsync<IActionResult>(async () =>
+
+            {
+
+                db.ChangeTracker.Clear();
+
+                await using var tx = db.Database.IsSqlServer()
+
+                    ? await db.Database.BeginTransactionAsync(System.Data.IsolationLevel.Serializable) : null;
+
+                var scheduleKey = WeeklyChallenges.ScheduleKey(map.ChallengeMapId);
+
+                var query = db.Database.IsSqlServer()
+
+                    ? db.ServerConfig.FromSqlInterpolated($"SELECT * FROM [ServerConfig] WITH (UPDLOCK, HOLDLOCK) WHERE [Key] = {scheduleKey}")
+
+                    : db.ServerConfig.Where(x => x.Key == scheduleKey);
+
+                var record = await query.SingleOrDefaultAsync();
+
+                var revision = record == null ? "" : JsonSerializer.Deserialize<RadicadeServer.RecNet.Progression.Challenges.WeeklyChallengeMap>(record.Value)!.Revision;
+
+                if (revision != request.Revision) return Conflict("This weekly was edited elsewhere. Reload before saving.");
+
+                if (record == null) db.ServerConfig.Add(new ServerConfigVal(scheduleKey, JsonSerializer.Serialize(map)));
+
+                else record.Value = JsonSerializer.Serialize(map);
+
+                await db.SaveChangesAsync();
+
+                if (tx != null) await tx.CommitAsync();
+
+                return Ok(map);
+
+            });
+
+        }
+
+        finally { WeeklySaveGate.Release(); }
+
+    }
+
+
+
+	private static AdminPanelState LoadState()
+	{
+		lock (StateLock)
+		{
+			if (!System.IO.File.Exists(StatePath))
+				return new AdminPanelState();
+
+			try
+			{
+				var json = System.IO.File.ReadAllText(StatePath);
+				return JsonSerializer.Deserialize<AdminPanelState>(json, JsonOptions) ?? new AdminPanelState();
+			}
+			catch
+			{
+				return new AdminPanelState();
+			}
+		}
+	}
+
+	private static void SaveState(AdminPanelState state)
+	{
+		lock (StateLock)
+		{
+			Directory.CreateDirectory(DBConfig.PersistentLogs);
+			System.IO.File.WriteAllText(StatePath, JsonSerializer.Serialize(state, JsonOptions));
+		}
+	}
+
+
+
+
+
+
+
+
+
+
+
+
+
+	public static void AddModerationReport(long reporterId, long reportedId, string reportMsg, string details, ReportCategory category, long roomId,
+		string? reportType = null, long? targetId = null, string? targetName = null)
+	{
+		lock (StateLock)
+		{
+			var state = LoadState();
+
+			long nextId = 1;
+			foreach (var existing in state.ModerationReports)
+			{
+				var rawId = existing["id"]?.ToString();
+				if (rawId != null && long.TryParse(rawId, out var parsedId) && parsedId >= nextId)
+					nextId = parsedId + 1;
+			}
+
+			var report = new JsonObject
+			{
+				["id"] = nextId,
+				["report_type"] = reportType ?? "Moderator",
+				["reporter_id"] = reporterId,
+				["reported_id"] = reportedId,
+				["reason"] = reportMsg,
+				["details"] = details,
+				["category"] = (int)category,
+				["room_id"] = roomId,
+				["status"] = "Pending",
+				["resolution_notes"] = "",
+				["created_at"] = DateTime.UtcNow.ToString("O")
+			};
+
+			if (targetId.HasValue)
+				report["target_id"] = targetId.Value;
+			if (!string.IsNullOrWhiteSpace(targetName))
+				report["target_name"] = targetName;
+
+			state.ModerationReports.Add(report);
+
+			SaveState(state);
+		}
+	}
+
+	private Task<IActionResult?> RejectInvalidKey(string key)
+	{
+		return Task.FromResult<IActionResult?>(key.IsAdminKey() ? null : Unauthorized("Invalid secret"));
+	}
+
+	/// The first of these that carries something: an item's own name beats nothing, and a
+	/// catalogue's name beats a raw descriptor used as one.
+	private static string NonEmpty(params string?[] values)
+	{
+		foreach (var value in values)
+		{
+			if (!string.IsNullOrWhiteSpace(value)) return value.Trim();
+		}
+		return "";
+	}
+
+	private static string RarityLabel(int rarity) => ((Rarity)rarity).ToString();
+
+	private static string ImageUrl(string? name)
+	{
+		if (string.IsNullOrWhiteSpace(name) ||
+			name.Equals("default", StringComparison.OrdinalIgnoreCase) ||
+			name.Equals("default.png", StringComparison.OrdinalIgnoreCase) ||
+			name.Equals(DBConfig.DefaultProfileImage, StringComparison.OrdinalIgnoreCase) ||
+			name.Equals(DBConfig.DefaultRoomImage, StringComparison.OrdinalIgnoreCase))
+			return $"{DBConfig.ServerUrl}/images/default";
+		return $"{DBConfig.ServerUrl}/images/img/{name}";
+	}
+
+
+
+
+
+
+	private async Task<List<object>> GetAdminUsers(string? eqCol, string? eqVal)
+	{
+		var query = db.AdminUsers.AsNoTracking();
+		if (eqCol == "user_id" && !string.IsNullOrWhiteSpace(eqVal))
+			query = query.Where(x => x.Username == eqVal);
+
+		var rows = await query.ToListAsync();
+		return rows.Select(u => new
+		{
+			id = u.Id,
+			user_id = u.Username,
+			username = u.Username,
+			created_at = u.CreatedAt,
+			last_login_at = u.LastLoginAt
+		}).Cast<object>().ToList();
+	}
+
+	[HttpGet("session")]
+	public async Task<IActionResult> Session([FromQuery] string key)
+	{
+		var rejection = await RejectInvalidKey(key);
+		if (rejection != null) return rejection;
+
+
+
+		if (Request.Cookies.TryGetValue(AdminSession.CookieName, out var token))
+		{
+			var (ok, userId) = await AdminSession.ValidateAsync(db, token);
+			if (ok)
+			{
+				var user = await db.AdminUsers.AsNoTracking().FirstOrDefaultAsync(x => x.Id == userId);
+				if (user != null)
+					return Ok(new { user = new { id = user.Id, username = user.Username } });
+			}
+		}
+
+		return Ok(new { user = (object?)null });
+	}
+
+
+
+
+
+
+
+	[HttpGet("appeals")]
+	public async Task<IActionResult> ListAppeals([FromQuery] string key)
+	{
+		var rejection = await RejectInvalidKey(key);
+		if (rejection != null) return rejection;
+
+		var appeals = await db.Moderation
+			.AsNoTracking()
+			.Where(x => x.AppealCode != null && x.AppealText != null)
+			.OrderByDescending(x => x.AppealSubmittedAt)
+			.Select(x => new
+			{
+				id = x.Id,
+				player_id = x.PlayerId,
+				player_name = db.Profiles.Where(p => p.accountId == x.PlayerId).Select(p => p.username).FirstOrDefault() ?? "unknown",
+				code = x.AppealCode,
+				reason = x.Message,
+				category = x.Category.ToString(),
+				permanent = x.ExpireDuration >= DateTime.MaxValue.AddYears(-10),
+				expires_at = x.ExpireDuration,
+				appeal_text = x.AppealText,
+				appeal_contact = x.AppealContact,
+
+				email = db.Players.Where(pl => pl.AccountId == x.PlayerId).Select(pl => pl.Email).FirstOrDefault() ?? "",
+				submitted_at = x.AppealSubmittedAt,
+				resolution = x.AppealResolution,
+				resolved_at = x.AppealResolvedAt,
+				ban_active = x.IsBan && x.ExpireDuration > DateTime.UtcNow
+			})
+			.ToListAsync();
+
+		return Ok(appeals);
+	}
+
+
+
+
+
+
+
+
+
+	[HttpPost("appeals/{appealId:long}/accept")]
+	public async Task<IActionResult> AcceptAppeal(long appealId, [FromQuery] string key, [FromQuery(Name = "send_email")] string? sendEmail = null, [FromQuery(Name = "custom_email")] string? customEmail = null)
+	{
+		var rejection = await RejectInvalidKey(key);
+		if (rejection != null) return rejection;
+		var wantsEmail = sendEmail == "1" || string.Equals(sendEmail, "true", StringComparison.OrdinalIgnoreCase);
+
+		var ban = await db.Moderation.FirstOrDefaultAsync(x => x.Id == appealId && x.AppealCode != null && x.AppealText != null);
+		if (ban == null) return NotFound("Appeal not found");
+
+		ban.IsBan = false;
+		ban.AppealResolution = "Accepted";
+		ban.AppealResolvedAt = DateTime.UtcNow;
+		await db.SaveChangesAsync();
+
+
+
+
+		await NotifyLoginRefresh(ban.PlayerId);
+
+		if (wantsEmail)
+			await SendAppealEmailAsync(ban, accepted: true, customText: customEmail);
+
+		return Ok(new OkResponse { Success = true, Message = "Appeal accepted - ban lifted and player notified." });
+	}
+
+
+
+
+
+
+
+	[HttpPost("appeals/{appealId:long}/reject")]
+	public async Task<IActionResult> RejectAppeal(long appealId, [FromQuery] string key, [FromQuery(Name = "send_email")] string? sendEmail = null, [FromQuery(Name = "custom_email")] string? customEmail = null)
+	{
+		var rejection = await RejectInvalidKey(key);
+		if (rejection != null) return rejection;
+		var wantsEmail = sendEmail == "1" || string.Equals(sendEmail, "true", StringComparison.OrdinalIgnoreCase);
+
+		var ban = await db.Moderation.FirstOrDefaultAsync(x => x.Id == appealId && x.AppealCode != null && x.AppealText != null);
+		if (ban == null) return NotFound("Appeal not found");
+
+		ban.AppealResolution = "Rejected";
+		ban.AppealResolvedAt = DateTime.UtcNow;
+		await db.SaveChangesAsync();
+
+		if (wantsEmail)
+			await SendAppealEmailAsync(ban, accepted: false, customText: customEmail);
+
+		return Ok(new OkResponse { Success = true, Message = "Appeal rejected - ban remains active." });
+	}
+
+
+
+
+
+
+
+
+	[HttpPost("appeals/{appealId:long}/reduce")]
+	public async Task<IActionResult> ReduceAppealBanTime(long appealId, [FromQuery] string key,
+		[FromQuery(Name = "send_email")] string? sendEmail = null, [FromQuery(Name = "custom_email")] string? customEmail = null, [FromQuery] int minutes = 0)
+	{
+		var rejection = await RejectInvalidKey(key);
+		if (rejection != null) return rejection;
+		if (minutes <= 0)
+			return BadRequest(new OkResponse { Success = false, Message = "Enter how many minutes to reduce the ban by." });
+
+		var ban = await db.Moderation.FirstOrDefaultAsync(x => x.Id == appealId && x.AppealCode != null && x.AppealText != null);
+		if (ban == null) return NotFound("Appeal not found");
+		if (!ban.IsBan) return BadRequest(new OkResponse { Success = false, Message = "This ban is no longer active." });
+
+		var now = DateTime.UtcNow;
+		var reduction = TimeSpan.FromMinutes(minutes);
+		if (ban.ExpireDuration >= DateTime.MaxValue.AddYears(-10))
+		{
+
+			ban.ExpireDuration = now.Add(reduction);
+		}
+		else
+		{
+			var target = ban.ExpireDuration.Subtract(reduction);
+			ban.ExpireDuration = target < now.AddMinutes(1) ? now.AddMinutes(1) : target;
+		}
+
+
+		ban.AppealResolution = "Reduced";
+		ban.AppealResolvedAt = DateTime.UtcNow;
+		await db.SaveChangesAsync();
+
+		await NotifyLoginRefresh(ban.PlayerId);
+
+		var wantsEmail = sendEmail == "1" || string.Equals(sendEmail, "true", StringComparison.OrdinalIgnoreCase);
+		if (wantsEmail)
+			await SendAppealTimeChangeEmailAsync(ban, reduced: true, customText: customEmail);
+
+		return Ok(new OkResponse { Success = true, Message = "Ban time reduced - player notified." });
+	}
+
+
+
+
+
+
+
+	[HttpPost("appeals/{appealId:long}/extend")]
+	public async Task<IActionResult> ExtendAppealBanTime(long appealId, [FromQuery] string key,
+		[FromQuery(Name = "send_email")] string? sendEmail = null, [FromQuery(Name = "custom_email")] string? customEmail = null, [FromQuery] int minutes = 0)
+	{
+		var rejection = await RejectInvalidKey(key);
+		if (rejection != null) return rejection;
+		if (minutes <= 0)
+			return BadRequest(new OkResponse { Success = false, Message = "Enter how many minutes to extend the ban by." });
+
+		var ban = await db.Moderation.FirstOrDefaultAsync(x => x.Id == appealId && x.AppealCode != null && x.AppealText != null);
+		if (ban == null) return NotFound("Appeal not found");
+		if (!ban.IsBan) return BadRequest(new OkResponse { Success = false, Message = "This ban is no longer active." });
+		if (ban.ExpireDuration >= DateTime.MaxValue.AddYears(-10))
+			return BadRequest(new OkResponse { Success = false, Message = "This ban is permanent and cannot be extended." });
+
+		ban.ExpireDuration = ban.ExpireDuration.AddMinutes(minutes);
+
+
+		ban.AppealResolution = "Extended";
+		ban.AppealResolvedAt = DateTime.UtcNow;
+		await db.SaveChangesAsync();
+
+		await NotifyLoginRefresh(ban.PlayerId);
+
+		var wantsEmail = sendEmail == "1" || string.Equals(sendEmail, "true", StringComparison.OrdinalIgnoreCase);
+		if (wantsEmail)
+			await SendAppealTimeChangeEmailAsync(ban, reduced: false, customText: customEmail);
+
+		return Ok(new OkResponse { Success = true, Message = "Ban time extended - player notified." });
+	}
+
+
+
+
+
+
+	private async Task NotifyLoginRefresh(long playerId)
+	{
+		var profile = await db.Profiles.FirstOrDefaultAsync(x => x.accountId == playerId);
+		if (profile != null)
+		{
+			await Notify.SendNotify(playerId, new Notification { Id = NotificationType.RefreshLogin, Msg = profile });
+		}
+	}
+
+
+
+
+
+
+	private async Task SendAppealEmailAsync(RecNet.Moderation.ModerationDB ban, bool accepted, string? customText = null)
+	{
+		if (string.IsNullOrWhiteSpace(DBConfig.MailApiKey))
+		{
+			return;
+		}
+
+		var player = await db.Players.AsNoTracking().FirstOrDefaultAsync(x => x.AccountId == ban.PlayerId);
+		var email = player?.Email;
+		if (string.IsNullOrWhiteSpace(email) || !email.Contains('@')) return;
+
+		var profile = await db.Profiles.AsNoTracking().FirstOrDefaultAsync(x => x.accountId == ban.PlayerId);
+		var name = string.IsNullOrWhiteSpace(profile?.username) ? "there" : profile.username;
+		var reason = string.IsNullOrWhiteSpace(ban.Message) ? "the listed reason" : ban.Message;
+
+		if (!string.IsNullOrWhiteSpace(customText))
+		{
+			var subject = accepted ? "Your Radicade ban appeal was approved" : "Your Radicade ban appeal was rejected";
+			await RadicadeMail.SendAsync(email, subject, BuildCustomEmailHtml(subject, customText));
+			return;
+		}
+
+		if (accepted)
+		{
+			var html =
+				$"<div style=\"font-family:Arial,sans-serif;max-width:520px;margin:0 auto;padding:24px;\">" +
+				$"<img src=\"https://radicade.app/assests/RadicadeHorizontal.png\" alt=\"Radicade\" style=\"display:block;max-width:220px;height:auto;margin:0 auto 22px;\" />" +
+				$"<h2 style=\"color:#1a1a2e;margin-top:0;\">Your Radicade ban appeal was approved</h2>" +
+				$"<p style=\"color:#444;font-size:15px;line-height:1.6;\">Hi {HtmlEncode(name)},</p>" +
+				$"<p style=\"color:#444;font-size:15px;line-height:1.6;\">Your appeal against the ban for <b>{HtmlEncode(reason)}</b> has been <b>accepted</b>. The ban has been lifted and you can log back into Radicade.</p>" +
+				$"<p style=\"color:#444;font-size:15px;line-height:1.6;\">Thanks for reaching out - enjoy the game!</p>" +
+				$"<p style=\"color:#999;font-size:12px;margin-top:24px;\">- Radicade Moderation</p></div>";
+
+			await RadicadeMail.SendAsync(email, "Your Radicade ban appeal was approved", html);
+		}
+		else
+		{
+			var html =
+				$"<div style=\"font-family:Arial,sans-serif;max-width:520px;margin:0 auto;padding:24px;\">" +
+				$"<img src=\"https://radicade.app/assests/RadicadeHorizontal.png\" alt=\"Radicade\" style=\"display:block;max-width:220px;height:auto;margin:0 auto 22px;\" />" +
+				$"<h2 style=\"color:#1a1a2e;margin-top:0;\">Your Radicade ban appeal was rejected</h2>" +
+				$"<p style=\"color:#444;font-size:15px;line-height:1.6;\">Hi {HtmlEncode(name)},</p>" +
+				$"<p style=\"color:#444;font-size:15px;line-height:1.6;\">We reviewed your appeal against the ban for <b>{HtmlEncode(reason)}</b> and it was <b>rejected</b>. The ban remains active.</p>" +
+				$"<p style=\"color:#444;font-size:15px;line-height:1.6;\">If you believe this decision was a mistake, you may submit another appeal once the cooldown period has passed.</p>" +
+				"<p style=\"color:#444;font-size:15px;line-height:1.6;\">Take this time to review our Code Of Conduct:</p>" +
+				"<p style=\"text-align:center;margin:24px 0;\"><a href=\"https://radicade.app/code-of-conduct\" style=\"background:#4a6cf7;color:#fff;text-decoration:none;padding:12px 28px;border-radius:6px;display:inline-block;\">Code Of Conduct</a></p>" +
+				$"<p style=\"color:#999;font-size:12px;margin-top:24px;\">- Radicade Moderation</p></div>";
+
+			await RadicadeMail.SendAsync(email, "Your Radicade ban appeal was rejected", html);
+		}
+	}
+
+
+
+
+
+
+
+	private async Task SendAppealTimeChangeEmailAsync(RecNet.Moderation.ModerationDB ban, bool reduced, string? customText = null)
+	{
+		if (string.IsNullOrWhiteSpace(DBConfig.MailApiKey))
+		{
+			return;
+		}
+
+		var player = await db.Players.AsNoTracking().FirstOrDefaultAsync(x => x.AccountId == ban.PlayerId);
+		var email = player?.Email;
+		if (string.IsNullOrWhiteSpace(email) || !email.Contains('@')) return;
+
+		var profile = await db.Profiles.AsNoTracking().FirstOrDefaultAsync(x => x.accountId == ban.PlayerId);
+		var name = string.IsNullOrWhiteSpace(profile?.username) ? "there" : profile.username;
+		var reason = string.IsNullOrWhiteSpace(ban.Message) ? "the listed reason" : ban.Message;
+
+		var action = reduced ? "reduced" : "extended";
+
+		if (!string.IsNullOrWhiteSpace(customText))
+		{
+			var subject = $"Your Radicade ban time was {action}";
+			await RadicadeMail.SendAsync(email, subject, BuildCustomEmailHtml(subject, customText));
+			return;
+		}
+		var permanent = ban.ExpireDuration >= DateTime.MaxValue.AddYears(-10);
+		var when = permanent
+			? "permanent"
+			: DateTime.SpecifyKind(ban.ExpireDuration, DateTimeKind.Utc).ToString("MMM d, yyyy 'at' h:mm tt 'UTC'");
+
+
+		var cocCta = reduced
+			? ""
+			: "<p style=\"color:#444;font-size:15px;line-height:1.6;\">Take this time to review our Code Of Conduct:</p>" +
+			  "<p style=\"text-align:center;margin:24px 0;\"><a href=\"https://radicade.app/code-of-conduct\" style=\"background:#4a6cf7;color:#fff;text-decoration:none;padding:12px 28px;border-radius:6px;display:inline-block;\">Code Of Conduct</a></p>";
+
+		var html =
+			$"<div style=\"font-family:Arial,sans-serif;max-width:520px;margin:0 auto;padding:24px;\">" +
+			$"<img src=\"https://radicade.app/assests/RadicadeHorizontal.png\" alt=\"Radicade\" style=\"display:block;max-width:220px;height:auto;margin:0 auto 22px;\" />" +
+			$"<h2 style=\"color:#1a1a2e;margin-top:0;\">Your Radicade ban time was {action}</h2>" +
+			$"<p style=\"color:#444;font-size:15px;line-height:1.6;\">Hi {HtmlEncode(name)},</p>" +
+			$"<p style=\"color:#444;font-size:15px;line-height:1.6;\">As part of your appeal, the ban for <b>{HtmlEncode(reason)}</b> has been <b>{action}</b>. It now ends <b>{when}</b>.</p>" +
+			cocCta +
+			$"<p style=\"color:#999;font-size:12px;margin-top:24px;\">- Radicade Moderation</p></div>";
+
+		await RadicadeMail.SendAsync(email, $"Your Radicade ban time was {action}", html);
+	}
+
+	private static string BuildCustomEmailHtml(string title, string customText)
+	{
+		var body = HtmlEncode(customText).Replace("\r", "").Replace("\n", "<br />");
+		return
+			$"<div style=\"font-family:Arial,sans-serif;max-width:520px;margin:0 auto;padding:24px;\">" +
+			$"<img src=\"https://radicade.app/assests/RadicadeHorizontal.png\" alt=\"Radicade\" style=\"display:block;max-width:220px;height:auto;margin:0 auto 22px;\" />" +
+			$"<h2 style=\"color:#1a1a2e;margin-top:0;\">{HtmlEncode(title)}</h2>" +
+			$"<p style=\"color:#444;font-size:15px;line-height:1.6;\">{body}</p>" +
+			$"<p style=\"color:#999;font-size:12px;margin-top:24px;\">- Radicade Moderation</p></div>";
+	}
+
+	private static string HtmlEncode(string value)
+	{
+		return System.Net.WebUtility.HtmlEncode(value);
+	}
+
+
+
+
+
+
+	private static readonly Dictionary<string, RoleType> RoomRoleNames = new(StringComparer.OrdinalIgnoreCase)
+	{
+		["none"] = RoleType.None,
+		["banned"] = RoleType.Banned,
+		["host"] = RoleType.Host,
+		["moderator"] = RoleType.Moderator,
+		["co-owner"] = RoleType.CoOwner,
+		["coowner"] = RoleType.CoOwner,
+		["temporarycoowner"] = RoleType.TemporaryCoOwner,
+		["creator"] = RoleType.Creator
+	};
+
+	private static string RoomRoleKey(RoleType role) => role switch
+	{
+		RoleType.Creator => "creator",
+		RoleType.CoOwner => "co-owner",
+		RoleType.TemporaryCoOwner => "co-owner",
+		RoleType.Moderator => "moderator",
+		RoleType.Host => "host",
+		_ => "none"
+	};
+
+	private static bool TryParseRoomRole(string? raw, out RoleType role)
+	{
+		role = RoleType.None;
+		if (string.IsNullOrWhiteSpace(raw)) return false;
+		if (RoomRoleNames.TryGetValue(raw.Trim(), out role)) return true;
+		if (int.TryParse(raw, NumberStyles.Integer, CultureInfo.InvariantCulture, out var numeric) && Enum.IsDefined(typeof(RoleType), numeric))
+		{
+			role = (RoleType)numeric;
+			return true;
+		}
+		return Enum.TryParse(raw, true, out role);
+	}
+
+	private static bool TryParseRoomAccessibility(string? raw, out Accessibility value)
+	{
+		value = Accessibility.Public;
+		if (string.IsNullOrWhiteSpace(raw)) return false;
+		if (int.TryParse(raw, NumberStyles.Integer, CultureInfo.InvariantCulture, out var numeric))
+		{
+			if (!Enum.IsDefined(typeof(Accessibility), numeric)) return false;
+			value = (Accessibility)numeric;
+			return true;
+		}
+		return Enum.TryParse(raw, true, out value) && Enum.IsDefined(typeof(Accessibility), value);
+	}
+
+	private static Accessibility ParseRoomAccessibility(string? raw)
+		=> TryParseRoomAccessibility(raw, out var parsed) ? parsed : Accessibility.Public;
+
+	[HttpGet("rooms/{roomId:long}")]
+	public async Task<IActionResult> RoomPanelDetails(long roomId, [FromQuery] string key)
+	{
+		var rejection = await RejectInvalidKey(key);
+		if (rejection != null) return rejection;
+
+		var room = await db.Rooms.AsNoTracking().FirstOrDefaultAsync(x => x.RoomId == roomId);
+		if (room == null) return NotFound("Room does not exist.");
+
+		var stats = await db.RoomStats.AsNoTracking().FirstOrDefaultAsync(x => x.RoomId == roomId);
+
+		var roleRows = await db.RoomRoles.AsNoTracking().Where(x => x.RoomId == roomId).ToListAsync();
+		var roleAccountIds = roleRows.Select(r => r.AccountId).Append(room.CreatorAccountId).Distinct().ToList();
+		var roleProfiles = await db.Profiles.AsNoTracking().Where(x => roleAccountIds.Contains(x.accountId)).ToDictionaryAsync(x => x.accountId);
+
+		object RoleRow(long accountId, RoleType role)
+		{
+			roleProfiles.TryGetValue(accountId, out var member);
+			var handle = member?.username ?? $"account_{accountId}";
+			return new
+			{
+				account_id = accountId,
+				username = handle,
+				display_name = string.IsNullOrWhiteSpace(member?.displayName) ? handle : member!.displayName,
+				profile_image = ImageUrl(member?.profileImage),
+				role = RoomRoleKey(role),
+				role_key = role.ToString(),
+				role_value = (int)role,
+				is_creator = accountId == room.CreatorAccountId
+			};
+		}
+
+		var members = new List<object>();
+		var seenAccounts = new HashSet<long>();
+
+		members.Add(RoleRow(room.CreatorAccountId, RoleType.Creator));
+		seenAccounts.Add(room.CreatorAccountId);
+
+		foreach (var row in roleRows.OrderBy(r => (int)r.Role).ThenBy(r => r.AccountId))
+		{
+			if (!seenAccounts.Add(row.AccountId)) continue;
+			members.Add(RoleRow(row.AccountId, row.Role));
+		}
+
+		var subRows = await db.SubRooms.AsNoTracking().Where(x => x.RoomId == roomId).OrderBy(x => x.SubRoomId).ToListAsync();
+		var subrooms = subRows.Select((sub, index) => (object)new
+		{
+			id = sub.SubRoomId,
+			name = sub.Name,
+			list = index + 1,
+			maxPlayers = sub.MaxPlayers,
+			max_players = sub.MaxPlayers,
+			accessibility = sub.Accessibility.ToString().ToLowerInvariant(),
+			sandbox = sub.IsSandbox,
+			save = sub.DataBlob ?? "",
+			unity_scene_id = sub.UnitySceneId,
+			created_at = DateTime.SpecifyKind(sub.CreatedAt, DateTimeKind.Utc)
+		}).ToList();
+
+		var saves = new List<object>();
+		try
+		{
+			if (Directory.Exists(DBConfig.CDNStorage))
+			{
+				saves = Directory.GetFiles(DBConfig.CDNStorage, "*.room")
+					.OrderByDescending(f => System.IO.File.GetLastWriteTimeUtc(f))
+					.Select(f => (object)new { id = Path.GetFileName(f), label = Path.GetFileName(f) })
+					.ToList();
+			}
+		}
+		catch
+		{
+			saves = new List<object>();
+		}
+
+		return Ok(new
+		{
+			room = new
+			{
+				id = room.RoomId,
+				name = room.Name,
+				description = room.Description,
+				image_name = room.ImageName,
+				custom_warning = room.CustomWarning,
+				creator_account_id = room.CreatorAccountId,
+				publish_state = room.State.ToString(),
+				accessibility = room.Accessibility.ToString(),
+				tags = room.Tags,
+				is_dorm = room.IsDorm,
+				is_rro = room.IsRRO,
+				cloning_allowed = room.CloningAllowed,
+				disable_mic_auto_mute = room.DisableMicAutoMute,
+				disable_room_comments = room.DisableRoomComments,
+				encrypt_voice_chat = room.EncryptVoiceChat,
+				supports_screens = room.SupportsScreens,
+				supports_walk_vr = room.SupportsWalkVR,
+				supports_teleport_vr = room.SupportsTeleportVR,
+				supports_quest2 = room.SupportsQuest2,
+				supports_mobile = room.SupportsMobile,
+				supports_juniors = room.SupportsJuniors,
+				min_level = room.MinLevel,
+				max_players = room.MaxPlayers,
+				max_player_calculation_mode = (int)room.MaxPlayerCalculationMode,
+				created_at = DateTime.SpecifyKind(room.CreatedAt, DateTimeKind.Utc),
+				published_at = room.PublishedAt == default ? (DateTime?)null : DateTime.SpecifyKind(room.PublishedAt, DateTimeKind.Utc),
+				featured = SafeRoomTags(room.Tags).Any(t => string.Equals(t, "featured", StringComparison.OrdinalIgnoreCase)),
+				cheer_count = stats?.CheerCount ?? 0,
+				favorite_count = stats?.FavoriteCount ?? 0,
+				visitor_count = stats?.VisitorCount ?? 0,
+				visit_count = stats?.VisitCount ?? 0,
+				join_gift_enabled = room.JoinGiftEnabled,
+				join_gift_once_per_player = room.JoinGiftOncePerPlayer,
+				join_gift_version = room.JoinGiftVersion,
+				join_gift_title = room.JoinGiftTitle,
+				join_gift_message = room.JoinGiftMessage,
+				join_gift_avatar_item = room.JoinGiftAvatarItem,
+				join_gift_equipment_item = room.JoinGiftEquipmentItem,
+				join_gift_consumable_item = room.JoinGiftConsumableItem,
+				join_gift_currency_amount = room.JoinGiftCurrencyAmount,
+				join_gift_currency_type = room.JoinGiftCurrencyType.ToString(),
+				join_gift_xp = room.JoinGiftXp,
+				join_gift_context = room.JoinGiftContext.ToString(),
+				join_gift_rarity = room.JoinGiftRarity.ToString(),
+				join_gift_avatar_item_type = room.JoinGiftAvatarItemType.ToString(),
+				join_gift_equipment_modification_guid = room.JoinGiftEquipmentModificationGuid,
+				// Digits in a string: an account id is eighteen digits and a JSON number would
+				// arrive in the panel rounded, so a saved id could name the wrong account.
+				join_gift_from_player_id = Math.Max(0, room.JoinGiftFromPlayerId).ToString(CultureInfo.InvariantCulture),
+				join_gifts = JoinGiftRows(room, await RoomJoinGiftUtils.ConfiguredGiftsAsync(db, room.RoomId))
+			},
+			roles = members,
+			subrooms,
+			saves
+		});
+	}
+
+	[HttpPost("rooms/{roomId:long}/name")]
+	public async Task<IActionResult> RenameRoom(long roomId, [FromQuery] string key, [FromQuery] string? name)
+	{
+		var rejection = await RejectInvalidKey(key);
+		if (rejection != null) return rejection;
+
+		var next = (name ?? "").Trim();
+		if (string.IsNullOrWhiteSpace(next)) return BadRequest("A room has to have a name.");
+		if (next.Length > 64) return BadRequest("Room names are limited to 64 characters.");
+
+		var room = await db.Rooms.FirstOrDefaultAsync(x => x.RoomId == roomId);
+		if (room == null) return NotFound("Room does not exist.");
+
+		var previous = room.Name;
+		room.Name = next;
+		await db.SaveChangesAsync();
+
+		AdminActionDiscord.LogAction("Rename Room", await GetPanelAdminUsernameAsync(), $"Renamed room {roomId} from \"{previous}\" to \"{next}\".");
+
+		return Ok(new { success = true, room_id = roomId, name = room.Name });
+	}
+
+	[HttpPost("rooms/{roomId:long}/roles")]
+	public async Task<IActionResult> SetRoomRole(long roomId, [FromQuery] string key, [FromQuery] long accountId, [FromQuery] string? role)
+	{
+		var rejection = await RejectInvalidKey(key);
+		if (rejection != null) return rejection;
+
+		var room = await db.Rooms.FirstOrDefaultAsync(x => x.RoomId == roomId);
+		if (room == null) return NotFound("Room does not exist.");
+
+		if (!TryParseRoomRole(role, out var nextRole)) return BadRequest("Unknown room role.");
+		if (accountId == room.CreatorAccountId && nextRole != RoleType.Creator)
+			return BadRequest("The room's creator keeps the Creator role.");
+
+		var existing = await db.RoomRoles.FirstOrDefaultAsync(x => x.RoomId == roomId && x.AccountId == accountId);
+		if (existing == null)
+		{
+			db.RoomRoles.Add(new RoomRole
+			{
+				RoomId = roomId,
+				AccountId = accountId,
+				Role = nextRole,
+				InvitedRole = RoleType.None
+			});
+		}
+		else
+		{
+			if (existing.Role == nextRole) return Ok(new { success = true, room_id = roomId, account_id = accountId, role = RoomRoleKey(nextRole) });
+			existing.Role = nextRole;
+		}
+
+		await db.SaveChangesAsync();
+
+		try
+		{
+			var updatedRoom = await RoomUtils.GetRoom(roomId);
+			if (updatedRoom != null)
+				await Notify.SendNotify(accountId, new Notification { Id = "RoomUpdate", Msg = updatedRoom });
+		}
+		catch (Exception) { }
+
+		AdminActionDiscord.LogAction("Room Role", await GetPanelAdminUsernameAsync(),
+			$"Set account {accountId} to {nextRole} on room {roomId} ({room.Name}).");
+
+		return Ok(new { success = true, room_id = roomId, account_id = accountId, role = RoomRoleKey(nextRole) });
+	}
+
+	[HttpPost("rooms/{roomId:long}/subrooms/add")]
+	public async Task<IActionResult> AddSubroom(long roomId, [FromQuery] string key, [FromQuery] string? name,
+		[FromQuery] int maxPlayers = 0, [FromQuery] string? accessibility = null, [FromQuery] string? sandbox = null, [FromQuery] string? saveId = null)
+	{
+		var rejection = await RejectInvalidKey(key);
+		if (rejection != null) return rejection;
+
+		var room = await db.Rooms.FirstOrDefaultAsync(x => x.RoomId == roomId);
+		if (room == null) return NotFound("Room does not exist.");
+
+		var subName = (name ?? "").Trim();
+		if (string.IsNullOrWhiteSpace(subName)) return BadRequest("A new subroom needs a name.");
+
+		var sub = new SubRoom
+		{
+			RoomId = roomId,
+			Name = subName,
+			MaxPlayers = maxPlayers > 0 ? maxPlayers : 20,
+			Accessibility = ParseRoomAccessibility(accessibility),
+			IsSandbox = string.Equals(sandbox, "true", StringComparison.OrdinalIgnoreCase) || sandbox == "1",
+			DataBlob = saveId ?? "",
+			SavedByAccountId = room.CreatorAccountId,
+			CreatedAt = DateTime.UtcNow
+		};
+
+		db.SubRooms.Add(sub);
+		await db.SaveChangesAsync();
+
+		var index = await db.SubRooms.CountAsync(x => x.RoomId == roomId && x.SubRoomId <= sub.SubRoomId);
+
+		AdminActionDiscord.LogAction("Add Subroom", await GetPanelAdminUsernameAsync(),
+			$"Added subroom \"{sub.Name}\" to room {roomId} ({room.Name}).");
+
+		return Ok(new { success = true, subroomId = sub.SubRoomId, subroomList = index, maxPlayers = sub.MaxPlayers });
+	}
+
+	[HttpPost("rooms/{roomId:long}/subrooms/{subRoomId:long}/name")]
+	public async Task<IActionResult> RenameSubroom(long roomId, long subRoomId, [FromQuery] string key, [FromQuery] string? name)
+	{
+		var rejection = await RejectInvalidKey(key);
+		if (rejection != null) return rejection;
+
+		var next = (name ?? "").Trim();
+		if (string.IsNullOrWhiteSpace(next)) return BadRequest("A subroom has to have a name.");
+
+		var sub = await db.SubRooms.FirstOrDefaultAsync(x => x.SubRoomId == subRoomId && x.RoomId == roomId);
+		if (sub == null) return NotFound("Subroom does not exist.");
+
+		sub.Name = next;
+		await db.SaveChangesAsync();
+
+		AdminActionDiscord.LogAction("Rename Subroom", await GetPanelAdminUsernameAsync(), $"Renamed subroom {subRoomId} on room {roomId} to \"{next}\".");
+
+		return Ok(new { success = true, subroomId = sub.SubRoomId, name = sub.Name });
+	}
+
+	[HttpPost("rooms/{roomId:long}/subrooms/{subRoomId:long}/delete")]
+	public async Task<IActionResult> DeleteSubroom(long roomId, long subRoomId, [FromQuery] string key)
+	{
+		var rejection = await RejectInvalidKey(key);
+		if (rejection != null) return rejection;
+
+		var sub = await db.SubRooms.FirstOrDefaultAsync(x => x.SubRoomId == subRoomId && x.RoomId == roomId);
+		if (sub == null) return NotFound("Subroom does not exist.");
+
+		var permissions = await db.SubRoomPermissions.Where(x => x.subRoomId == subRoomId).ToListAsync();
+		if (permissions.Count > 0) db.SubRoomPermissions.RemoveRange(permissions);
+
+		db.SubRooms.Remove(sub);
+		await db.SaveChangesAsync();
+
+		AdminActionDiscord.LogAction("Delete Subroom", await GetPanelAdminUsernameAsync(), $"Deleted subroom \"{sub.Name}\" ({subRoomId}) from room {roomId}.");
+
+		return Ok(new { success = true, subroomId = subRoomId });
+	}
+
+	[HttpPost("rooms/{roomId:long}/saves")]
+	public async Task<IActionResult> UploadRoomSave(long roomId, [FromQuery] string key, [FromForm] List<IFormFile> file)
+	{
+		var rejection = await RejectInvalidKey(key);
+		if (rejection != null) return rejection;
+
+		var room = await db.Rooms.AsNoTracking().FirstOrDefaultAsync(x => x.RoomId == roomId);
+		if (room == null) return NotFound("Room does not exist.");
+
+		var chosen = file?.FirstOrDefault(f => f.Length > 0 && Path.GetExtension(f.FileName).Equals(".room", StringComparison.OrdinalIgnoreCase))
+			?? file?.FirstOrDefault(f => f.Length > 0);
+		if (chosen == null) return BadRequest("No .room save was uploaded.");
+
+		Directory.CreateDirectory(DBConfig.CDNStorage);
+		var stored = Guid.NewGuid().ToString("N") + Path.GetExtension(chosen.FileName).ToLowerInvariant();
+		using (var stream = new FileStream(Path.Join(DBConfig.CDNStorage, stored), FileMode.Create))
+		{
+			await chosen.CopyToAsync(stream);
+		}
+
+		AdminActionDiscord.LogAction("Upload Room Save", await GetPanelAdminUsernameAsync(),
+			$"Uploaded save \"{chosen.FileName}\" ({stored}) for room {roomId} ({room.Name}).");
+
+		return Ok(new { success = true, saveId = stored, fileName = chosen.FileName });
+	}
+
+	[HttpPost("rooms/{roomId:long}/subrooms/{subRoomId:long}/save")]
+	public async Task<IActionResult> SetSubroomSave(long roomId, long subRoomId, [FromQuery] string key,
+		[FromQuery] string? saveId, [FromForm] List<IFormFile>? file)
+	{
+		var rejection = await RejectInvalidKey(key);
+		if (rejection != null) return rejection;
+
+		var sub = await db.SubRooms.FirstOrDefaultAsync(x => x.SubRoomId == subRoomId && x.RoomId == roomId);
+		if (sub == null) return NotFound("Subroom does not exist.");
+
+		var chosen = file?.FirstOrDefault(f => f.Length > 0 && Path.GetExtension(f.FileName).Equals(".room", StringComparison.OrdinalIgnoreCase))
+			?? file?.FirstOrDefault(f => f.Length > 0);
+
+		string stored;
+		if (chosen != null)
+		{
+			Directory.CreateDirectory(DBConfig.CDNStorage);
+			stored = Guid.NewGuid().ToString("N") + Path.GetExtension(chosen.FileName).ToLowerInvariant();
+			using var stream = new FileStream(Path.Join(DBConfig.CDNStorage, stored), FileMode.Create);
+			await chosen.CopyToAsync(stream);
+		}
+		else
+		{
+			stored = (saveId ?? "").Trim();
+			stored = Path.GetFileName(stored);
+			if (!string.IsNullOrEmpty(stored) && !System.IO.File.Exists(Path.Join(DBConfig.CDNStorage, stored)))
+				return BadRequest($"No uploaded save named '{stored}'.");
+		}
+
+		sub.DataBlob = stored;
+		await db.SaveChangesAsync();
+
+		AdminActionDiscord.LogAction("Set Subroom Save", await GetPanelAdminUsernameAsync(),
+			$"Pointed subroom \"{sub.Name}\" ({subRoomId}) on room {roomId} at save \"{(string.IsNullOrEmpty(stored) ? "none" : stored)}\".");
+
+		return Ok(new { success = true, subroomId = sub.SubRoomId, saveId = stored });
+	}
+
+	[HttpPost("players/{playerId:long}/{kind}")]
+	public Task<IActionResult> PlayerPanelAction(long playerId, string kind, [FromQuery] string key)
+		=> ApplyPlayerPanelAction(playerId, kind, key);
+
+	[HttpPost("players/{playerId:long}/{kind}/{sub}")]
+	public Task<IActionResult> PlayerPanelSubAction(long playerId, string kind, string sub, [FromQuery] string key)
+		=> ApplyPlayerPanelAction(playerId, $"{kind}/{sub}", key);
+
+	/// Take one saved photo off an account's gallery: the row that indexes it, the cheers
+	/// that point at it, and the file itself. A player can do this to their own gallery in
+	/// game (ImagesAPI's deletesaved), so the panel does it the same way rather than
+	/// leaving the file behind.
+	[HttpDelete("players/{playerId:long}/photos/{imageId:long}")]
+	public async Task<IActionResult> DeletePlayerPhoto(long playerId, long imageId, [FromQuery] string key)
+	{
+		var rejection = await RejectInvalidKey(key);
+		if (rejection != null) return rejection;
+
+		var image = await db.Images.FirstOrDefaultAsync(x => x.Id == imageId && x.OwnerId == playerId);
+		if (image == null) return NotFound("That photo is not on this account's gallery.");
+
+		var cheers = db.ImageInteractions.Where(x => x.SavedImageId == image.Id);
+		db.ImageInteractions.RemoveRange(cheers);
+		db.Images.Remove(image);
+		await db.SaveChangesAsync();
+
+		var fullPath = Path.Join(DBConfig.CDNImages, image.Name);
+		if (System.IO.File.Exists(fullPath))
+			System.IO.File.Delete(fullPath);
+
+		AdminActionDiscord.LogAction("Delete Photo", await GetPanelAdminUsernameAsync(),
+			$"Deleted photo \"{image.Name}\" ({imageId}) from player {playerId}'s gallery.");
+		return Ok(new { success = true, player_id = playerId, image_id = imageId, name = image.Name });
+	}
+
+	/// Take one invention off the account that created it, along with the versions it was
+	/// saved in and every player's personal details about it. Requests and other accounts'
+	/// downloads of it stop resolving on the next read.
+	[HttpDelete("players/{playerId:long}/inventions/{inventionId:long}")]
+	public async Task<IActionResult> DeletePlayerInvention(long playerId, long inventionId, [FromQuery] string key)
+	{
+		var rejection = await RejectInvalidKey(key);
+		if (rejection != null) return rejection;
+
+		var invention = await db.Inventions.FirstOrDefaultAsync(x => x.InventionId == inventionId && x.CreatorPlayerId == playerId);
+		if (invention == null) return NotFound("That invention does not belong to this account.");
+
+		var versions = await db.InventionVersions.Where(x => x.InventionId == inventionId).ToListAsync();
+		var details = await db.InventionPersonalDetails.Where(x => x.InventionId == inventionId).ToListAsync();
+		db.InventionVersions.RemoveRange(versions);
+		db.InventionPersonalDetails.RemoveRange(details);
+		db.Inventions.Remove(invention);
+		await db.SaveChangesAsync();
+
+		AdminActionDiscord.LogAction("Delete Invention", await GetPanelAdminUsernameAsync(),
+			$"Deleted invention \"{invention.Name}\" ({inventionId}) created by player {playerId}, with {versions.Count} saved version(s).");
+		return Ok(new { success = true, player_id = playerId, invention_id = inventionId, name = invention.Name });
+	}
+
+	private async Task<IActionResult> ApplyPlayerPanelAction(long playerId, string kind, string key)
+	{
+		var rejection = await RejectInvalidKey(key);
+		if (rejection != null) return rejection;
+
+		var profile = await db.Profiles.AsNoTracking().FirstOrDefaultAsync(x => x.accountId == playerId);
+		if (profile == null) return NotFound("Player does not exist.");
+		var display = string.IsNullOrWhiteSpace(profile.displayName) ? profile.username : profile.displayName;
+
+		string? Q(string name)
+		{
+			var raw = Request.Query[name].ToString();
+			return string.IsNullOrEmpty(raw) ? null : raw;
+		}
+		bool QBool(string name, bool fallback = false)
+		{
+			var raw = Q(name);
+			if (raw == null) return fallback;
+			return raw.Equals("true", StringComparison.OrdinalIgnoreCase) || raw == "1";
+		}
+		int QInt(string name, int fallback = 0) => int.TryParse(Q(name), NumberStyles.Integer, CultureInfo.InvariantCulture, out var parsed) ? parsed : fallback;
+
+		var payload = new Dictionary<string, object?>();
+		var audit = "";
+
+		switch (kind)
+		{
+			case "ban":
+			{
+				var reason = (Q("reason") ?? "").Trim();
+				var seconds = QInt("durationSeconds", -1);
+				payload["banned"] = true;
+				payload["ban_reason"] = reason;
+				payload["ban_method"] = Q("banMethod") ?? "Admin Panel";
+				var moderatorNote = (Q("moderatorNote") ?? "").Trim();
+				if (!string.IsNullOrWhiteSpace(moderatorNote)) payload["moderator_note"] = moderatorNote;
+				payload["ban_until"] = seconds <= 0
+					? "permanent"
+					: DateTime.UtcNow.AddSeconds(seconds).ToString("O", CultureInfo.InvariantCulture);
+				audit = seconds <= 0
+					? $"Banned player {playerId} ({display}) permanently - {reason}"
+					: $"Banned player {playerId} ({display}) for {seconds} second(s) - {reason}";
+				break;
+			}
+			case "unban":
+				payload["banned"] = false;
+				audit = $"Lifted player {playerId} ({display})'s ban";
+				break;
+			case "coach":
+			{
+				var message = (Q("message") ?? "").Trim();
+				if (string.IsNullOrWhiteSpace(message)) return BadRequest("A coach message cannot be empty.");
+
+				await Notify.SendMessage(playerId, new Message
+				{
+					Type = MessageType.CoachMessage,
+					Data = message,
+					FromPlayerId = 1
+				});
+
+				AdminActionDiscord.LogAction("Coach Message", await GetPanelAdminUsernameAsync(), $"Sent a coach message to player {playerId} ({display}): {message}");
+				return Ok(new { success = true, player_id = playerId, message });
+			}
+			case "roles/add":
+			{
+				var added = (Q("roles") ?? "").Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries);
+				if (added.Length == 0) return BadRequest("Pick at least one role to add.");
+
+				var merged = new List<string>(SplitRoles(profile.role));
+				foreach (var role in added)
+				{
+					if (!merged.Contains(role, StringComparer.OrdinalIgnoreCase)) merged.Add(role);
+				}
+				payload["roles"] = string.Join(",", merged);
+				audit = $"Added role(s) {string.Join(",", added)} to player {playerId} ({display})";
+				break;
+			}
+			case "roles/clear":
+				payload["roles"] = "";
+				audit = $"Cleared player {playerId} ({display})'s in-game roles";
+				break;
+			case "lockname":
+				payload["name_locked"] = QBool("locked");
+				audit = $"{(QBool("locked") ? "Locked" : "Unlocked")} player {playerId} ({display})'s name";
+				break;
+			case "lockbio":
+				payload["bio_locked"] = QBool("locked");
+				audit = $"{(QBool("locked") ? "Locked" : "Unlocked")} player {playerId} ({display})'s bio";
+				break;
+			case "junior":
+				payload["is_junior"] = QBool("junior");
+				audit = $"Marked player {playerId} ({display}) as {(QBool("junior") ? "a Junior account" : "no longer Junior")}";
+				break;
+			case "resetpassword":
+			{
+				var password = Q("password") ?? "";
+				if (password.Length < 8) return BadRequest("A reset password needs at least 8 characters.");
+				payload["password"] = password;
+				audit = $"Reset player {playerId} ({display})'s password";
+				break;
+			}
+			case "username":
+			{
+				var username = (Q("username") ?? "").Trim();
+				if (string.IsNullOrWhiteSpace(username)) return BadRequest("Enter the new username.");
+				if (username.Length < 3 || username.Length > 32) return BadRequest("Usernames are 3-32 characters.");
+				if (await db.Profiles.AnyAsync(x => x.accountId != playerId && x.username == username))
+					return BadRequest($"The username '{username}' is already taken.");
+				payload["username"] = username;
+				audit = $"Renamed player {playerId} ({display}) to {username}";
+				break;
+			}
+			case "reputation":
+				payload["reputation"] = QInt("reputation");
+				payload["noteriety"] = QInt("notoriety");
+				audit = $"Saved player {playerId} ({display})'s reputation";
+				break;
+			case "cheers":
+				payload["cheer_general"] = QInt("general");
+				payload["cheer_helpful"] = QInt("helpful");
+				payload["cheer_great_host"] = QInt("greatHost");
+				payload["cheer_sportsman"] = QInt("sportsman");
+				payload["cheer_creative"] = QInt("creative");
+				payload["cheer_credit"] = QInt("credit");
+				audit = $"Saved player {playerId} ({display})'s cheers";
+				break;
+			case "progression":
+				payload["level"] = QInt("level", 1);
+				payload["xp"] = QInt("xp");
+				audit = $"Set player {playerId} ({display}) to level {QInt("level", 1)} / {QInt("xp")} XP";
+				break;
+			case "notes":
+			{
+				var text = (Q("note") ?? "").Trim();
+				if (string.IsNullOrWhiteSpace(text)) return BadRequest("A note cannot be empty.");
+
+				var state = LoadState();
+				long nextId = 1;
+				foreach (var existing in state.Notes)
+				{
+					if (long.TryParse(existing["id"]?.ToString(), out var parsedId) && parsedId >= nextId)
+						nextId = parsedId + 1;
+				}
+
+				var note = new JsonObject
+				{
+					["id"] = nextId,
+					["player_id"] = playerId,
+					["text"] = text,
+					["author"] = await GetPanelAdminUsernameAsync(),
+					["created_at"] = DateTime.UtcNow.ToString("O")
+				};
+				state.Notes.Add(note);
+				SaveState(state);
+
+				return Ok(new { success = true, player_id = playerId, note = note });
+			}
+			case "settings":
+			{
+				var settingKey = (Q("setting_key") ?? "").Trim();
+				if (string.IsNullOrWhiteSpace(settingKey)) return BadRequest("A setting needs a key.");
+				return await ApplyPlayerSetting(playerId, new Dictionary<string, string?> { [settingKey] = Q("value") ?? "" });
+			}
+			case "settings/delete":
+			{
+				var settingKey = (Q("setting_key") ?? "").Trim();
+				if (string.IsNullOrWhiteSpace(settingKey)) return BadRequest("A setting needs a key.");
+				return await ApplyPlayerSetting(playerId, new Dictionary<string, string?> { [settingKey] = null });
+			}
+			case "settings/reset":
+				await ApplyPlayerSetting(playerId, null);
+				AdminActionDiscord.LogAction("Reset Settings", await GetPanelAdminUsernameAsync(), $"Reset every in-game setting for player {playerId} ({display}).");
+				return Ok(new { success = true, player_id = playerId });
+			case "settings/birthday":
+				return await ApplyPlayerSetting(playerId, new Dictionary<string, string?> { ["birthday"] = (Q("birthday") ?? "").Trim() });
+			case "settings/profilepicture":
+			{
+				var owner = await db.Profiles.FirstOrDefaultAsync(x => x.accountId == playerId);
+				if (owner == null) return NotFound("Player does not exist.");
+				owner.profileImage = DBConfig.DefaultProfileImage;
+				await db.SaveChangesAsync();
+				AdminActionDiscord.LogAction("Reset Profile Picture", await GetPanelAdminUsernameAsync(), $"Reset player {playerId} ({display})'s profile picture.");
+				return Ok(new { success = true, player_id = playerId });
+			}
+			case "items/revoke":
+			{
+				var itemKind = (Q("itemKind") ?? "").Trim().ToLowerInvariant();
+				var itemId = (Q("itemId") ?? "").Trim();
+				var modGuid = (Q("modGuid") ?? "").Trim();
+				if (itemId.Length == 0) return BadRequest("An item to revoke is required.");
+
+				var unlocks = await db.Unlocks.FirstOrDefaultAsync(x => x.AccountId == playerId);
+				if (unlocks == null) return NotFound("This account has no locker to take an item from.");
+
+				int removed;
+				string removedName;
+				switch (itemKind)
+				{
+					case "avatar":
+					{
+						var items = unlocks.GetAvatarItems();
+						removedName = items.FirstOrDefault(i => i != null && string.Equals((i.AvatarItemDesc ?? "").Trim(), itemId, StringComparison.OrdinalIgnoreCase))?.FriendlyName ?? itemId;
+						removed = items.RemoveAll(i => i != null && string.Equals((i.AvatarItemDesc ?? "").Trim(), itemId, StringComparison.OrdinalIgnoreCase));
+						unlocks.AvatarItems = items.ToJson();
+						break;
+					}
+					case "equipment":
+					{
+						var items = unlocks.GetEquipment();
+						bool Matches(Equipment i) => i != null
+							&& string.Equals((i.PrefabName ?? "").Trim(), itemId, StringComparison.OrdinalIgnoreCase)
+							&& (modGuid.Length == 0 || string.Equals((i.ModificationGuid ?? "").Trim(), modGuid, StringComparison.OrdinalIgnoreCase));
+						removedName = items.FirstOrDefault(Matches)?.FriendlyName ?? itemId;
+						removed = items.RemoveAll(Matches);
+						unlocks.Equipment = items.ToJson();
+						break;
+					}
+					case "consumable":
+					{
+						var items = unlocks.GetConsumables();
+						removedName = items.FirstOrDefault(i => i != null && string.Equals((i.ConsumableItemDesc ?? "").Trim(), itemId, StringComparison.OrdinalIgnoreCase))?.ConsumableItemDesc ?? itemId;
+						removed = items.RemoveAll(i => i != null && string.Equals((i.ConsumableItemDesc ?? "").Trim(), itemId, StringComparison.OrdinalIgnoreCase));
+						unlocks.SetConsumables(items);
+						break;
+					}
+					default:
+						return BadRequest("The item kind must be avatar, equipment or consumable.");
+				}
+
+				if (removed == 0) return NotFound("That item is not in this account's locker.");
+				await db.SaveChangesAsync();
+				AdminActionDiscord.LogAction("Revoke Item", await GetPanelAdminUsernameAsync(),
+					$"Took {removed} {itemKind} item(s) named \"{removedName}\" out of player {playerId} ({display})'s locker.");
+				return Ok(new { success = true, player_id = playerId, item_kind = itemKind, item_id = itemId, removed });
+			}
+			case "locker/reset":
+			{
+				var unlocks = await db.Unlocks.FirstOrDefaultAsync(x => x.AccountId == playerId);
+				if (unlocks == null) return NotFound("This account has no locker to reset.");
+				unlocks.AvatarItems = DBConfig.DefaultAvatarUnlocks;
+				unlocks.Consumables = DBConfig.DefaultConsumableUnlocks;
+				unlocks.Equipment = DBConfig.DefaultEquipmentUnlocks;
+				await db.SaveChangesAsync();
+				AdminActionDiscord.LogAction("Reset Locker", await GetPanelAdminUsernameAsync(),
+					$"Reset player {playerId} ({display})'s locker to the default inventory.");
+				return Ok(new { success = true, player_id = playerId });
+			}
+			case "lock":
+			{
+				var caseRef = (Q("case") ?? Q("case_ref") ?? "").Trim();
+				var result = await AccountLock.ApplyAsync(db, playerId, await GetPanelAdminUsernameAsync(),
+					string.IsNullOrWhiteSpace(caseRef) ? null : caseRef);
+				if (!result.Success)
+					return StatusCode(500, new { success = false, message = result.Error ?? "The account lock could not be applied." });
+				return Ok(new
+				{
+					success = true,
+					player_id = playerId,
+					locked = true,
+					ban_method = AccountLock.BanMethod,
+					ban_category = ReportCategory.Moderator.ToString(),
+					permanent = true,
+					changed = result.Changed
+				});
+			}
+			case "unlock":
+			{
+				var caseRef = (Q("case") ?? Q("case_ref") ?? "").Trim();
+				var result = await AccountLock.RemoveAsync(db, playerId, await GetPanelAdminUsernameAsync(),
+					string.IsNullOrWhiteSpace(caseRef) ? null : caseRef);
+				if (!result.Success)
+					return Conflict(new { success = false, message = result.Error ?? "The account lock could not be removed." });
+				return Ok(new { success = true, player_id = playerId, locked = false });
+			}
+			case "quit":
+				return await QuitPlayerGame(playerId, key);
+			case "forcelogout":
+				return await ForceLogoutPlayer(playerId, key);
+			default:
+				return NotFound($"Unknown player action '{kind}'.");
+		}
+
+		var applied = await UpdatePlayer(playerId, JsonSerializer.SerializeToElement(payload));
+		if (applied is IActionResult failure) return failure;
+
+		if (!string.IsNullOrEmpty(audit))
+			AdminActionDiscord.LogAction(kind, await GetPanelAdminUsernameAsync(), audit);
+
+		return Ok(new { success = true, player_id = playerId });
+	}
+
+	private async Task<IActionResult> ApplyPlayerSetting(long playerId, Dictionary<string, string?>? changes)
+	{
+		var row = await db.PlayerSettings.FirstOrDefaultAsync(x => x.AccountId == playerId);
+		var settings = row?.DeserializeSettings() ?? new List<Setting>();
+
+		if (changes != null)
+		{
+			foreach (var change in changes)
+			{
+				settings.RemoveAll(s => string.Equals(s.Key, change.Key, StringComparison.OrdinalIgnoreCase));
+				if (change.Value != null) settings.Add(new Setting { Key = change.Key, Value = change.Value });
+			}
+		}
+		else
+		{
+			settings = new List<Setting>();
+		}
+
+		var payload = new Dictionary<string, object>
+		{
+			["settings"] = settings.ToDictionary(s => s.Key, s => s.Value)
+		};
+
+		var applied = await UpdatePlayer(playerId, JsonSerializer.SerializeToElement(payload));
+		if (applied is IActionResult failure) return failure;
+
+		return Ok(new { success = true, player_id = playerId, settings = settings.Count });
+	}
+
+	[HttpGet("players/{playerId:long}/details")]
+	public async Task<IActionResult> PlayerDetails(long playerId, [FromQuery] string key)
+	{
+		var rejection = await RejectInvalidKey(key);
+		if (rejection != null) return rejection;
+
+		var rooms = await db.Rooms
+			.Where(r => r.CreatorAccountId == playerId)
+			.Select(r => new
+			{
+				id = r.RoomId,
+				name = r.Name,
+				description = r.Description,
+				image_name = r.ImageName,
+				state = r.State.ToString(),
+				accessibility = r.Accessibility.ToString(),
+				created_at = r.CreatedAt,
+				max_players = r.MaxPlayers,
+				supports_juniors = r.SupportsJuniors,
+				cloning_allowed = r.CloningAllowed
+			})
+			.ToListAsync();
+
+		var inventions = await db.Inventions
+			.Where(i => i.CreatorPlayerId == playerId)
+			.Select(i => new
+			{
+				id = i.InventionId,
+				name = i.Name,
+				description = i.Description,
+				image_name = i.ImageName,
+				is_published = i.IsPublished,
+				num_downloads = i.NumDownloads,
+				cheer_count = i.CheerCount,
+				created_at = i.CreatedAt
+			})
+			.ToListAsync();
+
+		var events = await db.PlayerEvents
+			.Where(e => e.CreatorPlayerId == playerId)
+			.Select(e => new
+			{
+				id = e.PlayerEventId,
+				name = e.Name,
+				description = e.Description,
+				image_name = e.ImageName,
+				room_id = e.RoomId,
+				start_time = e.StartTime,
+				end_time = e.EndTime,
+				attendee_count = e.AttendeeCount,
+				accessibility = e.Accessibility.ToString()
+			})
+			.ToListAsync();
+
+		var currency = await db.Currency.FirstOrDefaultAsync(x => x.AccountId == playerId);
+		var balance = new
+		{
+			rec_tokens = currency?.RecTokens ?? 0,
+			laser_tag_tickets = currency?.LaserTagTickets ?? 0,
+			gold = currency?.Gold ?? 0,
+			dracula_silver = currency?.DraculaSilver ?? 0
+		};
+
+		// What the account actually owns: the unlocks row the game reads when it dresses an
+		// avatar. The panel shows this as the player's locker, so each entry is resolved
+		// against the server's own catalogues here - the saved entry often carries no name
+		// or picture of its own, and the catalogue is the only place that has them.
+		var unlocksRow = await db.Unlocks.AsNoTracking().FirstOrDefaultAsync(x => x.AccountId == playerId);
+		var lockerAvatar = unlocksRow?.GetAvatarItems() ?? new List<AvatarItem>();
+		var lockerEquipment = unlocksRow?.GetEquipment() ?? new List<Equipment>();
+		var lockerConsumables = unlocksRow?.GetConsumables() ?? new List<Consumable>();
+		var avatarCatalog = (DBConfig.DefaultAvatarCatalog.FromJson<List<AvatarItem>>() ?? new List<AvatarItem>())
+			.Where(x => x != null && !string.IsNullOrWhiteSpace(x.AvatarItemDesc))
+			.GroupBy(x => x.AvatarItemDesc.Trim(), StringComparer.OrdinalIgnoreCase)
+			.ToDictionary(g => g.Key, g => g.First(), StringComparer.OrdinalIgnoreCase);
+		var equipmentCatalog = (DBConfig.DefaultEquipmentItems.FromJson<List<Equipment>>(CatalogJsonOptions) ?? new List<Equipment>())
+			.Where(x => x != null && !string.IsNullOrWhiteSpace(x.PrefabName))
+			.GroupBy(x => x.PrefabName.Trim(), StringComparer.OrdinalIgnoreCase)
+			.ToDictionary(g => g.Key, g => g.First(), StringComparer.OrdinalIgnoreCase);
+		var consumableCatalog = (DBConfig.DefaultConsumableItems.FromJson<List<ConsumableItem>>(CatalogJsonOptions) ?? new List<ConsumableItem>())
+			.Where(x => x != null && !string.IsNullOrWhiteSpace(x.ConsumableItemDesc))
+			.GroupBy(x => x.ConsumableItemDesc.Trim(), StringComparer.OrdinalIgnoreCase)
+			.ToDictionary(g => g.Key, g => g.First(), StringComparer.OrdinalIgnoreCase);
+		var locker = new
+		{
+			avatar = lockerAvatar
+				.Where(i => i != null && !string.IsNullOrWhiteSpace(i.AvatarItemDesc))
+				.Select(i =>
+				{
+					avatarCatalog.TryGetValue(i.AvatarItemDesc.Trim(), out var meta);
+					return new
+					{
+						desc = i.AvatarItemDesc.Trim(),
+						name = NonEmpty(i.FriendlyName, meta?.FriendlyName, i.AvatarItemDesc),
+						rarity = RarityLabel(meta?.Rarity ?? i.Rarity),
+						thumbnail_image = NonEmpty(i.ThumbnailImage, meta?.ThumbnailImage, "")
+					};
+				})
+				.Cast<object>().ToList(),
+			equipment = lockerEquipment
+				.Where(i => i != null && !string.IsNullOrWhiteSpace(i.PrefabName))
+				.Select(i =>
+				{
+					equipmentCatalog.TryGetValue(i.PrefabName.Trim(), out var meta);
+					return new
+					{
+						prefab = i.PrefabName.Trim(),
+						guid = (i.ModificationGuid ?? "").Trim(),
+						name = NonEmpty(i.FriendlyName, meta?.FriendlyName, i.PrefabName),
+						rarity = (meta?.Rarity ?? i.Rarity).ToString()
+					};
+				})
+				.Cast<object>().ToList(),
+			consumables = lockerConsumables
+				.Where(i => i != null && !string.IsNullOrWhiteSpace(i.ConsumableItemDesc))
+				.Select(i =>
+				{
+					consumableCatalog.TryGetValue(i.ConsumableItemDesc.Trim(), out var meta);
+					return new
+					{
+						desc = i.ConsumableItemDesc.Trim(),
+						count = i.Count,
+						name = NonEmpty(meta?.FriendlyName, i.ConsumableItemDesc),
+						rarity = meta == null ? "None" : ((Rarity)meta.Rarity).ToString()
+					};
+				})
+				.Cast<object>().ToList()
+		};
+
+
+
+		var photos = await db.Images
+			.Where(i => i.OwnerId == playerId)
+			.OrderByDescending(i => i.CreatedAt)
+			.Select(i => new
+			{
+				id = i.Id,
+				name = i.Name,
+				image_url = $"{DBConfig.ServerUrl}/images/img/{i.Name}",
+				type = i.ImageType.ToString(),
+				accessibility = i.Accessibility.ToString(),
+				room_id = i.RoomId,
+				created_at = DateTime.SpecifyKind(i.CreatedAt, DateTimeKind.Utc)
+			})
+			.ToListAsync();
+
+
+
+
+		var roomIds = rooms.Select(r => r.id).ToList();
+		var roomReports = LoadState().ModerationReports
+			.Where(r => string.Equals(r["report_type"]?.ToString(), "Room", StringComparison.OrdinalIgnoreCase)
+				&& (string.Equals(r["reported_id"]?.ToString(), playerId.ToString(), StringComparison.Ordinal)
+					|| (r["target_id"]?.ToString() is string targetRaw
+						&& long.TryParse(targetRaw, out var targetId) && roomIds.Contains(targetId))))
+			.OrderByDescending(r => r["created_at"]?.ToString())
+			.ToList();
+
+
+
+		var moderation = (await db.Moderation
+			.Where(m => m.PlayerId == playerId)
+			.ToListAsync())
+			.Select(m => new
+			{
+				id = m.Id,
+				category = m.Category.ToString(),
+				message = m.Message,
+				moderator_note = m.ModeratorNote,
+				ban_method = m.BanMethod,
+				created_at = DateTime.SpecifyKind(m.CreatedAt, DateTimeKind.Utc),
+				is_ban = m.IsBan,
+
+
+
+				expire_duration = DateTime.SpecifyKind(m.ExpireDuration, DateTimeKind.Utc)
+			})
+			.ToList();
+
+
+
+		var voteKicks = await db.VoteKicks
+			.Where(v => v.PlayerId == playerId)
+			.OrderByDescending(v => v.CreatedAt)
+			.Select(v => new
+			{
+				id = v.Id,
+				reason = v.Reason,
+				category = v.Category.ToString(),
+				is_force = v.IsForce,
+				created_at = DateTime.SpecifyKind(v.CreatedAt, DateTimeKind.Utc),
+				expires_at = DateTime.SpecifyKind(v.ExpiresAt, DateTimeKind.Utc)
+			})
+			.ToListAsync();
+
+		var friendRows = await db.Relationships
+			.Where(r => r.AccountId == playerId && r.RelationshipType == RelationshipType.Friend)
+			.ToListAsync();
+		var friendIds = friendRows.Select(r => r.PlayerId).Distinct().ToList();
+		var friendProfiles = friendIds.Count > 0
+			? await db.Profiles.Where(p => friendIds.Contains(p.accountId)).ToDictionaryAsync(p => p.accountId)
+			: new Dictionary<long, Profile>();
+		var friendProgression = friendIds.Count > 0
+			? await db.Progression.Where(p => friendIds.Contains(p.PlayerId)).ToDictionaryAsync(p => p.PlayerId)
+			: new Dictionary<long, ProgressionData>();
+		var friends = friendRows.Select(r =>
+		{
+			friendProfiles.TryGetValue(r.PlayerId, out var fp);
+			friendProgression.TryGetValue(r.PlayerId, out var fprog);
+			return new
+			{
+				player_id = r.PlayerId,
+				username = fp?.username ?? "",
+				display_name = fp?.displayName ?? $"Player {r.PlayerId}",
+				profile_image = fp != null ? ImageUrl(fp.profileImage) : ImageUrl(null),
+				level = fprog?.Level ?? 0,
+				relationship_type = r.RelationshipType.ToString()
+			};
+		}).ToList();
+
+		var taggedImages = await db.Images.ToListAsync();
+		var photosOfMe = taggedImages
+			.Where(i =>
+			{
+				try
+				{
+					var ids = i.PlayerIds.FromJson<List<long>>() ?? new List<long>();
+					return ids.Contains(playerId);
+				}
+				catch
+				{
+					return false;
+				}
+			})
+			.OrderByDescending(i => i.CreatedAt)
+			.Select(i => new
+			{
+				id = i.Id,
+				name = i.Name,
+				image_url = $"{DBConfig.ServerUrl}/images/img/{i.Name}",
+				owner_id = i.OwnerId,
+				room_id = i.RoomId,
+				created_at = DateTime.SpecifyKind(i.CreatedAt, DateTimeKind.Utc)
+			})
+			.ToList();
+
+		var notes = LoadState().Notes
+			.Where(n => string.Equals(n["player_id"]?.ToString(), playerId.ToString(), StringComparison.Ordinal))
+			.OrderByDescending(n => n["created_at"]?.ToString())
+			.Cast<object>()
+			.ToList();
+
+		var clubRecords = await ClubStore.LoadAsync(db);
+		var clubs = clubRecords
+			.Where(c => c.ownerPlayerId == playerId)
+			.OrderByDescending(c => c.createdAt)
+			.Select(c => new
+			{
+				id = c.clubId,
+				name = c.name,
+				description = c.description,
+				primary_tag = c.primaryTag,
+				created_at = DateTime.SpecifyKind(c.createdAt, DateTimeKind.Utc)
+			})
+			.Cast<object>()
+			.ToList();
+
+		var progress = await db.Progression.FirstOrDefaultAsync(x => x.PlayerId == playerId);
+		var progressJson = progress?.GetProgressionJson();
+		var progression = new
+		{
+			level = progress?.Level ?? 0,
+			xp = progress?.XP ?? 0,
+			last_xp_earned_at = progressJson?.LastXpEarnedAt,
+			xp_earned_today = progressJson?.XpEarnedToday ?? 0
+		};
+
+		var accountLocked = moderation.Any(m => m.is_ban
+			&& string.Equals(m.ban_method, "Account Lock", StringComparison.OrdinalIgnoreCase)
+			&& m.expire_duration > DateTime.UtcNow);
+
+		var warningRows = await db.PlayerWarnings
+			.AsNoTracking()
+			.Where(w => w.WarnedPlayerId == playerId)
+			.OrderByDescending(w => w.Id)
+			.ToListAsync();
+		var warningCount = warningRows.Count;
+		var pendingWarningCount = warningRows.Count(w => w.AcknowledgedAt == null);
+		var warnings = warningRows.Take(25).Select(w => new
+		{
+			id = w.Id,
+			category = w.ReportCategory.ToString(),
+			report_category = (int)w.ReportCategory,
+			reason = w.DisplayReason ?? string.Empty,
+			moderator_id = w.ModeratorPlayerId,
+			note = w.ModeratorNote ?? string.Empty,
+			created_at = DateTime.SpecifyKind(w.CreatedAt, DateTimeKind.Utc),
+			acknowledged_at = w.AcknowledgedAt.HasValue
+				? DateTime.SpecifyKind(w.AcknowledgedAt.Value, DateTimeKind.Utc)
+				: (DateTime?)null
+		}).Cast<object>().ToList();
+
+		var voiceRestriction = await VoiceChatRestrictions.ActiveAsync(db, playerId);
+
+		return Ok(new
+		{
+			rooms,
+			inventions,
+			events,
+			balance,
+			locker,
+			moderation,
+			voice_restricted = voiceRestriction != null,
+			voice_restriction = voiceRestriction == null
+				? null
+				: new
+				{
+					reason = voiceRestriction.Reason,
+					category = voiceRestriction.Category.ToString(),
+					report_category = (int)voiceRestriction.Category,
+					issued_by = voiceRestriction.IssuedBy,
+					issued_by_username = voiceRestriction.IssuedByUsername,
+					note = voiceRestriction.ModeratorNote,
+					started_at = DateTime.SpecifyKind(voiceRestriction.StartedAt, DateTimeKind.Utc),
+					expires_at = DateTime.SpecifyKind(voiceRestriction.ExpiresAt, DateTimeKind.Utc),
+					minutes_remaining = (int)Math.Max(0, (voiceRestriction.ExpiresAt - DateTime.UtcNow).TotalMinutes)
+				},
+			vote_kicks = voteKicks,
+			photos,
+			photos_of_me = photosOfMe,
+			friends,
+			clubs,
+			notes,
+			progression,
+			room_reports = roomReports,
+			warn_count = warningCount,
+			pending_warn_count = pendingWarningCount,
+			warnings,
+			account_locked = accountLocked
+		});
+	}
+
+	[HttpGet("notify/status")]
+	public async Task<IActionResult> NotifyStatus([FromQuery] string key)
+	{
+		var rejection = await RejectInvalidKey(key);
+		if (rejection != null) return rejection;
+
+		var accounts = Notify.ConnectedAccountIds();
+		return Ok(new
+		{
+			hub_context_ready = Notify.Context != null,
+			connected_connections = Notify.ConnectedConnectionCount,
+			connected_account_count = accounts.Count,
+			connected_accounts = accounts
+		});
+	}
+
+	[HttpGet("{table}")]
+	public async Task<IActionResult> List(string table, [FromQuery] string key, [FromQuery(Name = "eq_col")] string? eqCol, [FromQuery(Name = "eq_val")] string? eqVal, [FromQuery] string? order, [FromQuery] bool ascending = true)
+	{
+		var rejection = await RejectInvalidKey(key);
+		if (rejection != null) return rejection;
+
+		return table switch
+		{
+			"admin_users" => Ok(await GetAdminUsers(eqCol, eqVal)),
+			"players" => Ok(await GetPlayers(order, ascending)),
+			"gift_drops" => Ok(await GetGiftDrops(order, ascending)),
+			"storefront_items" => Ok(await GetStorefrontItems(eqCol, eqVal, order, ascending)),
+			"storefronts" => Ok(GetStorefronts(order, ascending)),
+			"challenges" => Ok(GetChallenges(order, ascending)),
+			"moderation_log" => Ok(FilterByPlayer(LoadState().ModerationLog, eqCol, eqVal, order, ascending)),
+			"gift_log" => Ok(await ProcessGiftLog(eqCol, eqVal, order, ascending)),
+			"notes" => Ok(FilterByPlayer(LoadState().Notes, eqCol, eqVal, order, ascending)),
+			"audit_log" => Ok(LoadState().AuditLog),
+			"rooms" => Ok(await GetRooms(order, ascending)),
+			"room_comments" => Ok(await GetRoomComments(order, ascending)),
+			"community_board" => Ok(GetCommunityBoard()),
+			"moderation_reports" => Ok(GetModerationReports(order, ascending)),
+			"player_events" => Ok(await GetPlayerEvents(order, ascending)),
+			"player_event_responses" => Ok(await GetPlayerEventResponses(eqCol, eqVal, order, ascending)),
+			"event_invitations" => Ok(await GetEventInvitations(eqCol, eqVal, order, ascending)),
+			"avatar_items" => Ok(GetAvatarItems()),
+			"equipment_items" => Ok(GetEquipmentItems()),
+			"consumable_items" => Ok(GetConsumableItems()),
+			"announcements" => Ok(GetAnnouncements()),
+			"ip_bans" => Ok(await GetIpBans(order, ascending)),
+			"hardware_bans" => Ok(await GetHardwareBans(order, ascending)),
+			"account_creation_blocks" => Ok(await GetAccountCreationBlocks(order, ascending)),
+			"leaderboard_scores" => Ok(await GetLeaderboardScores(eqCol, eqVal, order, ascending)),
+			"game_blocks" => Ok(await GetGameBlocks(order, ascending)),
+			"gameconfigs" => Ok(await db.GameConfig.ToListAsync()),
+			"serverconfigs" => Ok(await db.ServerConfig.ToListAsync()),
+			"clubs" => Ok(await GetClubs()),
+			"featured_rooms" => Ok(await GetFeaturedRooms()),
+			"room_recommendations" => Ok(await GetRoomRecommendations()),
+			"item_sets" => Ok(await GetItemSets()),
+			"playlists" => Ok(await GetPlaylists()),
+			"split_tests" => Ok(await GetSplitTests()),
+			"cohort_nux_buttons" => Ok(await GetCohortNuxButtons()),
+			"challenge_maps" => Ok(await GetChallengeMaps()),
+			"tags" => Ok(await GetTags()),
+			_ => GenericTableList(table)
+		};
+	}
+
+	private IActionResult GenericTableList(string table)
+	{
+		var prop = db.GetType().GetProperties()
+			.FirstOrDefault(p => p.PropertyType.IsGenericType
+				&& p.PropertyType.GetGenericTypeDefinition() == typeof(DbSet<>)
+				&& string.Equals(p.Name, table, StringComparison.OrdinalIgnoreCase));
+		if (prop == null) return NotFound($"Unknown admin panel table '{table}'.");
+
+		var set = prop.GetValue(db) as System.Collections.IEnumerable;
+		var rows = set?.Cast<object>().ToList() ?? new List<object>();
+		return Ok(rows);
+	}
+
+	private static List<string> SafeRoomTags(string? tags)
+	{
+		if (string.IsNullOrWhiteSpace(tags)) return new List<string>();
+		try { return StringTools.ReadTags(tags).Select(t => t.Tag).ToList(); }
+		catch { return new List<string>(); }
+	}
+
+	private async Task<List<object>> GetClubs()
+	{
+		var config = await db.ServerConfig.AsNoTracking().FirstOrDefaultAsync(x => x.Key == "Clubs");
+		if (config == null || string.IsNullOrWhiteSpace(config.Value)) return new List<object>();
+
+		try
+		{
+			var clubs = config.Value.FromJson<List<ClubRecord>>() ?? new List<ClubRecord>();
+			var clubReports = LoadState().ModerationReports
+				.Where(r => string.Equals(r["report_type"]?.ToString(), "Club", StringComparison.OrdinalIgnoreCase))
+				.Select(r => r["target_id"]?.ToString())
+				.Where(v => !string.IsNullOrWhiteSpace(v))
+				.GroupBy(v => v!, StringComparer.Ordinal)
+				.ToDictionary(g => g.Key, g => g.Count(), StringComparer.Ordinal);
+
+			return clubs.Select(c =>
+			{
+				var categories = new List<string>();
+				if (!string.IsNullOrWhiteSpace(c.primaryTag)) categories.Add(c.primaryTag);
+				if (c.customTags != null) categories.AddRange(c.customTags.Where(t => !string.IsNullOrWhiteSpace(t)));
+
+				return new
+				{
+					club_id = c.clubId,
+					name = c.name,
+					description = c.description,
+					primary_tag = c.primaryTag,
+					categories = categories,
+					image_name = c.imageName,
+					banner_image_name = c.bannerImageName,
+					owner_player_id = c.ownerPlayerId,
+					created_at = c.createdAt,
+					privacy = c.visibility,
+					privacy_label = c.visibility == 0 ? "Private" : "Public",
+					member_access = c.joinability,
+					member_access_label = c.joinability switch { 1 => "Invite Only", 2 => "Ask to Join", _ => "Open" },
+					member_count = ClubStore.GetMemberCount(c),
+					report_count = clubReports.TryGetValue(c.clubId.ToString(), out var rc) ? rc : 0
+				};
+			}).Cast<object>().ToList();
+		}
+		catch
+		{
+			return new List<object>();
+		}
+	}
+
+	private async Task<List<object>> GetFeaturedRooms()
+	{
+		var rooms = await db.Rooms.AsNoTracking().ToListAsync();
+		return rooms
+			.Where(r => SafeRoomTags(r.Tags).Any(t => string.Equals(t, "featured", StringComparison.OrdinalIgnoreCase)))
+			.Select(r => new
+			{
+				room_id = r.RoomId,
+				name = r.Name,
+				creator_player_id = r.CreatorAccountId,
+				tags = r.Tags,
+				accessibility = r.Accessibility.ToString(),
+				is_rro = r.IsRRO,
+				is_dorm = r.IsDorm,
+				created_at = r.CreatedAt
+			}).Cast<object>().ToList();
+	}
+
+	private async Task<List<object>> GetRoomRecommendations()
+	{
+		var top = await db.Rooms
+			.AsNoTracking()
+			.Where(r => r.Accessibility == Accessibility.Public && !r.IsDorm)
+			.Select(r => new
+			{
+				r.RoomId,
+				r.Name,
+				r.CreatorAccountId,
+				r.Tags,
+				r.IsRRO,
+				r.CreatedAt,
+				Engagement = db.RoomInteractions
+					.Where(i => i.RoomId == r.RoomId)
+					.Sum(i => (i.Favorited ? 1 : 0) + (i.Cheered ? 1 : 0))
+			})
+			.OrderByDescending(x => x.Engagement)
+			.Take(10)
+			.ToListAsync();
+
+		var rank = 1;
+		return top.Select(x => new
+		{
+			rank = rank++,
+			room_id = x.RoomId,
+			name = x.Name,
+			creator_player_id = x.CreatorAccountId,
+			tags = x.Tags,
+			is_rro = x.IsRRO,
+			engagement = x.Engagement,
+			created_at = x.CreatedAt
+		}).Cast<object>().ToList();
+	}
+
+	private async Task<List<object>> GetItemSets()
+	{
+		var curated = await db.ItemSets.AsNoTracking().OrderBy(x => x.ItemSetId).ToListAsync();
+		var derived = await db.GiftItems
+			.AsNoTracking()
+			.Where(g => g.ItemSetId > 0)
+			.GroupBy(g => new { g.ItemSetId, g.ItemSetFriendlyName })
+			.Select(g => new { item_set_id = g.Key.ItemSetId, item_set_friendly_name = g.Key.ItemSetFriendlyName, item_count = g.Count() })
+			.OrderBy(x => x.item_set_id)
+			.ToListAsync();
+
+		var result = new List<object>();
+		var curatedIds = curated.Select(c => c.ItemSetId).ToHashSet();
+		foreach (var set in curated)
+		{
+			var count = derived.Where(d => d.item_set_id == set.ItemSetId).Sum(d => d.item_count);
+			result.Add(new { item_set_id = set.ItemSetId, item_set_friendly_name = set.FriendlyName, item_count = count, source = "curated" });
+		}
+		foreach (var set in derived.Where(d => !curatedIds.Contains(d.item_set_id)))
+		{
+			result.Add(new { item_set_id = set.item_set_id, item_set_friendly_name = set.item_set_friendly_name, item_count = set.item_count, source = "derived" });
+		}
+		return result;
+	}
+
+	private async Task<List<object>> GetPlaylists()
+	{
+		var playlists = await db.Playlists.AsNoTracking().OrderBy(x => x.PlaylistId).ToListAsync();
+		return playlists.Select(p => new
+		{
+			playlist_id = p.PlaylistId,
+			keywords = p.Keywords
+		}).Cast<object>().ToList();
+	}
+
+	private async Task<object> CreatePlaylist(string keywords)
+	{
+		var playlist = new PlaylistDB { Keywords = keywords };
+		db.Playlists.Add(playlist);
+		await db.SaveChangesAsync();
+		return new { playlist_id = playlist.PlaylistId, keywords = playlist.Keywords };
+	}
+
+	private async Task<object> CreateItemSet(string friendlyName)
+	{
+		var set = new ItemSetDB { FriendlyName = friendlyName };
+		db.ItemSets.Add(set);
+		await db.SaveChangesAsync();
+		return new { item_set_id = set.ItemSetId, item_set_friendly_name = set.FriendlyName, item_count = 0, source = "curated" };
+	}
+
+	private async Task<object> CreateTag(string tag, string description)
+	{
+		var row = new TagDB { Tag = tag, Description = description };
+		db.Tags.Add(row);
+		await db.SaveChangesAsync();
+		return new { tag_id = (long?)row.TagId, tag = row.Tag, description = row.Description, room_count = 0, source = "curated" };
+	}
+
+	private async Task<IActionResult> UpdatePlaylist(long id, JsonElement payload)
+	{
+		var playlist = await db.Playlists.FirstOrDefaultAsync(x => x.PlaylistId == id);
+		if (playlist == null) return NotFound("Playlist not found.");
+		var keywords = GetJsonString(payload, "keywords");
+		if (keywords != null) playlist.Keywords = keywords;
+		await db.SaveChangesAsync();
+		return Ok(new { playlist_id = playlist.PlaylistId, keywords = playlist.Keywords });
+	}
+
+	private async Task<IActionResult> UpdateItemSet(long id, JsonElement payload)
+	{
+		var set = await db.ItemSets.FirstOrDefaultAsync(x => x.ItemSetId == id);
+		if (set == null) return NotFound("Item set not found.");
+		var friendlyName = GetJsonString(payload, "item_set_friendly_name") ?? GetJsonString(payload, "friendly_name");
+		if (!string.IsNullOrWhiteSpace(friendlyName)) set.FriendlyName = friendlyName;
+		await db.SaveChangesAsync();
+		return Ok(new { item_set_id = set.ItemSetId, item_set_friendly_name = set.FriendlyName, source = "curated" });
+	}
+
+	private async Task<IActionResult> UpdateTag(long id, JsonElement payload)
+	{
+		var tag = await db.Tags.FirstOrDefaultAsync(x => x.TagId == id);
+		if (tag == null) return NotFound("Tag not found.");
+		var tagValue = GetJsonString(payload, "tag");
+		if (!string.IsNullOrWhiteSpace(tagValue)) tag.Tag = tagValue;
+		var description = GetJsonString(payload, "description");
+		if (description != null) tag.Description = description;
+		await db.SaveChangesAsync();
+		return Ok(new { tag_id = (long?)tag.TagId, tag = tag.Tag, description = tag.Description, source = "curated" });
+	}
+
+	private async Task<List<object>> GetSplitTests()
+	{
+		var configs = await db.GameConfig.AsNoTracking().ToListAsync();
+		var available = configs.FirstOrDefault(c => c.Key == "splitTestsAvailable")?.Value ?? "";
+		var hard = configs.FirstOrDefault(c => c.Key == "splitTestHardOverrides")?.Value ?? "";
+		var probs = configs.FirstOrDefault(c => c.Key == "splitTestSegmentProbabilities")?.Value ?? "";
+
+		var hardMap = new Dictionary<string, string>();
+		foreach (var part in hard.Split(';', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries))
+		{
+			var eq = part.IndexOf('=');
+			if (eq <= 0) continue;
+			hardMap[part[..eq].Trim()] = part[(eq + 1)..].Trim();
+		}
+
+		JsonNode? probNode = null;
+		try { probNode = JsonNode.Parse(probs); } catch { }
+
+		var rows = new List<object>();
+		foreach (var part in available.Split(';', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries))
+		{
+			var eq = part.IndexOf('=');
+			if (eq <= 0) continue;
+			var name = part[..eq].Trim();
+			var segments = part[(eq + 1)..].Trim();
+			string? probabilities = null;
+			if (probNode is JsonObject obj && obj.TryGetPropertyValue(name, out var segNode) && segNode != null)
+				probabilities = segNode.ToJsonString();
+			rows.Add(new
+			{
+				test_name = name,
+				available_segments = segments,
+				hard_override = hardMap.TryGetValue(name, out var h) ? h : "",
+				segment_probabilities = probabilities ?? ""
+			});
+		}
+		return rows;
+	}
+
+	private async Task<List<object>> GetCohortNuxButtons()
+	{
+		var rows = new List<object>();
+		var game = await db.GameConfig.AsNoTracking().ToListAsync();
+		var server = await db.ServerConfig.AsNoTracking().ToListAsync();
+
+		void AddFromConfig(string key, string value, string source)
+		{
+			if (MatchesNux(key))
+			{
+				rows.Add(new { config_key = key, value, source });
+				return;
+			}
+			foreach (var entry in value.Split(';', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries))
+			{
+				if (!MatchesNux(entry)) continue;
+				var eq = entry.IndexOf('=');
+				rows.Add(new
+				{
+					config_key = eq > 0 ? entry[..eq].Trim() : entry,
+					value = eq > 0 ? entry[(eq + 1)..].Trim() : "",
+					source
+				});
+			}
+		}
+
+		foreach (var c in game) AddFromConfig(c.Key, c.Value, "GameConfig");
+		foreach (var c in server) AddFromConfig(c.Key, c.Value, "ServerConfig");
+		return rows;
+
+		static bool MatchesNux(string s) =>
+			s.Contains("NUX", StringComparison.OrdinalIgnoreCase) || s.Contains("Cohort", StringComparison.OrdinalIgnoreCase);
+	}
+
+	private async Task<List<object>> GetChallengeMaps()
+	{
+		var rooms = await db.Rooms.AsNoTracking().ToListAsync();
+		return rooms
+			.Where(r => SafeRoomTags(r.Tags).Any(t =>
+				string.Equals(t, "challenge", StringComparison.OrdinalIgnoreCase) ||
+				string.Equals(t, "quest", StringComparison.OrdinalIgnoreCase)))
+			.Select(r => new
+			{
+				room_id = r.RoomId,
+				name = r.Name,
+				creator_player_id = r.CreatorAccountId,
+				tags = r.Tags,
+				accessibility = r.Accessibility.ToString(),
+				is_rro = r.IsRRO,
+				created_at = r.CreatedAt
+			}).Cast<object>().ToList();
+	}
+
+	private async Task<List<object>> GetTags()
+	{
+		var curated = await db.Tags.AsNoTracking().OrderBy(x => x.Tag).ToListAsync();
+		var rooms = await db.Rooms.AsNoTracking().ToListAsync();
+		var derived = rooms
+			.SelectMany(r => SafeRoomTags(r.Tags).Select(t => new { Tag = t, RoomId = r.RoomId }))
+			.Where(t => !string.IsNullOrWhiteSpace(t.Tag))
+			.GroupBy(t => t.Tag, StringComparer.OrdinalIgnoreCase)
+			.Select(g => new { tag = g.Key, room_count = g.Select(x => x.RoomId).Distinct().Count() })
+			.OrderByDescending(x => x.room_count)
+			.ThenBy(x => x.tag)
+			.ToList();
+
+		var result = new List<object>();
+		var curatedTags = curated.Select(c => c.Tag).ToHashSet(StringComparer.OrdinalIgnoreCase);
+		foreach (var tag in curated)
+		{
+			var count = derived.FirstOrDefault(d => string.Equals(d.tag, tag.Tag, StringComparison.OrdinalIgnoreCase))?.room_count ?? 0;
+			result.Add(new { tag_id = (long?)tag.TagId, tag = tag.Tag, description = tag.Description, room_count = count, source = "curated" });
+		}
+		foreach (var tag in derived.Where(d => !curatedTags.Contains(d.tag)))
+		{
+			result.Add(new { tag_id = (long?)null, tag = tag.tag, description = "", room_count = tag.room_count, source = "derived" });
+		}
+		return result;
+	}
+
+
+
+
+
+	private static string? SaveDataUrlFile(string? dataUrl, string directory)
+	{
+		if (string.IsNullOrWhiteSpace(dataUrl) || !dataUrl.StartsWith("data:", StringComparison.OrdinalIgnoreCase))
+			return null;
+
+		var comma = dataUrl.IndexOf(',');
+		if (comma < 0) return null;
+
+		var header = dataUrl.Substring(0, comma);
+		string ext = header.Contains("png", StringComparison.OrdinalIgnoreCase) ? ".png"
+			: header.Contains("jpeg", StringComparison.OrdinalIgnoreCase) ? ".jpg"
+			: header.Contains("jpg", StringComparison.OrdinalIgnoreCase) ? ".jpg"
+			: header.Contains("gif", StringComparison.OrdinalIgnoreCase) ? ".gif"
+			: header.Contains("webp", StringComparison.OrdinalIgnoreCase) ? ".webp"
+			: ".png";
+
+		try
+		{
+			var bytes = Convert.FromBase64String(dataUrl.Substring(comma + 1));
+			Directory.CreateDirectory(directory);
+			var name = Guid.NewGuid().ToString("N") + ext;
+			System.IO.File.WriteAllBytes(Path.Join(directory, name), bytes);
+			return name;
+		}
+		catch
+		{
+			return null;
+		}
+	}
+
+	private static string FormatBanTime(TimeSpan timeRemaining)
+	{
+		if (timeRemaining.TotalDays > 365 * 10)
+			return "This ban is permanent.";
+
+		var parts = new List<string>();
+		if (timeRemaining.Days > 0)
+			parts.Add($"{timeRemaining.Days} Days");
+		if (timeRemaining.Hours > 0)
+			parts.Add($"{timeRemaining.Hours} Hours");
+		if (timeRemaining.Minutes > 0)
+			parts.Add($"{timeRemaining.Minutes} Minutes");
+		if (timeRemaining.Seconds > 0)
+			parts.Add($"{timeRemaining.Seconds} Seconds");
+
+		return parts.Count > 0 ? string.Join(", ", parts) : "0 Seconds";
+	}
+
+	[HttpPost("upload/video")]
+	[RequestSizeLimit(AdminUtils.MaxUploadBytes)]
+	public async Task<IActionResult> UploadVideo([FromQuery] string key, [FromForm] IFormFile file)
+	{
+
+		var rejection = await RejectInvalidKey(key);
+		if (rejection != null) return rejection;
+
+		if (file == null || file.Length == 0) return BadRequest("No file provided.");
+
+
+		var allowed = new[] { ".mp4", ".webm", ".mov", ".m4v", ".ogv" };
+		var ext = Path.GetExtension(file.FileName).ToLowerInvariant();
+		if (!allowed.Contains(ext)) return BadRequest($"Unsupported video format '{ext}'. Use mp4/webm/mov.");
+
+		Directory.CreateDirectory(DBConfig.CDNVideos);
+		var name = Guid.NewGuid().ToString("N") + ext;
+		var path = Path.Join(DBConfig.CDNVideos, name);
+		using (var stream = new FileStream(path, FileMode.Create))
+		{
+			await file.CopyToAsync(stream);
+		}
+
+		return Ok(new { name, url = $"{DBConfig.ServerUrl}/cdn/video/{name}" });
+	}
+
+	[HttpPost("upload/image")]
+	[RequestSizeLimit(AdminUtils.MaxUploadBytes)]
+	public async Task<IActionResult> UploadImage([FromQuery] string key, [FromForm] IFormFile file)
+	{
+
+		var rejection = await RejectInvalidKey(key);
+		if (rejection != null) return rejection;
+
+		if (file == null || file.Length == 0) return BadRequest("No file provided.");
+
+
+
+		var allowed = new[] { ".png", ".jpg", ".jpeg", ".gif", ".webp", ".bmp" };
+		var ext = Path.GetExtension(file.FileName).ToLowerInvariant();
+		if (!allowed.Contains(ext)) return BadRequest($"Unsupported image format '{ext}'. Use png/jpg/jpeg/gif/webp.");
+
+		Directory.CreateDirectory(DBConfig.CDNImages);
+		var name = Guid.NewGuid().ToString("N") + ext;
+		var path = Path.Join(DBConfig.CDNImages, name);
+		using (var stream = new FileStream(path, FileMode.Create))
+		{
+			await file.CopyToAsync(stream);
+		}
+
+		return Ok(new { name, url = $"{DBConfig.ServerUrl}/images/img/{name}" });
+	}
+
+	[HttpPost("upload/room")]
+	[RequestSizeLimit(AdminUtils.MaxUploadBytes)]
+	public async Task<IActionResult> UploadRoom([FromQuery] string key, [FromForm] IFormFile file, [FromQuery] string? name)
+	{
+
+		// An oversized or truncated body fails form binding, so it is reported as the bad
+		// request it is rather than as whatever a half-read form left behind.
+		if (!ModelState.IsValid) return BadRequest($"Invalid upload request. Use a multipart form no larger than {AdminUtils.MaxUploadLabel}.");
+
+		var rejection = await RejectInvalidKey(key);
+		if (rejection != null) return rejection;
+
+		if (file == null || file.Length == 0) return BadRequest("No file provided.");
+
+
+
+
+
+		// A subroom is imported as three kinds of file, and each keeps the role its
+		// extension names: the .room is the save the subroom loads, the .assetbundle
+		// is the Unity scene its unity_assets metadata points at, and the .htr files
+		// are the audio/data blobs that save references by name. They are imported one
+		// file at a time, so every one of them lands in the CDN under the name it was
+		// uploaded as - the 2023 client asks for exactly that name (GET /data/<name>),
+		// which is why a file this route renamed to a GUID could never be found.
+		// An explicit ?name= wins; otherwise the uploaded file's own name is the one to
+		// store, and it is held to the same bare-name rule either way.
+		var candidate = !string.IsNullOrWhiteSpace(name) ? name : Path.GetFileName(file.FileName);
+		if (!AdminUtils.TryResolveUploadName(candidate, out var finalName, out var nameError))
+			return BadRequest(nameError);
+		if (string.IsNullOrEmpty(finalName))
+			return BadRequest("The uploaded file has no name to store it under.");
+
+		// The stored name decides which of the three a file is, so a renamed upload is
+		// classified by what it is being stored as.
+		var kind = RoomFileKind(finalName);
+		if (kind == null)
+		{
+			var ext = Path.GetExtension(finalName).ToLowerInvariant();
+			return BadRequest($"Unsupported room file format '{(string.IsNullOrEmpty(ext) ? "no extension" : ext)}'. Only .room, .htr and .assetbundle room files are allowed.");
+		}
+
+		Directory.CreateDirectory(DBConfig.CDNStorage);
+		var path = Path.Join(DBConfig.CDNStorage, finalName);
+		using (var stream = new FileStream(path, FileMode.Create))
+		{
+			await file.CopyToAsync(stream);
+		}
+
+		return Ok(new { name = finalName, kind, url = $"{DBConfig.ServerUrl}/cdn/data/{finalName}" });
+	}
+
+	/// The stored name decides which of the three a room file is: the extension is the role.
+	private static string? RoomFileKind(string fileName) => Path.GetExtension(fileName).ToLowerInvariant() switch
+	{
+		".room" => "room",
+		".htr" => "htr",
+		".assetbundle" => "assetbundle",
+		_ => null
+	};
+
+	/// <summary>
+	/// One part of a file too big to send in a single request.
+	///
+	/// A whole room file in one request does not survive the trip to this server: the edge
+	/// proxy in front of it refuses a request body over 100 MB and holds a streamed body in
+	/// memory, so importing a large .assetbundle died between the panel and here and surfaced
+	/// to the admin as a broken connection rather than as a size refusal. The panel therefore
+	/// posts anything large in parts, and this route appends each one to
+	/// "&lt;name&gt;.uploading" and promotes it to "&lt;name&gt;" when the last part lands, so
+	/// a half-imported file is never served, listed or bound.
+	///
+	/// The offset is checked against what is already stored, so a part retried after its
+	/// answer was lost either continues where it left off or is told exactly where to continue
+	/// (409, with the stored byte count) instead of corrupting the file.
+	/// </summary>
+	[HttpPost("upload/part")]
+	[RequestSizeLimit(AdminUtils.MaxUploadBytes)]
+	public async Task<IActionResult> UploadPart([FromQuery] string key, [FromQuery] string name, [FromQuery] long offset, [FromQuery] long total)
+	{
+		var rejection = await RejectInvalidKey(key);
+		if (rejection != null) return rejection;
+
+		if (!AdminUtils.TryResolveUploadName(name, out var finalName, out var nameError))
+			return BadRequest(nameError);
+		if (string.IsNullOrEmpty(finalName))
+			return BadRequest("The uploaded file has no name to store it under.");
+		if (AdminUtils.IsUploadPart(finalName))
+			return BadRequest($"'{finalName}' is a partial upload name; import the file under its final name.");
+		if (total <= 0 || total > AdminUtils.MaxUploadBytes)
+			return BadRequest($"A file of that size cannot be imported this way; the limit is {AdminUtils.MaxUploadLabel}.");
+		if (offset < 0 || offset > total)
+			return BadRequest("The part's offset is outside the file it belongs to.");
+
+		Directory.CreateDirectory(DBConfig.CDNStorage);
+		var partPath = Path.Join(DBConfig.CDNStorage, finalName + AdminUtils.PartSuffix);
+		var finalPath = Path.Join(DBConfig.CDNStorage, finalName);
+
+		// A part starting at zero begins the file over, whether or not an abandoned attempt left
+		// bytes behind; any other offset has to line up with what is stored or it is refused.
+		var stored = System.IO.File.Exists(partPath) ? new FileInfo(partPath).Length : 0;
+		if (offset == 0)
+		{
+			if (System.IO.File.Exists(partPath)) System.IO.File.Delete(partPath);
+			stored = 0;
+		}
+		if (stored != offset)
+			return Conflict(new
+			{
+				error = "part_out_of_order",
+				message = $"This import already holds {stored} of {total} bytes, not {offset}.",
+				stored,
+				total
+			});
+
+		long received = 0;
+		using (var stream = new FileStream(partPath, offset == 0 ? FileMode.Create : FileMode.Append, FileAccess.Write, FileShare.None))
+		{
+			var buffer = new byte[81920];
+			int read;
+			while ((read = await Request.Body.ReadAsync(buffer, HttpContext.RequestAborted)) > 0)
+			{
+				received += read;
+				if (offset + received > total)
+				{
+					stream.Dispose();
+					System.IO.File.Delete(partPath);
+					return BadRequest($"This part carried more than the {total} bytes it was sent for; the import was discarded.");
+				}
+				await stream.WriteAsync(buffer.AsMemory(0, read), HttpContext.RequestAborted);
+			}
+		}
+
+		var written = offset + received;
+		if (written < total)
+			return Ok(new { name = finalName, kind = RoomFileKind(finalName), received = written, total, complete = false });
+
+		// The last part: the file becomes the upload it was always meant to be.
+		if (System.IO.File.Exists(finalPath)) System.IO.File.Delete(finalPath);
+		System.IO.File.Move(partPath, finalPath);
+		return Ok(new { name = finalName, kind = RoomFileKind(finalName), url = $"{DBConfig.ServerUrl}/cdn/data/{finalName}", received = written, total, complete = true });
+	}
+
+	/// A part left behind by an import that never finished is not an upload and must not
+	/// accumulate: one older than a day was abandoned, so it goes.
+	private static void SweepAbandonedParts()
+	{
+		if (!Directory.Exists(DBConfig.CDNStorage)) return;
+		foreach (var file in Directory.GetFiles(DBConfig.CDNStorage, "*" + AdminUtils.PartSuffix))
+		{
+			try
+			{
+				if (System.IO.File.GetLastWriteTimeUtc(file) < DateTime.UtcNow.AddHours(-24)) System.IO.File.Delete(file);
+			}
+			catch (IOException) { }
+		}
+	}
+
+	[HttpPost("upload/datablob")]
+	[RequestSizeLimit(AdminUtils.MaxUploadBytes)]
+	public async Task<IActionResult> UploadDatablob([FromQuery] string key, [FromForm] IFormFile file, [FromQuery] string? name)
+	{
+
+		if (!ModelState.IsValid) return BadRequest($"Invalid upload request. Use a multipart form no larger than {AdminUtils.MaxUploadLabel}.");
+
+		var rejection = await RejectInvalidKey(key);
+		if (rejection != null) return rejection;
+
+		if (file == null || file.Length == 0) return BadRequest("No file provided.");
+
+		// Same rule as a room file: the blob keeps the name it arrived under unless
+		// the caller names it, because the client can only ask for a name it knows.
+		var candidate = !string.IsNullOrWhiteSpace(name) ? name : Path.GetFileName(file.FileName);
+		if (!AdminUtils.TryResolveUploadName(candidate, out var requestedName, out var nameError))
+			return BadRequest(nameError);
+		if (string.IsNullOrEmpty(requestedName))
+			return BadRequest("The uploaded file has no name to store it under.");
+
+		Directory.CreateDirectory(DBConfig.CDNStorage);
+		var finalName = requestedName;
+		var path = Path.Join(DBConfig.CDNStorage, finalName);
+		using (var stream = new FileStream(path, FileMode.Create))
+		{
+			await file.CopyToAsync(stream);
+		}
+
+		return Ok(new { name = finalName, url = $"{DBConfig.ServerUrl}/cdn/data/{finalName}" });
+	}
+
+	[HttpGet("uploads")]
+	public async Task<IActionResult> ListUploads([FromQuery] string key)
+	{
+		var rejection = await RejectInvalidKey(key);
+		if (rejection != null) return rejection;
+
+
+
+
+		string[] Scan(string dir)
+		{
+			if (!Directory.Exists(dir)) return Array.Empty<string>();
+			SweepAbandonedParts();
+			return Directory.GetFiles(dir)
+				.Select(f => Path.GetFileName(f)!)
+				// A part of a file still being uploaded is not an upload: it is invisible until
+				// its last part lands and it becomes the file it was sent as.
+				.Where(n => !AdminUtils.IsUploadPart(n))
+				.OrderByDescending(f => System.IO.File.GetLastWriteTimeUtc(Path.Join(dir, f)))
+				.ToArray();
+		}
+
+		var images = Scan(DBConfig.CDNImages);
+		var videos = Scan(DBConfig.CDNVideos);
+		var storage = Scan(DBConfig.CDNStorage);
+		var bundles = storage.Where(n => n.EndsWith(".assetbundle", StringComparison.OrdinalIgnoreCase)).ToArray();
+
+
+
+		long SizeOf(string dir, string name)
+		{
+			try { return new FileInfo(Path.Join(dir, name)).Length; }
+			catch { return 0; }
+		}
+
+		return Ok(new
+		{
+			images = images.Select(n => new { name = n, url = $"{DBConfig.ServerUrl}/images/img/{n}", size = SizeOf(DBConfig.CDNImages, n) }).Cast<object>().ToList(),
+			videos = videos.Select(n => new { name = n, url = $"{DBConfig.ServerUrl}/cdn/video/{n}", size = SizeOf(DBConfig.CDNVideos, n) }).Cast<object>().ToList(),
+			rooms = storage.Select(n => new { name = n, url = $"{DBConfig.ServerUrl}/cdn/room/{n}", size = SizeOf(DBConfig.CDNStorage, n) }).Cast<object>().ToList(),
+			assetbundles = bundles.Select(n => new { name = n, url = $"{DBConfig.ServerUrl}/cdn/data/{n}", size = SizeOf(DBConfig.CDNStorage, n) }).Cast<object>().ToList(),
+			datablobs = storage.Select(n => new { name = n, url = $"{DBConfig.ServerUrl}/cdn/data/{n}", size = SizeOf(DBConfig.CDNStorage, n) }).Cast<object>().ToList()
+		});
+	}
+
+	[HttpDelete("uploads")]
+	public async Task<IActionResult> DeleteUpload([FromQuery] string key, [FromQuery] string type, [FromQuery] string name)
+	{
+		var rejection = await RejectInvalidKey(key);
+		if (rejection != null) return rejection;
+
+		if (string.IsNullOrWhiteSpace(name)) return BadRequest("No file name provided.");
+
+
+
+		name = Path.GetFileName(name);
+		string dir = type switch
+		{
+			"image" => DBConfig.CDNImages,
+			"video" => DBConfig.CDNVideos,
+			_ => DBConfig.CDNStorage
+		};
+
+		var path = Path.Join(dir, name);
+		if (!System.IO.File.Exists(path)) return NotFound("File not found.");
+
+		System.IO.File.Delete(path);
+		return Ok(new { deleted = name });
+	}
+
+	[HttpPost("{table}")]
+	public async Task<IActionResult> Insert(string table, [FromQuery] string key, [FromBody] JsonElement payload)
+	{
+		var rejection = await RejectInvalidKey(key);
+		if (rejection != null) return rejection;
+
+		if (table == "gift_drops" || table == "storefront_items")
+			return Ok(await CreateGiftDrop(payload));
+
+		if (table == "ip_bans")
+			return Ok(await AddIpBan(payload));
+
+		if (table == "hardware_bans")
+			return Ok(await AddHardwareBan(payload));
+
+		if (table == "account_creation_blocks")
+			return Ok(await AddAccountCreationBlock(payload));
+
+		if (table == "game_blocks")
+		{
+
+
+			var addGameBlockResult = await AddGameBlock(payload);
+			return addGameBlockResult is IActionResult actionResult ? actionResult : Ok(addGameBlockResult);
+		}
+
+		if (table == "gameconfigs" || table == "serverconfigs")
+			return Ok(await UpsertConfig(table, null, payload));
+
+		if (table == "playlists")
+		{
+			var keywords = GetJsonString(payload, "keywords") ?? "";
+			if (string.IsNullOrWhiteSpace(keywords)) return BadRequest("Keywords are required.");
+			return Ok(await CreatePlaylist(keywords));
+		}
+
+		if (table == "item_sets")
+		{
+			var friendlyName = GetJsonString(payload, "item_set_friendly_name") ?? GetJsonString(payload, "friendly_name") ?? "";
+			if (string.IsNullOrWhiteSpace(friendlyName)) return BadRequest("A friendly name is required.");
+			return Ok(await CreateItemSet(friendlyName));
+		}
+
+		if (table == "tags")
+		{
+			var tag = GetJsonString(payload, "tag") ?? "";
+			if (string.IsNullOrWhiteSpace(tag)) return BadRequest("A tag is required.");
+			var description = GetJsonString(payload, "description") ?? "";
+			return Ok(await CreateTag(tag, description));
+		}
+
+		var state = LoadState();
+		return table switch
+		{
+			"storefronts" => Ok(AddStorefront(state, payload)),
+			"challenges" => Ok(AddChallenge(state, payload)),
+			"moderation_log" => InsertLoggedRows(state, state.ModerationLog, payload, "moderation_log"),
+			"gift_log" => await InsertGiftLogRows(state, payload),
+			"notes" => Ok(RowsResponse(payload, AddRows(state, state.Notes, payload))),
+			"audit_log" => InsertLoggedRows(state, state.AuditLog, payload, "audit_log"),
+			"community_board" => Ok(await UpdateCommunityBoard(state, payload)),
+			"announcements" => await UpdateAnnouncements(payload),
+			_ => NotFound($"Unknown admin panel table '{table}'.")
+		};
+	}
+
+	public async Task<IActionResult> Update(string table, long id, [FromQuery] string key, [FromBody] JsonElement payload)
+	{
+		var rejection = await RejectInvalidKey(key);
+		if (rejection != null) return rejection;
+
+		if (table == "players")
+		{
+
+
+			var updatePlayerResult = await UpdatePlayer(id, payload);
+			return updatePlayerResult is IActionResult actionResult ? actionResult : Ok(updatePlayerResult);
+		}
+
+		if (table == "rooms")
+		{
+			var updateRoomResult = await UpdateRoom(id, payload);
+			return updateRoomResult is IActionResult roomActionResult ? roomActionResult : Ok(updateRoomResult);
+		}
+
+		if (table == "player_events")
+			return Ok(await UpdatePlayerEvent(id, payload));
+
+		if (table == "gift_drops" || table == "storefront_items")
+			return Ok(await UpdateGiftDrop(id, payload));
+
+		if (table == "playlists")
+			return await UpdatePlaylist(id, payload);
+
+		if (table == "item_sets")
+			return await UpdateItemSet(id, payload);
+
+		if (table == "tags")
+			return await UpdateTag(id, payload);
+
+		var state = LoadState();
+		return table switch
+		{
+			"storefronts" => Ok(UpdateRow(state, state.Storefronts, id, payload)),
+			"challenges" => Ok(UpdateRow(state, state.Challenges, id, payload)),
+			"moderation_reports" => Ok(UpdateRow(state, state.ModerationReports, id, payload)),
+			"community_board" => Ok(await UpdateCommunityBoard(state, payload)),
+			_ => NotFound($"Unknown admin panel table '{table}'.")
+		};
+	}
+
+	[HttpPatch("{table}")]
+	public async Task<IActionResult> UpdateNoId(string table, [FromQuery] string key, [FromBody] JsonElement payload)
+	{
+		var rejection = await RejectInvalidKey(key);
+		if (rejection != null) return rejection;
+
+		var state = LoadState();
+		return table switch
+		{
+			"community_board" => Ok(await UpdateCommunityBoard(state, payload)),
+			_ => NotFound($"Unknown admin panel table '{table}'.")
+		};
+	}
+
+	[HttpPatch("{table}/{id}")]
+	public async Task<IActionResult> UpdateByKey(string table, string id, [FromQuery] string key, [FromBody] JsonElement payload)
+	{
+		var rejection = await RejectInvalidKey(key);
+		if (rejection != null) return rejection;
+
+		if (table == "gameconfigs" || table == "serverconfigs")
+			return Ok(await UpsertConfig(table, id, payload));
+
+		if (long.TryParse(id, out var rowId))
+			return await Update(table, rowId, key, payload);
+
+		return NotFound($"Unknown admin panel table '{table}'.");
+	}
+
+	private async Task<IActionResult> UpsertConfig(string table, string? fallbackKey, JsonElement payload)
+	{
+		string? key = null, value = null;
+		if (payload.ValueKind == JsonValueKind.Object)
+		{
+			foreach (var prop in payload.EnumerateObject())
+			{
+				if (prop.Name.Equals("Key", StringComparison.OrdinalIgnoreCase))
+					key = prop.Value.ValueKind == JsonValueKind.String ? prop.Value.GetString() : prop.Value.ToString();
+				else if (prop.Name.Equals("Value", StringComparison.OrdinalIgnoreCase))
+					value = prop.Value.ValueKind == JsonValueKind.String ? prop.Value.GetString() : prop.Value.ToString();
+			}
+		}
+
+		key ??= fallbackKey;
+		if (string.IsNullOrWhiteSpace(key)) return BadRequest("Config 'Key' is required.");
+		value ??= "";
+
+		if (table == "gameconfigs")
+		{
+			var row = await db.GameConfig.FirstOrDefaultAsync(x => x.Key == key);
+			if (row == null) db.GameConfig.Add(new ConfigVal(key, value));
+			else row.Value = value;
+		}
+		else
+		{
+			var row = await db.ServerConfig.FirstOrDefaultAsync(x => x.Key == key);
+			if (row == null) db.ServerConfig.Add(new ServerConfigVal(key, value));
+			else row.Value = value;
+		}
+		await db.SaveChangesAsync();
+		return Ok(new { Key = key, Value = value });
+	}
+
+	[HttpDelete("{table}")]
+	public async Task<IActionResult> Delete(string table, [FromQuery] string key, [FromQuery(Name = "in_col")] string? inCol, [FromQuery(Name = "in_vals")] string? inVals, [FromQuery(Name = "eq_col")] string? eqCol, [FromQuery(Name = "eq_val")] string? eqVal, [FromQuery(Name = "room_id")] long? roomId, [FromQuery(Name = "stat_channel")] int? statChannel, [FromQuery(Name = "player_id")] long? playerId)
+	{
+		var rejection = await RejectInvalidKey(key);
+		if (rejection != null) return rejection;
+
+		var ids = ParseIds(inVals ?? eqVal);
+
+		if (table == "gameconfigs" || table == "serverconfigs")
+		{
+			var cfgKeys = (inVals ?? eqVal ?? "")
+				.Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries)
+				.ToList();
+			if (table == "gameconfigs")
+			{
+				var rows = await db.GameConfig.Where(x => cfgKeys.Contains(x.Key)).ToListAsync();
+				db.GameConfig.RemoveRange(rows);
+				await db.SaveChangesAsync();
+				return Ok(rows);
+			}
+			else
+			{
+				var rows = await db.ServerConfig.Where(x => cfgKeys.Contains(x.Key)).ToListAsync();
+				db.ServerConfig.RemoveRange(rows);
+				await db.SaveChangesAsync();
+				return Ok(rows);
+			}
+		}
+
+		if (table == "gift_drops" || table == "storefront_items")
+		{
+			var gifts = await db.GiftItems.Where(x => ids.Contains(x.GiftDropId)).ToListAsync();
+			db.GiftItems.RemoveRange(gifts);
+			await db.SaveChangesAsync();
+			return Ok(gifts);
+		}
+
+		if (table == "playlists")
+		{
+			var playlists = await db.Playlists.Where(x => ids.Contains(x.PlaylistId)).ToListAsync();
+			db.Playlists.RemoveRange(playlists);
+			await db.SaveChangesAsync();
+			return Ok(playlists);
+		}
+
+		if (table == "item_sets")
+		{
+			var sets = await db.ItemSets.Where(x => ids.Contains(x.ItemSetId)).ToListAsync();
+			db.ItemSets.RemoveRange(sets);
+			await db.SaveChangesAsync();
+			return Ok(sets);
+		}
+
+		if (table == "tags")
+		{
+			var tags = await db.Tags.Where(x => ids.Contains(x.TagId)).ToListAsync();
+			db.Tags.RemoveRange(tags);
+			await db.SaveChangesAsync();
+			return Ok(tags);
+		}
+
+		if (table == "player_events")
+			return Ok(await DeletePlayerEvents(ids));
+
+		if (table == "ip_bans")
+		{
+			var ipRows = await db.IpBans.Where(x => ids.Contains(x.Id)).ToListAsync();
+			db.IpBans.RemoveRange(ipRows);
+			await db.SaveChangesAsync();
+			return Ok(ipRows);
+		}
+
+		if (table == "hardware_bans")
+		{
+			var hwRows = await db.HardwareBans.Where(x => ids.Contains(x.Id)).ToListAsync();
+			db.HardwareBans.RemoveRange(hwRows);
+			await db.SaveChangesAsync();
+			return Ok(hwRows);
+		}
+
+		if (table == "account_creation_blocks")
+		{
+			var blockRows = await db.AccountCreationBlocks.Where(x => ids.Contains(x.Id)).ToListAsync();
+			db.AccountCreationBlocks.RemoveRange(blockRows);
+			await db.SaveChangesAsync();
+			return Ok(blockRows);
+		}
+
+		if (table == "game_blocks")
+		{
+			var gameBlockRows = await db.GameBlocks.Where(x => ids.Contains(x.Id)).ToListAsync();
+			db.GameBlocks.RemoveRange(gameBlockRows);
+			await db.SaveChangesAsync();
+
+			if (gameBlockRows.Count > 0) GameBlockMonitor.Invalidate();
+			return Ok(gameBlockRows);
+		}
+
+		if (table == "room_comments")
+		{
+			var commentRows = await db.RoomComments.Where(x => ids.Contains(x.Id)).ToListAsync();
+			db.RoomComments.RemoveRange(commentRows);
+			await db.SaveChangesAsync();
+			return Ok(commentRows);
+		}
+
+		if (table == "leaderboard_scores")
+		{
+
+
+
+			if (roomId.HasValue && statChannel.HasValue)
+			{
+
+
+
+				var query = db.LeaderboardScores.Where(x => x.StatChannel == statChannel.Value);
+				if (roomId.Value > 0)
+					query = query.Where(x => x.RoomId == roomId.Value);
+				if (playerId.HasValue)
+					query = query.Where(x => x.PlayerId == playerId.Value);
+
+				var boardRows = await query.ToListAsync();
+				db.LeaderboardScores.RemoveRange(boardRows);
+				await db.SaveChangesAsync();
+				return Ok(boardRows);
+			}
+
+			var scoreRows = await db.LeaderboardScores.Where(x => ids.Contains(x.Id)).ToListAsync();
+			db.LeaderboardScores.RemoveRange(scoreRows);
+			await db.SaveChangesAsync();
+			return Ok(scoreRows);
+		}
+
+		var state = LoadState();
+		return table switch
+		{
+			"storefronts" => Ok(DeleteRows(state, state.Storefronts, ids)),
+			"challenges" => Ok(DeleteRows(state, state.Challenges, ids)),
+			"notes" => Ok(DeleteRows(state, state.Notes, ids)),
+			"announcements" => Ok(await DeleteAnnouncements(ids)),
+			"clubs" => Ok(await DeleteClubs(ids)),
+			_ => NotFound($"Unknown admin panel table '{table}'.")
+		};
+	}
+
+	private async Task<List<object>> DeleteClubs(List<long> ids)
+	{
+		var deleted = new List<object>();
+		foreach (var id in ids)
+		{
+			if (id <= 0) continue;
+			if (await ClubStore.DeleteAsync(db, id)) deleted.Add(new { club_id = id });
+		}
+		return deleted;
+	}
+
+	private async Task<List<object>> DeleteAnnouncements(List<long> ids)
+	{
+		var config = await db.ServerConfig.FirstOrDefaultAsync(x => x.Key == "Announcement");
+		if (config == null || string.IsNullOrWhiteSpace(config.Value))
+			return new List<object>();
+
+		try
+		{
+			var list = config.Value.FromJson<List<JsonObject>>() ?? new List<JsonObject>();
+			var removed = new List<JsonObject>();
+
+
+			var toRemove = ids.Count > 0
+				? list.Where(x => ids.Contains(ReadAnnouncementId(x) ?? 0)).ToList()
+				: list;
+
+			foreach (var item in toRemove)
+			{
+				list.Remove(item);
+				removed.Add(item);
+			}
+
+			config.Value = JsonSerializer.Serialize(list);
+			await db.SaveChangesAsync();
+
+			foreach (var deleted in toRemove)
+			{
+				try { await Notify.SendGlobalNotify(AnnouncementBroadcast.Delete(ToAnnouncement(deleted))); }
+				catch (Exception) { }
+			}
+
+
+
+
+			var touchedMaintenance = toRemove.Any(x => string.Equals(x["type"]?.ToString(), "Maintenance", StringComparison.OrdinalIgnoreCase))
+				|| list.Any(x => string.Equals(x["type"]?.ToString(), "Maintenance", StringComparison.OrdinalIgnoreCase));
+			if (touchedMaintenance)
+				await RecomputeMaintenanceFromAnnouncements(list);
+
+			return removed.Cast<object>().ToList();
+		}
+		catch
+		{
+			return new List<object>();
+		}
+	}
+
+
+
+
+
+	private async Task ApplyMaintenanceToConfig(int startsInMinutes)
+	{
+		var config = await db.Config.FirstOrDefaultAsync();
+		if (config == null) return;
+
+		config.ServerMaintenance = new ServerMaintenance { StartsInMinutes = Math.Clamp(startsInMinutes, 0, 61) }.ToJson();
+		await db.SaveChangesAsync();
+
+		if (MainConfig.ActiveConfig != null)
+			MainConfig.ActiveConfig.ServerMaintenance = config.ServerMaintenance;
+	}
+
+
+
+
+
+	private async Task RecomputeMaintenanceFromAnnouncements(List<JsonObject> list)
+	{
+		var config = await db.Config.FirstOrDefaultAsync();
+		if (config == null) return;
+
+		var now = DateTime.UtcNow;
+		int minutes = 0;
+		foreach (var item in list)
+		{
+			if (!string.Equals(item["type"]?.ToString(), "Maintenance", StringComparison.OrdinalIgnoreCase)) continue;
+
+			if (item["expires_at"]?.ToString() is string expiresRaw &&
+				DateTime.TryParse(expiresRaw, out var expiry) && expiry <= now) continue;
+
+			var itemMinutes = item["minutes"]?.GetValue<int>();
+			if (itemMinutes.HasValue && itemMinutes.Value > 0)
+				minutes = Math.Min(61, Math.Max(minutes, itemMinutes.Value));
+		}
+
+		config.ServerMaintenance = new ServerMaintenance { StartsInMinutes = minutes }.ToJson();
+		await db.SaveChangesAsync();
+
+		if (MainConfig.ActiveConfig != null)
+			MainConfig.ActiveConfig.ServerMaintenance = config.ServerMaintenance;
+	}
+
+	private async Task<List<object>> GetPlayers(string? order, bool ascending)
+	{
+		var profiles = await db.Profiles.ToListAsync();
+		var playerIds = profiles.Select(x => x.accountId).ToList();
+		var players = await db.Players.Where(x => playerIds.Contains(x.AccountId)).ToDictionaryAsync(x => x.AccountId);
+		var progression = await db.Progression.Where(x => playerIds.Contains(x.PlayerId)).ToDictionaryAsync(x => x.PlayerId);
+		var reputations = await db.Reputations.Where(x => playerIds.Contains(x.AccountId)).ToDictionaryAsync(x => x.AccountId);
+		var presences = await db.Presences.Where(x => playerIds.Contains(x.playerId)).ToDictionaryAsync(x => x.playerId);
+		var moderation = await db.Moderation.Where(x => playerIds.Contains(x.PlayerId) && x.IsBan).ToListAsync();
+
+
+
+		var expiredBans = moderation.Where(m => m.ExpireDuration < DateTime.UtcNow).ToList();
+		foreach (var expired in expiredBans)
+		{
+			db.Moderation.Remove(expired);
+			moderation.Remove(expired);
+		}
+		if (expiredBans.Count > 0) await db.SaveChangesAsync();
+		var activeBans = moderation.ToDictionary(x => x.PlayerId);
+
+
+		var hardwareBans = await db.HardwareBans.ToListAsync();
+		var ipBans = await db.IpBans.ToListAsync();
+		var accountCreationBlocks = await db.AccountCreationBlocks.ToListAsync();
+		var settings = await db.PlayerSettings.Where(x => playerIds.Contains(x.AccountId)).ToDictionaryAsync(x => x.AccountId);
+		var currencies = await db.Currency.Where(x => playerIds.Contains(x.AccountId)).ToDictionaryAsync(x => x.AccountId);
+		var cached = await db.CachedLogins.Where(x => playerIds.Contains(x.accountId)).ToListAsync();
+
+
+
+
+
+		var connectedAccounts = new HashSet<long>(Notify.SnapshotClients().Select(x => x.AccountId));
+
+		var rows = profiles.Select(profile =>
+		{
+			players.TryGetValue(profile.accountId, out var player);
+			progression.TryGetValue(profile.accountId, out var progress);
+			reputations.TryGetValue(profile.accountId, out var rep);
+			presences.TryGetValue(profile.accountId, out var presence);
+			activeBans.TryGetValue(profile.accountId, out var ban);
+			var progressJson = progress?.GetProgressionJson();
+
+
+
+
+
+			var hardwareBan = player != null && !string.IsNullOrWhiteSpace(player.DeviceId)
+				? hardwareBans.FirstOrDefault(h => h.DeviceId == player.DeviceId && (!h.ExpiresAt.HasValue || h.ExpiresAt.Value >= DateTime.UtcNow))
+				: null;
+			var ipBan = player != null && !string.IsNullOrWhiteSpace(player.LastIpAddress)
+				? ipBans.FirstOrDefault(ip => ip.IpAddress == player.LastIpAddress && (!ip.ExpiresAt.HasValue || ip.ExpiresAt.Value >= DateTime.UtcNow))
+				: null;
+			var ipBanned = ipBan != null;
+
+
+
+			var accountCreationBlocked = player != null && !string.IsNullOrWhiteSpace(player.LastIpAddress)
+				? accountCreationBlocks.Any(b => b.IpAddress == player.LastIpAddress && (!b.ExpiresAt.HasValue || b.ExpiresAt.Value >= DateTime.UtcNow))
+				: false;
+
+			settings.TryGetValue(profile.accountId, out var playerSettings);
+			currencies.TryGetValue(profile.accountId, out var currency);
+			var login = cached.FirstOrDefault(x => x.accountId == profile.accountId);
+
+			var birthday = player?.Birthday;
+			var hasRealBirthday = birthday != null && birthday.Value.Year > 1900;
+			var age = hasRealBirthday ? (int?)Math.Floor((DateTime.UtcNow - birthday!.Value).TotalDays / 365.2425) : null;
+			var settingsList = playerSettings?.DeserializeSettings() ?? new List<Setting>();
+			var settingsMap = settingsList
+				.Where(x => !string.IsNullOrWhiteSpace(x.Key))
+				.GroupBy(x => x.Key)
+				.ToDictionary(x => x.Key, x => x.Last().Value);
+
+
+			var nameHistoryList = new List<string>();
+			if (settingsMap.TryGetValue("NameHistory", out var nhRaw))
+			{
+				try { nameHistoryList = nhRaw.FromJson<List<string>>() ?? new List<string>(); } catch { nameHistoryList = new List<string>(); }
+			}
+
+			bool isOnline = presence?.isOnline == true && connectedAccounts.Contains(profile.accountId);
+
+			return new
+			{
+				id = profile.accountId,
+				name = profile.displayName,
+				original_name = profile.username,
+				username = profile.username,
+				platform = login?.platform.ToString() ?? "Steam",
+				platform_id = login?.platformId ?? "",
+				joined_at = DateTime.SpecifyKind(profile.createdAt, DateTimeKind.Utc),
+				last_online_at = isOnline ? DateTime.UtcNow : DateTime.SpecifyKind(login?.lastLoginTime ?? profile.createdAt, DateTimeKind.Utc),
+				bio = profile.bio,
+				email = player?.Email ?? "",
+				level = progress?.Level ?? 0,
+				xp = progress?.XP ?? 0,
+				last_xp_earned_at = progressJson?.LastXpEarnedAt,
+				xp_earned_today = progressJson?.XpEarnedToday ?? 0,
+				reputation = rep?.ReputationScore ?? Reputation.DefaultReputation,
+
+
+				trust = rep?.Trust ?? "Trusted",
+				report_count = rep?.ReportCount ?? 0,
+				noteriety = rep?.Noteriety ?? 0,
+				cheer_general = rep?.CheerGeneral ?? 0,
+				cheer_helpful = rep?.CheerHelpful ?? 0,
+				cheer_great_host = rep?.CheerGreatHost ?? 0,
+				cheer_sportsman = rep?.CheerSportsman ?? 0,
+				cheer_creative = rep?.CheerCreative ?? 0,
+				cheer_credit = rep?.CheerCredit ?? 0,
+				subscriber_count = 0,
+				subscribed_count = 0,
+				name_history = nameHistoryList,
+				settings = settingsMap,
+
+
+				avatar_image = ImageUrl(profile.profileImage),
+				avatar_color = (string?)null,
+				is_online = isOnline,
+				online = isOnline,
+				banned = ban != null || hardwareBan != null || ipBan != null,
+				ban_reason = ban?.Message ?? hardwareBan?.Reason ?? ipBan?.Reason ?? "",
+				ban_type = ban != null
+					? (ban.ExpireDuration >= DateTime.MaxValue.AddYears(-10) || ban.ExpireDuration - DateTime.UtcNow > TimeSpan.FromDays(365 * 10)
+						? "Permanent"
+						: "Temporary")
+					: (hardwareBan != null
+						? (hardwareBan.ExpiresAt.HasValue ? "Temporary" : "Permanent")
+						: (ipBan != null ? (ipBan.ExpiresAt.HasValue ? "Temporary" : "Permanent") : "Temporary")),
+
+
+				ban_until = ban != null
+					? DateTime.SpecifyKind(ban.ExpireDuration, DateTimeKind.Utc)
+					: (hardwareBan != null && hardwareBan.ExpiresAt.HasValue
+						? DateTime.SpecifyKind(hardwareBan.ExpiresAt.Value, DateTimeKind.Utc)
+						: (ipBan != null && ipBan.ExpiresAt.HasValue
+							? DateTime.SpecifyKind(ipBan.ExpiresAt.Value, DateTimeKind.Utc)
+							: (DateTime?)null)),
+				ban_method = ban != null && !string.IsNullOrWhiteSpace(ban.BanMethod)
+					? ban.BanMethod
+					: (hardwareBan != null ? "Hardware Ban" : (ipBan != null ? "IP Ban" : "None")),
+
+
+				ban_is_moderator = ban?.Message?.StartsWith("Moderator.", StringComparison.OrdinalIgnoreCase) == true,
+				ban_category = ban?.Category ?? (hardwareBan != null ? ReportCategory.Misc : (ipBan != null ? ReportCategory.Misc : ReportCategory.Unknown)),
+				appeal_code = ban?.AppealCode,
+				ban_action_type = ModerationPolicy.IsVoiceModeration(ban?.BanMethod) ? "VoiceModeration" : (ModerationPolicy.IsTimeout(ban?.BanMethod) ? "Timeout" : "Moderation"),
+				account_locked = ban != null && string.Equals(ban.BanMethod, "Account Lock", StringComparison.OrdinalIgnoreCase),
+
+				ban_display_reason = ban?.Message != null && ModerationPolicy.IsVoiceModeration(ban.BanMethod)
+					? $"{ModerationPolicy.AutomaticVoiceModerationBanText}\n\n{ban.Message}"
+					: ban?.Message,
+				ban_started_at = ban != null ? DateTime.SpecifyKind(ban.CreatedAt, DateTimeKind.Utc) : (hardwareBan != null ? DateTime.SpecifyKind(hardwareBan.CreatedAt, DateTimeKind.Utc) : (ipBan != null ? DateTime.SpecifyKind(ipBan.CreatedAt, DateTimeKind.Utc) : (DateTime?)null)),
+				ban_related_account_username = hardwareBan?.BannedAccountId.HasValue == true && hardwareBan.BannedAccountId.Value != profile.accountId
+					? profiles.FirstOrDefault(p => p.accountId == hardwareBan.BannedAccountId.Value)?.username
+					: null,
+				ban_note = ban?.ModeratorNote,
+				ip_banned = ipBanned,
+				hardware_banned = hardwareBan != null,
+				account_creation_blocked = accountCreationBlocked,
+
+
+				device_class = player?.DeviceClass switch
+				{
+					DeviceClass.VR or DeviceClass.VRLow or DeviceClass.Quest2 => "VR",
+					DeviceClass.Screen or DeviceClass.Mobile => "Screen",
+					_ => "Screen"
+				},
+				device_id = player?.DeviceId ?? "",
+				ip = player?.LastIpAddress ?? "",
+				is_junior = profile.isJunior,
+				jr_state = player?.JuniorState.ToString() ?? "N/A",
+				name_locked = profile.NameLocked,
+				bio_locked = profile.BioLocked,
+				parent_account_id = player?.Parent,
+				has_birthday = hasRealBirthday,
+				age = age,
+				is_parental_locked = settingsMap.ContainsKey("IsParentalLocked") && settingsMap["IsParentalLocked"] == "true",
+				is_coach = false,
+				coach_status = "",
+				roles = profile.role?.Split(',', StringSplitOptions.RemoveEmptyEntries).Select(r => r.Trim()).ToList() ?? new List<string>(),
+				rec_tokens = currency?.RecTokens ?? 0,
+				laser_tag_tickets = currency?.LaserTagTickets ?? 0,
+				gold = currency?.Gold ?? 0,
+				dracula_silver = currency?.DraculaSilver ?? 0
+			};
+		}).Cast<object>().ToList();
+
+		return OrderRows(rows, order, ascending);
+	}
+
+	private async Task<List<object>> GetStorefrontItems(string? eqCol, string? eqVal, string? order, bool ascending)
+	{
+		var storefrontId = eqCol == "storefront_id" && long.TryParse(eqVal, out var parsed) ? parsed : (long?)null;
+
+		if (storefrontId is > 0 && StorefrontCatalog.StorefrontIds.Contains(storefrontId.Value))
+			return OrderRows(CatalogStorefrontItems(storefrontId.Value), order, ascending);
+
+		var query = db.GiftItems.AsQueryable();
+
+
+
+
+		if (storefrontId != null)
+			query = query.Where(x => x.StorefrontId == storefrontId.Value);
+		else
+			query = query.Where(x => x.StorefrontId > 0);
+
+		var giftDrops = await query.ToListAsync();
+		var storefrontNames = GetStorefrontDisplayNames();
+
+		var rows = giftDrops.Select(g => new
+		{
+			id = g.GiftDropId,
+			name = g.Name,
+			start_time = g.StartTime,
+			end_time = g.EndTime,
+			storefront_id = g.StorefrontId,
+			storefront_name = storefrontNames.TryGetValue(g.StorefrontId, out var sfName) ? sfName : "",
+			description = g.Description,
+			currency_amount = g.CurrencyAmount,
+			xp_amount = g.XPAmount,
+			avatar_items = g.AvatarItems,
+			equipment_items = g.EquipmentItems,
+			consumable_items = g.ConsumableItems,
+			purchasable_item_id = g.PurchasableItemId,
+			is_featured = g.IsFeatured,
+			price = g.Price,
+			currency_type = g.CurrencyType.ToString(),
+			rarity = g.Rarity.ToString(),
+			context = g.Context.ToString(),
+			avatar_item_type = g.AvatarItemType.ToString(),
+			equipment_modification_guid = g.EquipmentModificationGuid,
+			tooltip = g.Tooltip,
+			is_query = g.IsQuery,
+			unique = g.Unique,
+			subscribers_only = g.SubscribersOnly,
+			item_set_id = g.ItemSetId,
+			item_set_friendly_name = g.ItemSetFriendlyName
+		}).Cast<object>().ToList();
+
+		return OrderRows(rows, order, ascending);
+	}
+
+	private static List<object> CatalogStorefrontItems(long storefrontId)
+	{
+		var storefrontName = StorefrontDisplayName(storefrontId);
+		var rows = new List<object>();
+
+		foreach (var item in StorefrontCatalog.GetItems(storefrontId))
+		{
+			var gift = item.GiftDrop;
+			var price = item.Prices.FirstOrDefault() ?? item.SubscriberPrices.FirstOrDefault();
+
+			rows.Add(new
+			{
+				id = item.PurchasableItemId,
+				name = gift?.FriendlyName ?? "",
+				start_time = (DateTime?)null,
+				end_time = (DateTime?)null,
+				storefront_id = storefrontId,
+				storefront_name = storefrontName,
+				description = "",
+				currency_amount = gift?.Currency ?? 0,
+				xp_amount = gift?.Xp ?? 0,
+				avatar_items = gift?.AvatarItemDesc ?? "",
+				equipment_items = gift?.EquipmentPrefabName ?? "",
+				consumable_items = gift?.ConsumableItemDesc ?? "",
+				gift_drop_id = gift?.GiftDropId ?? 0,
+				purchasable_item_id = item.PurchasableItemId,
+				is_featured = item.IsFeatured,
+				price = price?.Price ?? 0,
+				currency_type = (price?.CurrencyType ?? CurrencyType.RecCenterTokens).ToString(),
+				rarity = (gift?.Rarity ?? Rarity.Common).ToString(),
+				context = (gift?.Context ?? GiftContext.Commerce_Purchase).ToString(),
+				avatar_item_type = (gift?.AvatarItemType ?? AvatarItemType.Outfit).ToString(),
+				equipment_modification_guid = gift?.EquipmentModificationGuid ?? "",
+				tooltip = gift?.Tooltip ?? "",
+				is_query = gift?.IsQuery ?? false,
+				unique = gift?.Unique ?? false,
+				subscribers_only = gift?.SubscribersOnly ?? false,
+				item_set_id = gift?.ItemSetId ?? 0,
+				item_set_friendly_name = gift?.ItemSetFriendlyName ?? "",
+				is_shipped = true
+			});
+		}
+
+		return rows;
+	}
+
+
+
+
+
+	private async Task<List<object>> GetGiftDrops(string? order, bool ascending)
+	{
+		var giftDrops = await db.GiftItems.ToListAsync();
+
+
+
+		var storefrontNames = GetStorefrontDisplayNames();
+
+		var rows = giftDrops.Select(g => new
+		{
+			id = g.GiftDropId,
+			name = g.Name,
+			start_time = g.StartTime,
+			end_time = g.EndTime,
+			storefront_id = g.StorefrontId,
+			storefront_name = storefrontNames.TryGetValue(g.StorefrontId, out var sfName) ? sfName : "",
+			description = g.Description,
+			currency_amount = g.CurrencyAmount,
+			xp_amount = g.XPAmount,
+			avatar_items = g.AvatarItems,
+			equipment_items = g.EquipmentItems,
+			consumable_items = g.ConsumableItems,
+			purchasable_item_id = g.PurchasableItemId,
+			is_featured = g.IsFeatured,
+			price = g.Price,
+			currency_type = g.CurrencyType.ToString(),
+			rarity = g.Rarity.ToString(),
+			context = g.Context.ToString(),
+			avatar_item_type = g.AvatarItemType.ToString(),
+			equipment_modification_guid = g.EquipmentModificationGuid,
+			tooltip = g.Tooltip,
+			is_query = g.IsQuery,
+			unique = g.Unique,
+			subscribers_only = g.SubscribersOnly,
+			item_set_id = g.ItemSetId,
+			item_set_friendly_name = g.ItemSetFriendlyName
+		}).Cast<object>().ToList();
+
+		return OrderRows(rows, order, ascending);
+	}
+
+
+
+
+	private static readonly JsonSerializerOptions CatalogJsonOptions = new()
+	{
+		PropertyNameCaseInsensitive = true,
+		Converters = { new System.Text.Json.Serialization.JsonStringEnumConverter() }
+	};
+
+	private List<object> GetEquipmentItems()
+	{
+		var defaultItems = DBConfig.DefaultEquipmentItems.FromJson<List<Equipment>>(CatalogJsonOptions) ?? new List<Equipment>();
+		var rows = defaultItems
+			.Where(x => x != null && !string.IsNullOrWhiteSpace(x.PrefabName))
+			.Select(item => new
+			{
+				equipment_prefab_name = item.PrefabName,
+				modification_guid = item.ModificationGuid ?? "",
+				friendly_name = string.IsNullOrWhiteSpace(item.FriendlyName) ? item.PrefabName : item.FriendlyName,
+				tooltip = item.Tooltip ?? "",
+				rarity = item.Rarity.ToString()
+			}).ToList();
+		if (rows.Count > 0)
+			return rows.Cast<object>().ToList();
+
+		var legacyItems = DBConfig.DefaultEquipmentItems.FromJson<List<EquipmentItem>>(CatalogJsonOptions) ?? new List<EquipmentItem>();
+		return legacyItems
+			.Where(x => x != null && !string.IsNullOrWhiteSpace(x.EquipmentPrefabName))
+			.Select(item => new
+			{
+				equipment_prefab_name = item.EquipmentPrefabName,
+				modification_guid = "",
+				friendly_name = string.IsNullOrWhiteSpace(item.FriendlyName) ? item.EquipmentPrefabName : item.FriendlyName,
+				tooltip = item.Tooltip ?? "",
+				rarity = item.Rarity.ToString()
+			}).Cast<object>().ToList();
+	}
+
+	private List<object> GetConsumableItems()
+	{
+		var items = DBConfig.DefaultConsumableItems.FromJson<List<ConsumableItem>>(CatalogJsonOptions) ?? new List<ConsumableItem>();
+		return items
+			.Where(x => x != null && !string.IsNullOrWhiteSpace(x.ConsumableItemDesc))
+			.Select(item => new
+			{
+				consumable_item_desc = item.ConsumableItemDesc,
+				friendly_name = string.IsNullOrWhiteSpace(item.FriendlyName) ? item.ConsumableItemDesc : item.FriendlyName,
+				tooltip = item.Tooltip ?? "",
+				rarity = item.Rarity.ToString()
+			}).Cast<object>().ToList();
+	}
+
+	private async Task<List<object>> GetIpBans(string? order, bool ascending)
+	{
+
+		var now = DateTime.UtcNow;
+		var expired = await db.IpBans.Where(x => x.ExpiresAt != null && x.ExpiresAt < now).ToListAsync();
+		if (expired.Count > 0)
+		{
+			db.IpBans.RemoveRange(expired);
+			await db.SaveChangesAsync();
+		}
+
+		var rows = await db.IpBans.AsNoTracking()
+			.Select(x => new
+			{
+				id = x.Id,
+				ip = x.IpAddress,
+				reason = x.Reason,
+				created_at = x.CreatedAt,
+				expires_at = x.ExpiresAt,
+				is_permanent = x.ExpiresAt == null
+			})
+			.ToListAsync();
+
+		return OrderRows(rows.Cast<object>().ToList(), order, ascending);
+	}
+
+	private async Task<List<object>> GetHardwareBans(string? order, bool ascending)
+	{
+
+		var now = DateTime.UtcNow;
+		var expired = await db.HardwareBans.Where(x => x.ExpiresAt != null && x.ExpiresAt < now).ToListAsync();
+		if (expired.Count > 0)
+		{
+			db.HardwareBans.RemoveRange(expired);
+			await db.SaveChangesAsync();
+		}
+
+		var rows = await db.HardwareBans.AsNoTracking()
+			.Select(x => new
+			{
+				id = x.Id,
+				device_id = x.DeviceId,
+				reason = x.Reason,
+				created_at = x.CreatedAt,
+				expires_at = x.ExpiresAt,
+				is_permanent = x.ExpiresAt == null
+			})
+			.ToListAsync();
+
+		return OrderRows(rows.Cast<object>().ToList(), order, ascending);
+	}
+
+	private async Task<JsonObject> AddIpBan(JsonElement payload)
+	{
+		var ip = GetJsonString(payload, "ip") ?? GetJsonString(payload, "ip_address") ?? "";
+		var reason = GetJsonString(payload, "reason") ?? "Banned via admin panel";
+		var expiresAt = TryGetJsonDate(payload, "expires_at");
+
+		var ipBan = new IpBan
+		{
+			IpAddress = ip,
+			Reason = reason,
+			CreatedAt = DateTime.UtcNow,
+
+			ExpiresAt = expiresAt
+		};
+
+		await db.IpBans.AddAsync(ipBan);
+		await db.SaveChangesAsync();
+
+		return new JsonObject
+		{
+			["id"] = ipBan.Id,
+			["ip"] = ipBan.IpAddress,
+			["reason"] = ipBan.Reason,
+			["created_at"] = ipBan.CreatedAt,
+			["expires_at"] = ipBan.ExpiresAt,
+			["is_permanent"] = ipBan.ExpiresAt == null
+		};
+	}
+
+	private async Task<JsonObject> AddHardwareBan(JsonElement payload)
+	{
+		var deviceId = GetJsonString(payload, "device_id") ?? "";
+		var reason = GetJsonString(payload, "reason") ?? "Banned via admin panel";
+		var expiresAt = TryGetJsonDate(payload, "expires_at");
+
+		var hardwareBan = new HardwareBan
+		{
+			DeviceId = deviceId,
+			Reason = reason,
+			CreatedAt = DateTime.UtcNow,
+
+			ExpiresAt = expiresAt
+		};
+
+		await db.HardwareBans.AddAsync(hardwareBan);
+		await db.SaveChangesAsync();
+
+		return new JsonObject
+		{
+			["id"] = hardwareBan.Id,
+			["device_id"] = hardwareBan.DeviceId,
+			["reason"] = hardwareBan.Reason,
+			["created_at"] = hardwareBan.CreatedAt,
+			["expires_at"] = hardwareBan.ExpiresAt,
+			["is_permanent"] = hardwareBan.ExpiresAt == null
+		};
+	}
+
+	private async Task<List<object>> GetAccountCreationBlocks(string? order, bool ascending)
+	{
+
+		var now = DateTime.UtcNow;
+		var expired = await db.AccountCreationBlocks.Where(x => x.ExpiresAt != null && x.ExpiresAt < now).ToListAsync();
+		if (expired.Count > 0)
+		{
+			db.AccountCreationBlocks.RemoveRange(expired);
+			await db.SaveChangesAsync();
+		}
+
+		var rows = await db.AccountCreationBlocks.AsNoTracking()
+			.Select(x => new
+			{
+				id = x.Id,
+				ip = x.IpAddress,
+				reason = x.Reason,
+				created_at = x.CreatedAt,
+				expires_at = x.ExpiresAt,
+				is_permanent = x.ExpiresAt == null
+			})
+			.ToListAsync();
+
+		return OrderRows(rows.Cast<object>().ToList(), order, ascending);
+	}
+
+	private async Task<JsonObject> AddAccountCreationBlock(JsonElement payload)
+	{
+		var ip = GetJsonString(payload, "ip") ?? GetJsonString(payload, "ip_address") ?? "";
+		var reason = GetJsonString(payload, "reason") ?? "Blocked via admin panel";
+		var expiresAt = TryGetJsonDate(payload, "expires_at");
+
+		var block = new AccountCreationBlock
+		{
+			IpAddress = ip,
+			Reason = reason,
+			CreatedAt = DateTime.UtcNow,
+			ExpiresAt = expiresAt
+		};
+
+		await db.AccountCreationBlocks.AddAsync(block);
+		await db.SaveChangesAsync();
+
+		return new JsonObject
+		{
+			["id"] = block.Id,
+			["ip"] = block.IpAddress,
+			["reason"] = block.Reason,
+			["created_at"] = block.CreatedAt,
+			["expires_at"] = block.ExpiresAt,
+			["is_permanent"] = block.ExpiresAt == null
+		};
+	}
+
+	private async Task<List<object>> GetGameBlocks(string? order, bool ascending)
+	{
+
+		var now = DateTime.UtcNow;
+		var expired = await db.GameBlocks.Where(x => x.ExpiresAt != null && x.ExpiresAt < now).ToListAsync();
+		if (expired.Count > 0)
+		{
+			db.GameBlocks.RemoveRange(expired);
+			await db.SaveChangesAsync();
+		}
+
+		var rows = await db.GameBlocks.AsNoTracking()
+			.Select(x => new
+			{
+				id = x.Id,
+				ip = x.IpAddress,
+				reason = x.Reason,
+				created_at = x.CreatedAt,
+				expires_at = x.ExpiresAt,
+				is_permanent = x.ExpiresAt == null
+			})
+			.ToListAsync();
+
+		return OrderRows(rows.Cast<object>().ToList(), order, ascending);
+	}
+
+	private async Task<object> AddGameBlock(JsonElement payload)
+	{
+		var ip = GameBlockMonitor.NormalizeIp(GetJsonString(payload, "ip") ?? GetJsonString(payload, "ip_address") ?? "");
+		if (string.IsNullOrWhiteSpace(ip))
+			return BadRequest("An IP address is required to create a game block.");
+		var reason = GetJsonString(payload, "reason") ?? "Blocked via admin panel";
+		var expiresAt = TryGetJsonDate(payload, "expires_at");
+
+		var block = new GameBlock
+		{
+			IpAddress = ip,
+			Reason = reason,
+			CreatedAt = DateTime.UtcNow,
+
+			ExpiresAt = expiresAt
+		};
+
+		await db.GameBlocks.AddAsync(block);
+		await db.SaveChangesAsync();
+
+
+
+		GameBlockMonitor.Invalidate();
+
+		return new JsonObject
+		{
+			["id"] = block.Id,
+			["ip"] = block.IpAddress,
+			["reason"] = block.Reason,
+			["created_at"] = block.CreatedAt,
+			["expires_at"] = block.ExpiresAt,
+			["is_permanent"] = block.ExpiresAt == null
+		};
+	}
+
+
+
+
+
+
+
+	private async Task<List<object>> GetLeaderboardScores(string? eqCol, string? eqVal, string? order, bool ascending)
+	{
+		var query = db.LeaderboardScores.AsNoTracking();
+		if (eqCol == "room_id" && long.TryParse(eqVal, out var roomId))
+			query = query.Where(x => x.RoomId == roomId);
+
+		var rows = await query.OrderByDescending(x => x.SubmittedAt).Take(5000).ToListAsync();
+		var playerNames = await LoadPlayerNames(rows.Select(x => x.PlayerId).Distinct().ToList());
+		var roomIds = rows.Select(x => x.RoomId).Distinct().ToList();
+		var rooms = await db.Rooms.AsNoTracking()
+			.Where(r => roomIds.Contains(r.RoomId))
+			.ToDictionaryAsync(r => r.RoomId, r => r.Name);
+
+		var result = rows.Select(s => (object)new
+		{
+			id = s.Id,
+			room_id = s.RoomId,
+			room_name = rooms.TryGetValue(s.RoomId, out var roomName) ? roomName : $"Room {s.RoomId}",
+			sub_room_id = s.SubRoomId,
+			player_id = s.PlayerId,
+			player_name = playerNames.GetValueOrDefault(s.PlayerId) ?? $"Player {s.PlayerId}",
+			stat_channel = s.StatChannel,
+			score = s.Score,
+			time = s.Time,
+			submitted_at = DateTime.SpecifyKind(s.SubmittedAt, DateTimeKind.Utc)
+		}).ToList();
+
+		return OrderRows(result, order, ascending);
+	}
+
+
+
+	private async Task<Dictionary<long, string>> LoadPlayerNames(List<long> playerIds)
+	{
+		if (playerIds.Count == 0) return new Dictionary<long, string>();
+
+		var profiles = await db.Profiles.AsNoTracking()
+			.Where(x => playerIds.Contains(x.accountId))
+			.ToDictionaryAsync(x => x.accountId);
+
+		return profiles.ToDictionary(
+			kv => kv.Key,
+			kv => kv.Value.displayName ?? kv.Value.username ?? $"Player {kv.Key}");
+	}
+
+
+
+
+
+
+
+	private List<object> GetStorefronts(string? order, bool ascending)
+	{
+		var state = LoadState();
+
+
+
+
+		var rows = new List<object>();
+		var seen = new HashSet<long>();
+
+		foreach (var id in StorefrontCatalog.StorefrontIds)
+		{
+			seen.Add(id);
+			var existing = state.Storefronts.FirstOrDefault(s => (s["id"]?.GetValue<long>() ?? 0) == id);
+
+			rows.Add(StorefrontRow(id, StorefrontLabel(id), existing, StorefrontCatalog.GetItems(id).Count, shipped: true));
+		}
+
+		foreach (var sf in state.Storefronts)
+		{
+			var id = sf["id"]?.GetValue<long>() ?? 0;
+			if (id <= 0 || !seen.Add(id)) continue;
+
+			rows.Add(StorefrontRow(id, sf["type"]?.ToString(), sf, db.GiftItems.Count(x => x.StorefrontId == id), shipped: false));
+		}
+
+		foreach (var id in db.GiftItems.Where(x => x.StorefrontId > 0).Select(x => x.StorefrontId).Distinct().ToList())
+		{
+			if (!seen.Add(id)) continue;
+
+			rows.Add(StorefrontRow(id, null, null, db.GiftItems.Count(x => x.StorefrontId == id), shipped: false));
+		}
+
+		return OrderRows(rows, order, ascending);
+	}
+
+	private static object StorefrontRow(long id, string? type, JsonObject? stateRow, int giftDropCount, bool shipped)
+	{
+		var label = string.IsNullOrWhiteSpace(type) ? StorefrontLabel(id) : type;
+		var friendlyName = stateRow?["friendly_name"]?.ToString();
+
+		return new
+		{
+			id,
+			type = label,
+			next_update = stateRow?["next_update"]?.ToString() ?? "",
+			new_until = stateRow?["new_until"]?.ToString() ?? "",
+			friendly_name = string.IsNullOrWhiteSpace(friendlyName) ? label : friendlyName,
+			gift_drop_count = giftDropCount,
+			is_auto_detected = shipped
+		};
+	}
+
+	private static string? StorefrontTypeName(long id)
+	{
+		if (id <= 0 || id > int.MaxValue) return null;
+		if (id == (long)StorefrontTypes.None) return null;
+		if (!Enum.IsDefined(typeof(StorefrontTypes), (int)id)) return null;
+
+		return ((StorefrontTypes)id).ToString();
+	}
+
+	private static string StorefrontLabel(long id) => StorefrontTypeName(id) ?? $"#{id}";
+
+	private static string StorefrontDisplayName(long id) =>
+		StorefrontTypeName(id) is { } name ? $"{name} ({id})" : $"#{id}";
+
+
+
+
+
+	private Dictionary<long, string> GetStorefrontDisplayNames()
+	{
+		var names = new Dictionary<long, string>();
+
+		foreach (var type in Enum.GetValues<StorefrontTypes>())
+		{
+			if (type == StorefrontTypes.None) continue;
+			names[(long)type] = $"{type} ({(long)type})";
+		}
+
+		foreach (var id in StorefrontCatalog.StorefrontIds)
+			names[id] = StorefrontDisplayName(id);
+
+		var state = LoadState();
+		foreach (var sf in state.Storefronts)
+		{
+			var id = sf["id"]?.GetValue<long>() ?? 0;
+			if (id > 0 && !names.ContainsKey(id))
+			{
+				names[id] = $"{sf["type"]?.ToString() ?? $"#{id}"} ({id})";
+			}
+		}
+
+		foreach (var id in db.GiftItems.Where(x => x.StorefrontId > 0).Select(x => x.StorefrontId).Distinct().ToList())
+			names.TryAdd(id, StorefrontDisplayName(id));
+
+		return names;
+	}
+
+	private List<object> GetChallenges(string? order, bool ascending)
+	{
+		var state = LoadState();
+		return OrderRows(state.Challenges.Cast<object>().ToList(), order, ascending);
+	}
+
+	private List<object> FilterByPlayer(List<JsonObject> rows, string? eqCol, string? eqVal, string? order, bool ascending)
+	{
+		if (!string.IsNullOrWhiteSpace(eqCol) && eqCol == "player_id" && eqVal != null)
+		{
+			rows = rows.Where(x => x["player_id"]?.ToString() == eqVal).ToList();
+		}
+		return OrderRows(rows.Cast<object>().ToList(), order, ascending);
+	}
+
+	private static List<object> OrderRows(List<object> rows, string? order, bool ascending)
+	{
+		if (string.IsNullOrWhiteSpace(order))
+			return rows;
+
+		var sorted = rows.OrderBy(x => 0);
+		if (rows.Count > 0 && rows[0] is JsonObject rowObj)
+		{
+			var first = rows[0] as JsonObject;
+			if (first != null && first.ContainsKey(order))
+			{
+				sorted = ascending
+					? rows.OrderBy(x => (x as JsonObject)?[order]?.ToString())
+					: rows.OrderByDescending(x => (x as JsonObject)?[order]?.ToString());
+			}
+		}
+		return sorted.ToList();
+	}
+
+	private static JsonObject AddStorefront(AdminPanelState state, JsonElement payload)
+	{
+		var row = new JsonObject();
+		foreach (var prop in payload.EnumerateObject())
+		{
+			try
+			{
+				row[prop.Name] = JsonNode.Parse(prop.Value.GetRawText());
+			}
+			catch
+			{
+
+				if (prop.Value.ValueKind == JsonValueKind.String)
+					row[prop.Name] = prop.Value.GetString();
+				else if (prop.Value.ValueKind == JsonValueKind.Number)
+					row[prop.Name] = prop.Value.GetRawText();
+				else if (prop.Value.ValueKind == JsonValueKind.True)
+					row[prop.Name] = true;
+				else if (prop.Value.ValueKind == JsonValueKind.False)
+					row[prop.Name] = false;
+				else if (prop.Value.ValueKind == JsonValueKind.Null)
+					row[prop.Name] = null;
+				else
+					row[prop.Name] = prop.Value.GetRawText();
+			}
+		}
+		if (!row.ContainsKey("id"))
+		{
+
+
+
+
+			var rawType = row["type"]?.ToString() ?? "";
+			long id = 0;
+			foreach (var type in Enum.GetValues<StorefrontTypes>())
+			{
+				if (type == StorefrontTypes.None) continue;
+				if (string.Equals(type.ToString(), rawType, StringComparison.OrdinalIgnoreCase))
+				{
+					id = (long)type;
+					break;
+				}
+			}
+			if (id == 0)
+			{
+				long maxId = 10000;
+				foreach (var existing in state.Storefronts)
+				{
+					var rawId = existing["id"]?.ToString();
+					if (rawId != null && long.TryParse(rawId, out var parsedId) && parsedId >= maxId)
+						maxId = parsedId + 1;
+				}
+				id = maxId;
+			}
+			row["id"] = id;
+		}
+		state.Storefronts.Add(row);
+		SaveState(state);
+		return row;
+	}
+
+	private static JsonObject AddChallenge(AdminPanelState state, JsonElement payload)
+	{
+		var row = new JsonObject();
+		foreach (var prop in payload.EnumerateObject())
+		{
+			try
+			{
+				row[prop.Name] = JsonNode.Parse(prop.Value.GetRawText());
+			}
+			catch
+			{
+				if (prop.Value.ValueKind == JsonValueKind.String)
+					row[prop.Name] = prop.Value.GetString();
+				else if (prop.Value.ValueKind == JsonValueKind.Number)
+					row[prop.Name] = prop.Value.GetRawText();
+				else if (prop.Value.ValueKind == JsonValueKind.True)
+					row[prop.Name] = true;
+				else if (prop.Value.ValueKind == JsonValueKind.False)
+					row[prop.Name] = false;
+				else if (prop.Value.ValueKind == JsonValueKind.Null)
+					row[prop.Name] = null;
+				else
+					row[prop.Name] = prop.Value.GetRawText();
+			}
+		}
+		if (!row.ContainsKey("id"))
+		{
+			row["id"] = state.Challenges.Count > 0 ? state.Challenges.Max(x => x["id"]?.GetValue<long>() ?? 0) + 1 : 1;
+		}
+		state.Challenges.Add(row);
+		SaveState(state);
+		return row;
+	}
+
+
+
+
+	private static object RowsResponse(JsonElement payload, List<JsonObject> rows)
+	{
+		if (payload.ValueKind == JsonValueKind.Array)
+			return rows;
+		return rows.Count > 0 ? rows[0] : new JsonObject();
+	}
+
+
+
+
+
+
+
+	private IActionResult InsertLoggedRows(AdminPanelState state, List<JsonObject> targetList, JsonElement payload, string table)
+	{
+		var rows = AddRows(state, targetList, payload);
+		NotifyPanelActionDiscord(table, payload);
+		return Ok(RowsResponse(payload, rows));
+	}
+
+
+	private async Task<IActionResult> InsertGiftLogRows(AdminPanelState state, JsonElement payload)
+	{
+		var rows = await AddGiftLogRows(state, payload);
+		NotifyPanelActionDiscord("gift_log", payload);
+		return Ok(RowsResponse(payload, rows));
+	}
+
+
+
+
+
+
+	private void NotifyPanelActionDiscord(string table, JsonElement payload)
+	{
+		var items = new List<JsonElement>();
+		if (payload.ValueKind == JsonValueKind.Array)
+		{
+			foreach (var el in payload.EnumerateArray()) items.Add(el);
+		}
+		else
+		{
+			items.Add(payload);
+		}
+
+		foreach (var item in items)
+		{
+			if (item.ValueKind != JsonValueKind.Object) continue;
+
+			var action = GetJsonString(item, "action") ?? table;
+			var admin = GetJsonString(item, "performed_by") ?? GetJsonString(item, "admin_id") ?? "Unknown";
+			var playerId = GetJsonString(item, "player_id") ?? "";
+
+			string? details = null;
+			if (item.TryGetProperty("details", out var d))
+			{
+				details = d.ValueKind == JsonValueKind.String ? d.GetString() : d.GetRawText();
+			}
+			else if (table == "gift_log")
+			{
+				var giftParts = new List<string>();
+				foreach (var name in new[] { "context", "rarity", "avatar", "equip", "cons", "currency", "currency_type", "xp", "message" })
+				{
+					var val = GetJsonString(item, name);
+					if (!string.IsNullOrWhiteSpace(val) && val != "null")
+						giftParts.Add($"{name}: {val}");
+				}
+				details = string.Join(", ", giftParts);
+			}
+
+			var fullDetails = string.IsNullOrWhiteSpace(playerId) ? details : $"Player {playerId} — {details}";
+			AdminActionDiscord.LogAction(action, admin, fullDetails);
+		}
+	}
+
+
+
+
+
+
+	private async Task<string> GetPanelAdminUsernameAsync()
+	{
+		if (Request.Cookies.TryGetValue(AdminSession.CookieName, out var token))
+		{
+			var (ok, userId) = await AdminSession.ValidateAsync(db, token);
+			if (ok)
+			{
+				var user = await db.AdminUsers.AsNoTracking().FirstOrDefaultAsync(x => x.Id == userId);
+				if (user != null) return user.Username;
+			}
+		}
+		return "Admin";
+	}
+
+	private static List<JsonObject> AddRows(AdminPanelState state, List<JsonObject> targetList, JsonElement payload)
+	{
+
+
+
+		var items = new List<JsonElement>();
+		if (payload.ValueKind == JsonValueKind.Array)
+		{
+			foreach (var el in payload.EnumerateArray()) items.Add(el);
+		}
+		else
+		{
+			items.Add(payload);
+		}
+
+		var added = new List<JsonObject>();
+		foreach (var item in items)
+		{
+			if (item.ValueKind != JsonValueKind.Object) continue;
+
+			var row = new JsonObject();
+			foreach (var prop in item.EnumerateObject())
+			{
+				try
+				{
+					row[prop.Name] = JsonNode.Parse(prop.Value.GetRawText());
+				}
+				catch
+				{
+					if (prop.Value.ValueKind == JsonValueKind.String)
+						row[prop.Name] = prop.Value.GetString();
+					else if (prop.Value.ValueKind == JsonValueKind.Number)
+						row[prop.Name] = prop.Value.GetRawText();
+					else if (prop.Value.ValueKind == JsonValueKind.True)
+						row[prop.Name] = true;
+					else if (prop.Value.ValueKind == JsonValueKind.False)
+						row[prop.Name] = false;
+					else if (prop.Value.ValueKind == JsonValueKind.Null)
+						row[prop.Name] = null;
+					else
+						row[prop.Name] = prop.Value.GetRawText();
+				}
+			}
+			if (!row.ContainsKey("id"))
+			{
+
+
+				long nextId = 1;
+				if (targetList.Count > 0)
+				{
+					foreach (var existing in targetList)
+					{
+						var rawId = existing["id"]?.ToString();
+						if (rawId != null && long.TryParse(rawId, out var parsedId) && parsedId >= nextId)
+							nextId = parsedId + 1;
+					}
+				}
+				row["id"] = nextId;
+			}
+			if (!row.ContainsKey("created_at"))
+				row["created_at"] = DateTime.UtcNow.ToString("O");
+			targetList.Add(row);
+			added.Add(row);
+		}
+		SaveState(state);
+		return added;
+	}
+
+	private static JsonObject UpdateRow(AdminPanelState state, List<JsonObject> targetList, long id, JsonElement payload)
+	{
+		var row = targetList.FirstOrDefault(x => x["id"]?.GetValue<long>() == id);
+		if (row == null)
+			return new JsonObject { ["error"] = "Row not found" };
+
+		foreach (var prop in payload.EnumerateObject())
+		{
+			try
+			{
+				row[prop.Name] = JsonNode.Parse(prop.Value.GetRawText());
+			}
+			catch
+			{
+				if (prop.Value.ValueKind == JsonValueKind.String)
+					row[prop.Name] = prop.Value.GetString();
+				else if (prop.Value.ValueKind == JsonValueKind.Number)
+					row[prop.Name] = prop.Value.GetRawText();
+				else if (prop.Value.ValueKind == JsonValueKind.True)
+					row[prop.Name] = true;
+				else if (prop.Value.ValueKind == JsonValueKind.False)
+					row[prop.Name] = false;
+				else if (prop.Value.ValueKind == JsonValueKind.Null)
+					row[prop.Name] = null;
+				else
+					row[prop.Name] = prop.Value.GetRawText();
+			}
+		}
+		SaveState(state);
+		return row;
+	}
+
+	private static List<JsonObject> DeleteRows(AdminPanelState state, List<JsonObject> targetList, List<long> ids)
+	{
+		var toRemove = targetList.Where(x => ids.Contains(x["id"]?.GetValue<long>() ?? 0)).ToList();
+		foreach (var item in toRemove)
+		{
+			targetList.Remove(item);
+		}
+		SaveState(state);
+		return toRemove;
+	}
+
+	private static List<long> ParseIds(string? vals)
+	{
+		if (string.IsNullOrWhiteSpace(vals))
+			return new List<long>();
+
+		return vals.Split(',')
+			.Select(x => long.TryParse(x.Trim(), out var id) ? id : 0)
+			.Where(x => x > 0)
+			.ToList();
+	}
+
+	private async Task<JsonObject> CreateGiftDrop(JsonElement payload)
+	{
+
+
+		var giftDrop = new GiftDropDB
+		{
+			Name = GetJsonString(payload, "name") ?? "Gift Drop",
+			StartTime = TryGetJsonDate(payload, "start_time") ?? DateTime.UtcNow,
+			EndTime = TryGetJsonDate(payload, "end_time") ?? DateTime.UtcNow.AddDays(30),
+			StorefrontId = TryGetJsonLong(payload, "storefront_id") ?? 0,
+			Description = GetJsonString(payload, "description") ?? GetJsonString(payload, "tooltip") ?? "",
+			CurrencyAmount = TryGetJsonInt(payload, "currency_amount") ?? TryGetJsonInt(payload, "currency") ?? 0,
+			XPAmount = TryGetJsonInt(payload, "xp_amount") ?? 0,
+			AvatarItems = GetJsonString(payload, "avatar_items") ?? GetJsonString(payload, "avatar") ?? "",
+			EquipmentItems = GetJsonString(payload, "equipment_items") ?? GetJsonString(payload, "equip") ?? "",
+			ConsumableItems = GetJsonString(payload, "consumable_items") ?? GetJsonString(payload, "consumable") ?? "",
+			PurchasableItemId = TryGetJsonInt(payload, "purchasable_item_id") ?? 0,
+			IsFeatured = TryGetJsonBool(payload, "is_featured") ?? TryGetJsonBool(payload, "featured") ?? false,
+			Price = TryGetJsonInt(payload, "price") ?? 0,
+			CurrencyType = ParseCurrencyType(GetJsonString(payload, "currency_type")) ?? CurrencyType.RecCenterTokens,
+			Rarity = ParseRarity(GetJsonString(payload, "rarity")) ?? Rarity.Common,
+			Context = ParseGiftContext(GetJsonString(payload, "context")) ?? GiftContext.Game_Drop,
+			AvatarItemType = ParseAvatarItemType(GetJsonString(payload, "avatar_item_type")) ?? GetJsonString(payload, "item_type") switch
+			{
+				"HairDye" => AvatarItemType.HairDye,
+				_ => AvatarItemType.Outfit
+			},
+			EquipmentModificationGuid = GetJsonString(payload, "equipment_modification_guid") ?? GetJsonString(payload, "prefab_modify") ?? "",
+			Tooltip = GetJsonString(payload, "tooltip") ?? "",
+			IsQuery = TryGetJsonBool(payload, "is_query") ?? false,
+			Unique = TryGetJsonBool(payload, "unique") ?? false,
+			SubscribersOnly = TryGetJsonBool(payload, "subscribers_only") ?? TryGetJsonBool(payload, "subonly") ?? false,
+			ItemSetId = TryGetJsonLong(payload, "item_set_id") ?? 0,
+			ItemSetFriendlyName = GetJsonString(payload, "item_set_friendly_name") ?? ""
+		};
+
+		db.GiftItems.Add(giftDrop);
+		await db.SaveChangesAsync();
+
+
+
+
+		if (giftDrop.PurchasableItemId == 0)
+		{
+			giftDrop.PurchasableItemId = (int)(giftDrop.GiftDropId % int.MaxValue);
+			await db.SaveChangesAsync();
+		}
+
+		return GiftDropToJson(giftDrop);
+	}
+
+	private async Task<JsonObject> UpdateGiftDrop(long id, JsonElement payload)
+	{
+		var giftDrop = await db.GiftItems.FirstOrDefaultAsync(x => x.GiftDropId == id);
+		if (giftDrop == null)
+			return new JsonObject { ["error"] = "Gift drop not found" };
+
+		ApplyGiftDropPayload(giftDrop, payload);
+
+
+
+		if (giftDrop.PurchasableItemId == 0)
+			giftDrop.PurchasableItemId = (int)(giftDrop.GiftDropId % int.MaxValue);
+
+		await db.SaveChangesAsync();
+
+		return GiftDropToJson(giftDrop);
+	}
+
+	private static void ApplyGiftDropPayload(GiftDropDB giftDrop, JsonElement payload)
+	{
+		var name = GetJsonString(payload, "name");
+		if (name != null) giftDrop.Name = name;
+
+		var startTime = TryGetJsonDate(payload, "start_time");
+		if (startTime != null) giftDrop.StartTime = startTime.Value;
+
+		var endTime = TryGetJsonDate(payload, "end_time");
+		if (endTime != null) giftDrop.EndTime = endTime.Value;
+
+		var storefrontId = TryGetJsonLong(payload, "storefront_id");
+		if (storefrontId != null) giftDrop.StorefrontId = storefrontId.Value;
+
+		var description = GetJsonString(payload, "description") ?? GetJsonString(payload, "tooltip");
+		if (description != null) giftDrop.Description = description;
+
+		var currencyAmount = TryGetJsonInt(payload, "currency_amount") ?? TryGetJsonInt(payload, "currency");
+		if (currencyAmount != null) giftDrop.CurrencyAmount = currencyAmount.Value;
+
+		var xpAmount = TryGetJsonInt(payload, "xp_amount");
+		if (xpAmount != null) giftDrop.XPAmount = xpAmount.Value;
+
+		var avatarItems = GetJsonString(payload, "avatar_items") ?? GetJsonString(payload, "avatar");
+		if (avatarItems != null) giftDrop.AvatarItems = avatarItems;
+
+		var equipmentItems = GetJsonString(payload, "equipment_items") ?? GetJsonString(payload, "equip");
+		if (equipmentItems != null) giftDrop.EquipmentItems = equipmentItems;
+
+		var consumableItems = GetJsonString(payload, "consumable_items") ?? GetJsonString(payload, "consumable");
+		if (consumableItems != null) giftDrop.ConsumableItems = consumableItems;
+
+		var purchasableItemId = TryGetJsonInt(payload, "purchasable_item_id");
+		if (purchasableItemId != null && purchasableItemId > 0) giftDrop.PurchasableItemId = purchasableItemId.Value;
+
+		var isFeatured = TryGetJsonBool(payload, "is_featured") ?? TryGetJsonBool(payload, "featured");
+		if (isFeatured != null) giftDrop.IsFeatured = isFeatured.Value;
+
+		var price = TryGetJsonInt(payload, "price");
+		if (price != null) giftDrop.Price = price.Value;
+
+		var currencyType = ParseCurrencyType(GetJsonString(payload, "currency_type"));
+		if (currencyType != null) giftDrop.CurrencyType = currencyType.Value;
+
+		var rarity = ParseRarity(GetJsonString(payload, "rarity"));
+		if (rarity != null) giftDrop.Rarity = rarity.Value;
+
+		var context = ParseGiftContext(GetJsonString(payload, "context"));
+		if (context != null) giftDrop.Context = context.Value;
+
+		var avatarItemType = ParseAvatarItemType(GetJsonString(payload, "avatar_item_type"));
+		if (avatarItemType != null) giftDrop.AvatarItemType = avatarItemType.Value;
+
+		var equipMod = GetJsonString(payload, "equipment_modification_guid") ?? GetJsonString(payload, "prefab_modify");
+		if (equipMod != null) giftDrop.EquipmentModificationGuid = equipMod;
+
+		var tooltip = GetJsonString(payload, "tooltip");
+		if (tooltip != null) giftDrop.Tooltip = tooltip;
+
+		var isQuery = TryGetJsonBool(payload, "is_query");
+		if (isQuery != null) giftDrop.IsQuery = isQuery.Value;
+
+		var unique = TryGetJsonBool(payload, "unique");
+		if (unique != null) giftDrop.Unique = unique.Value;
+
+		var subscribersOnly = TryGetJsonBool(payload, "subscribers_only") ?? TryGetJsonBool(payload, "subonly");
+		if (subscribersOnly != null) giftDrop.SubscribersOnly = subscribersOnly.Value;
+
+		var itemSetId = TryGetJsonLong(payload, "item_set_id");
+		if (itemSetId != null) giftDrop.ItemSetId = itemSetId.Value;
+
+		var itemSetName = GetJsonString(payload, "item_set_friendly_name");
+		if (itemSetName != null) giftDrop.ItemSetFriendlyName = itemSetName;
+	}
+
+	private static JsonObject GiftDropToJson(GiftDropDB g)
+	{
+		return new JsonObject
+		{
+			["id"] = g.GiftDropId,
+			["name"] = g.Name,
+			["start_time"] = g.StartTime,
+			["end_time"] = g.EndTime,
+			["storefront_id"] = g.StorefrontId,
+			["description"] = g.Description,
+			["currency_amount"] = g.CurrencyAmount,
+			["xp_amount"] = g.XPAmount,
+			["avatar_items"] = g.AvatarItems,
+			["equipment_items"] = g.EquipmentItems,
+			["consumable_items"] = g.ConsumableItems,
+			["purchasable_item_id"] = g.PurchasableItemId,
+			["is_featured"] = g.IsFeatured,
+			["price"] = g.Price,
+			["currency_type"] = g.CurrencyType.ToString(),
+			["rarity"] = g.Rarity.ToString(),
+			["context"] = g.Context.ToString(),
+			["avatar_item_type"] = g.AvatarItemType.ToString(),
+			["equipment_modification_guid"] = g.EquipmentModificationGuid,
+			["tooltip"] = g.Tooltip,
+			["is_query"] = g.IsQuery,
+			["unique"] = g.Unique,
+			["subscribers_only"] = g.SubscribersOnly,
+			["item_set_id"] = g.ItemSetId,
+			["item_set_friendly_name"] = g.ItemSetFriendlyName
+		};
+	}
+
+	private static string? GetJsonString(JsonElement el, string name)
+	{
+		if (el.TryGetProperty(name, out var v) && v.ValueKind == JsonValueKind.String)
+			return v.GetString();
+		return null;
+	}
+
+	private static int? TryGetJsonInt(JsonElement el, string name)
+	{
+		if (!el.TryGetProperty(name, out var v)) return null;
+		try
+		{
+			if (v.ValueKind == JsonValueKind.Number) return v.GetInt32();
+			if (v.ValueKind == JsonValueKind.String && int.TryParse(v.GetString(), out var i)) return i;
+		}
+		catch { }
+		return null;
+	}
+
+	private static long? TryGetJsonLong(JsonElement el, string name)
+	{
+		if (!el.TryGetProperty(name, out var v)) return null;
+		try
+		{
+			if (v.ValueKind == JsonValueKind.Number) return v.GetInt64();
+			if (v.ValueKind == JsonValueKind.String && long.TryParse(v.GetString(), out var l)) return l;
+		}
+		catch { }
+		return null;
+	}
+
+	private static DateTime? TryGetJsonDate(JsonElement el, string name)
+	{
+		if (!el.TryGetProperty(name, out var v)) return null;
+		try
+		{
+			if (v.ValueKind == JsonValueKind.String && DateTime.TryParse(v.GetString(), out var d)) return d.ToUniversalTime();
+		}
+		catch { }
+		return null;
+	}
+
+	private static bool? TryGetJsonBool(JsonElement el, string name)
+	{
+		if (!el.TryGetProperty(name, out var v)) return null;
+		try
+		{
+			if (v.ValueKind == JsonValueKind.True) return true;
+			if (v.ValueKind == JsonValueKind.False) return false;
+			if (v.ValueKind == JsonValueKind.String && bool.TryParse(v.GetString(), out var b)) return b;
+		}
+		catch { }
+		return null;
+	}
+
+	private static CurrencyType? ParseCurrencyType(string? raw)
+	{
+		if (string.IsNullOrWhiteSpace(raw)) return null;
+		if (Enum.TryParse<CurrencyType>(raw.Trim(), true, out var type) && Enum.IsDefined(type) && type != CurrencyType.Invalid)
+			return type;
+		return null;
+	}
+
+	private static Rarity? ParseRarity(string? raw)
+	{
+		if (string.IsNullOrWhiteSpace(raw)) return null;
+		if (Enum.TryParse<Rarity>(raw.Trim(), true, out var rarity) && Enum.IsDefined(rarity))
+			return rarity;
+		return null;
+	}
+
+	private static GiftContext? ParseGiftContext(string? raw)
+	{
+		if (string.IsNullOrWhiteSpace(raw)) return null;
+		if (Enum.TryParse<GiftContext>(raw.Trim(), true, out var context) && Enum.IsDefined(context))
+			return context;
+		return null;
+	}
+
+	private static AvatarItemType? ParseAvatarItemType(string? raw)
+	{
+		if (string.IsNullOrWhiteSpace(raw)) return null;
+		if (Enum.TryParse<AvatarItemType>(raw.Trim(), true, out var type) && Enum.IsDefined(type))
+			return type;
+		return null;
+	}
+
+
+
+	private static int? TryGetJsonInt(JsonObject obj, string key)
+	{
+		if (obj[key] is not JsonValue v) return null;
+		try
+		{
+			if (v.TryGetValue<int>(out var i)) return i;
+			if (v.TryGetValue<string>(out var s) && int.TryParse(s, out var parsed)) return parsed;
+			if (v.TryGetValue<double>(out var d)) return (int)d;
+		}
+		catch { }
+		return null;
+	}
+
+
+
+
+	private static long NewGiftDropId()
+	{
+		long value = BitConverter.ToInt64(Guid.NewGuid().ToByteArray(), 0);
+		return value switch
+		{
+			> 0 => value,
+			> long.MinValue => -value + 1,
+			_ => 1
+		};
+	}
+
+	private static GiftContext? TryParseGiftContext(string? raw)
+	{
+		if (string.IsNullOrWhiteSpace(raw)) return null;
+		if (Enum.TryParse<GiftContext>(raw.Trim(), true, out var context) && Enum.IsDefined(context))
+			return context;
+		return null;
+	}
+
+	private static Rarity? TryParseRarity(string? raw)
+	{
+		if (string.IsNullOrWhiteSpace(raw)) return null;
+		if (Enum.TryParse<Rarity>(raw.Trim(), true, out var rarity) && Enum.IsDefined(rarity))
+			return rarity;
+		return null;
+	}
+
+	private async Task<object> UpdatePlayer(long id, JsonElement payload)
+	{
+		var profile = await db.Profiles.FirstOrDefaultAsync(x => x.accountId == id);
+		if (profile == null) return NotFound();
+
+		var player = await db.Players.FirstOrDefaultAsync(x => x.AccountId == id);
+		var progress = await db.Progression.FirstOrDefaultAsync(x => x.PlayerId == id);
+		int? priorLevel = progress?.Level;
+		var rep = await db.Reputations.FirstOrDefaultAsync(x => x.AccountId == id);
+		var settings = await db.PlayerSettings.FirstOrDefaultAsync(x => x.AccountId == id);
+
+		if (TryGetString(payload, "name", out var name)) profile.displayName = name;
+		if (TryGetString(payload, "original_name", out var username) || TryGetString(payload, "username", out username)) profile.username = username;
+		if (TryGetString(payload, "bio", out var bio)) profile.bio = bio;
+
+
+		if (payload.TryGetProperty("name_locked", out var nameLockedElem) && nameLockedElem.ValueKind == JsonValueKind.True)
+			profile.NameLocked = true;
+		else if (payload.TryGetProperty("name_locked", out nameLockedElem) && nameLockedElem.ValueKind == JsonValueKind.False)
+			profile.NameLocked = false;
+		if (payload.TryGetProperty("bio_locked", out var bioLockedElem) && bioLockedElem.ValueKind == JsonValueKind.True)
+			profile.BioLocked = true;
+		else if (payload.TryGetProperty("bio_locked", out bioLockedElem) && bioLockedElem.ValueKind == JsonValueKind.False)
+			profile.BioLocked = false;
+
+
+
+
+		if (TryGetString(payload, "password", out var newPassword) && !string.IsNullOrWhiteSpace(newPassword))
+		{
+			if (player == null) return BadRequest("Player data not found - cannot reset password.");
+			player.Hashword = PasswordHasher.HashPassword(player, newPassword);
+
+
+
+
+
+			var staleLogins = await db.CachedLogins.Where(x => x.accountId == id).ToListAsync();
+			if (staleLogins.Count > 0)
+			{
+				db.CachedLogins.RemoveRange(staleLogins);
+			}
+
+
+
+
+			player.TokenVersion++;
+			TokenRevocation.Bump(id, player.TokenVersion);
+
+
+
+			AdminActionDiscord.LogAction("Player Password Reset", await GetPanelAdminUsernameAsync(),
+				$"Player {id} ({(profile.displayName ?? profile.username) ?? id.ToString()})");
+
+
+
+
+			await Notify.SendNotify(id, new Notification { Id = NotificationType.ModerationQuitGame, Msg = null });
+			var presence = await db.Presences.FirstOrDefaultAsync(x => x.playerId == id);
+			if (presence != null)
+			{
+				presence.isOnline = false;
+				presence.roomInstance = null;
+				presence.LoginLock = null;
+			}
+		}
+
+
+
+
+		if (payload.TryGetProperty("avatar_image", out var avatarImageElem))
+		{
+			if (avatarImageElem.ValueKind == JsonValueKind.String)
+			{
+				var avatarImage = avatarImageElem.GetString();
+				if (!string.IsNullOrWhiteSpace(avatarImage))
+				{
+					if (avatarImage.StartsWith("data:", StringComparison.OrdinalIgnoreCase))
+					{
+						var savedName = SaveDataUrlFile(avatarImage, DBConfig.CDNImages);
+						if (savedName != null) profile.profileImage = savedName;
+					}
+					else
+					{
+
+						var trimmed = avatarImage;
+						var schemeIndex = trimmed.IndexOf("://", StringComparison.Ordinal);
+						if (schemeIndex >= 0)
+						{
+							var lastSlash = trimmed.LastIndexOf('/');
+							if (lastSlash > schemeIndex) trimmed = trimmed.Substring(lastSlash + 1);
+						}
+						if (!string.IsNullOrWhiteSpace(trimmed))
+							profile.profileImage = trimmed;
+					}
+				}
+			}
+			else if (avatarImageElem.ValueKind == JsonValueKind.Null && !string.IsNullOrWhiteSpace(profile.profileImage))
+			{
+
+				if (profile.profileImage != DBConfig.DefaultProfileImage)
+				{
+					profile.profileImage = DBConfig.DefaultProfileImage;
+				}
+			}
+		}
+		if (payload.TryGetProperty("is_junior", out var isJunior))
+		{
+			var junior = isJunior.GetBoolean();
+			var wasJunior = profile.isJunior;
+			profile.isJunior = junior;
+			if (player != null)
+			{
+				player.IsJunior = junior;
+				player.JuniorState = junior ? JuniorState.ModerationOverride : JuniorState.BasedOnBirthday;
+			}
+
+			if (wasJunior != junior)
+			{
+
+
+
+				if (player != null) player.TokenVersion++;
+				await db.SaveChangesAsync();
+				if (player != null) TokenRevocation.Bump(id, player.TokenVersion);
+
+				await NotifyAccountChanged(id, profile, player, refreshSession: true);
+			}
+		}
+		if (payload.TryGetProperty("roles", out var roles))
+		{
+			var oldRoles = profile.role;
+			profile.role = JoinRoles(roles);
+
+			if (oldRoles != profile.role)
+			{
+				if (player != null)
+				{
+					player.TokenVersion++;
+				}
+
+
+
+
+
+				await db.SaveChangesAsync();
+				if (player != null)
+					TokenRevocation.Bump(id, player.TokenVersion);
+
+				await NotifyAccountChanged(id, profile, player, refreshSession: true);
+			}
+		}
+
+
+
+
+		bool banPenaltyApplied = false;
+
+
+		if (payload.TryGetProperty("banned", out var banned))
+		{
+			var isBanned = banned.GetBoolean();
+			var banReason = TryGetString(payload, "ban_reason", out var reason) ? reason : "Banned via admin panel";
+
+
+
+			var banIsModerator = payload.TryGetProperty("ban_is_moderator", out var isMod) && isMod.ValueKind == JsonValueKind.True;
+			if (banIsModerator && !string.IsNullOrWhiteSpace(banReason) &&
+				!banReason.StartsWith("Moderator.", StringComparison.OrdinalIgnoreCase))
+			{
+				banReason = "Moderator. " + banReason;
+			}
+			var banMethod = TryGetString(payload, "ban_method", out var method) && !string.IsNullOrWhiteSpace(method)
+				? method.Trim()
+				: (isBanned ? "Admin Panel" : "None");
+			var moderatorNote = TryGetString(payload, "moderator_note", out var note) ? note?.Trim() : null;
+			var banType = TryGetString(payload, "ban_type", out var type) ? type : (isBanned ? "Temporary" : "");
+			var banCategory = TryGetEnum(payload, "ban_category", out ReportCategory category) ? category : ReportCategory.Misc;
+
+
+			var banIsTimeout = isBanned
+				&& payload.TryGetProperty("ban_is_timeout", out var isTimeoutFlag)
+				&& isTimeoutFlag.ValueKind == JsonValueKind.True;
+			if (banIsTimeout)
+			{
+				banMethod = ModerationPolicy.AutomaticTimeoutBanMethod;
+				banType = "Temporary";
+			}
+
+			var isAccountLock = string.Equals(banMethod, "Account Lock", StringComparison.OrdinalIgnoreCase);
+			if (isAccountLock && isBanned)
+			{
+				banType = "Permanent";
+				banCategory = ReportCategory.Moderator;
+				banReason = AccountLock.Reason;
+			}
+
+
+
+
+
+			DateTime? banDuration = null;
+			if (isBanned)
+			{
+				if (string.Equals(banType, "Permanent", StringComparison.OrdinalIgnoreCase))
+				{
+					banDuration = DateTime.MaxValue;
+				}
+				else if (TryGetString(payload, "ban_until", out var banUntil))
+				{
+					if (string.Equals(banUntil, "permanent", StringComparison.OrdinalIgnoreCase) || banUntil == "-1")
+					{
+						banDuration = DateTime.MaxValue;
+					}
+					else if (DateTime.TryParse(banUntil, CultureInfo.InvariantCulture, DateTimeStyles.AssumeUniversal | DateTimeStyles.AdjustToUniversal, out var parsedUntil))
+					{
+
+
+						banDuration = parsedUntil;
+					}
+					else
+					{
+
+
+						banDuration = DateTime.UtcNow.AddDays(30);
+					}
+				}
+				else
+				{
+					banDuration = DateTime.UtcNow.AddDays(30);
+				}
+
+				if (banIsTimeout)
+				{
+
+					var requested = banDuration!.Value - DateTime.UtcNow;
+					banDuration = DateTime.UtcNow + ModerationPolicy.ClampTimeout(requested > TimeSpan.Zero ? requested : TimeSpan.Zero);
+				}
+			}
+
+			if (banIsTimeout)
+				banReason = PlayerReportingAPI.GetTimeoutDisplayReason(banMethod, banReason, banCategory);
+
+
+
+			string playerIp = TryGetString(payload, "ip", out var payloadIp) && !string.IsNullOrWhiteSpace(payloadIp)
+				? payloadIp
+				: (player?.LastIpAddress ?? "");
+			string playerDevice = TryGetString(payload, "device_id", out var payloadDevice) && !string.IsNullOrWhiteSpace(payloadDevice)
+				? payloadDevice
+				: (player?.DeviceId ?? "");
+
+			var existingBan = await db.Moderation.FirstOrDefaultAsync(x => x.PlayerId == id && x.IsBan);
+
+
+
+
+			bool banChanged = false;
+
+			if (isBanned)
+			{
+				if (string.Equals(banMethod, "IP Ban", StringComparison.OrdinalIgnoreCase))
+				{
+
+
+
+
+					if (string.IsNullOrWhiteSpace(playerIp))
+					{
+
+
+						return BadRequest("No IP address is known for this player. Ask them to log in once, then try the IP ban again.");
+					}
+
+
+
+
+					if (existingBan != null)
+					{
+						db.Moderation.Remove(existingBan);
+						existingBan = null;
+					}
+
+					var existingIpBan = await db.IpBans.FirstOrDefaultAsync(x => x.IpAddress == playerIp);
+					if (existingIpBan == null)
+					{
+						await db.IpBans.AddAsync(new IpBan
+						{
+							IpAddress = playerIp,
+							Reason = banReason,
+							CreatedAt = DateTime.UtcNow,
+							ExpiresAt = banDuration == DateTime.MaxValue ? null : banDuration
+						});
+						banChanged = true;
+					}
+					else
+					{
+						if (existingIpBan.Reason != banReason || existingIpBan.ExpiresAt != (banDuration == DateTime.MaxValue ? null : banDuration))
+							banChanged = true;
+						existingIpBan.Reason = banReason;
+						existingIpBan.ExpiresAt = banDuration == DateTime.MaxValue ? null : banDuration;
+					}
+					await db.SaveChangesAsync();
+
+
+
+					await db.VoteKicks.AddAsync(new VoteKickLog
+					{
+						PlayerId = id,
+						Reason = banReason,
+						Category = banCategory,
+						IsForce = true,
+						CreatedAt = DateTime.UtcNow,
+						ExpiresAt = banDuration ?? DateTime.MaxValue
+					});
+					await db.SaveChangesAsync();
+
+
+
+
+
+
+
+
+
+					await PlayerUtils.KickOrPromptAsync(db, id, PlayerUtils.BuildBlockDetails(true, banCategory, banReason, banDuration, startedAtUtc: DateTime.UtcNow));
+				}
+				else
+				{
+
+
+
+
+
+
+
+
+					var appealable = ModerationPolicy.IssuesAppealCode(banMethod);
+					var appealCode = appealable ? existingBan?.AppealCode : null;
+					string? appealError = null;
+					if (appealable && string.IsNullOrWhiteSpace(appealCode))
+					{
+						var (newCode, cooldownError) = await PlayerUtils.GetAppealForNewBanAsync(db, id);
+						appealCode = newCode;
+						appealError = cooldownError;
+						banChanged = true;
+					}
+					var banStartedAt = DateTime.UtcNow;
+					var banWasModified = existingBan == null
+						|| existingBan.Message != banReason
+						|| existingBan.ExpireDuration != banDuration!.Value
+						|| existingBan.BanMethod != banMethod
+						|| existingBan.ModeratorNote != moderatorNote
+						|| existingBan.Category != banCategory;
+					if (existingBan == null)
+					{
+						await db.Moderation.AddAsync(new ModerationDB
+						{
+							PlayerId = id,
+							Category = banCategory,
+							Message = banReason,
+							ModeratorNote = moderatorNote,
+							CreatedAt = banStartedAt,
+							ExpireDuration = banDuration!.Value,
+							IsBan = true,
+							BanMethod = banMethod,
+							AppealCode = appealCode
+						});
+						banChanged = true;
+					}
+					else
+					{
+
+						if (banWasModified)
+						{
+							banChanged = true;
+							existingBan.CreatedAt = banStartedAt;
+						}
+						existingBan.Category = banCategory;
+						existingBan.Message = banReason;
+						existingBan.ModeratorNote = moderatorNote;
+						existingBan.ExpireDuration = banDuration!.Value;
+						existingBan.IsBan = true;
+						existingBan.BanMethod = banMethod;
+					existingBan.AppealCode = appealCode;
+					}
+
+
+
+
+
+
+					if (string.Equals(banMethod, "Hardware Ban", StringComparison.OrdinalIgnoreCase) && !string.IsNullOrWhiteSpace(playerDevice))
+					{
+						var existingHardwareBan = await db.HardwareBans.FirstOrDefaultAsync(x => x.DeviceId == playerDevice);
+						if (existingHardwareBan == null)
+						{
+							await db.HardwareBans.AddAsync(new HardwareBan
+							{
+								DeviceId = playerDevice,
+								Reason = banReason,
+								CreatedAt = DateTime.UtcNow,
+								ExpiresAt = banDuration == DateTime.MaxValue ? null : banDuration,
+								BannedAccountId = id
+							});
+						}
+						else
+						{
+							existingHardwareBan.Reason = banReason;
+							existingHardwareBan.ExpiresAt = banDuration == DateTime.MaxValue ? null : banDuration;
+							existingHardwareBan.BannedAccountId = id;
+						}
+					}
+
+					await db.SaveChangesAsync();
+
+
+
+					await db.VoteKicks.AddAsync(new VoteKickLog
+					{
+						PlayerId = id,
+						Reason = banReason,
+						Category = banCategory,
+						IsForce = true,
+						CreatedAt = DateTime.UtcNow,
+						ExpiresAt = banDuration ?? DateTime.MaxValue
+					});
+					await db.SaveChangesAsync();
+
+
+
+
+
+
+
+
+
+					var effectiveBan = existingBan ?? await db.Moderation.FirstOrDefaultAsync(x => x.PlayerId == id && x.IsBan);
+					var blockDetails = PlayerUtils.BuildBlockDetails(true, banCategory, banReason, banDuration, appealCode: appealCode, appealError: appealError, startedAtUtc: effectiveBan?.CreatedAt ?? DateTime.UtcNow);
+
+					PlayerUtils.ApplyClientBanKind(blockDetails, banMethod);
+					await PlayerUtils.KickOrPromptAsync(db, id, blockDetails);
+				}
+
+
+
+
+
+				if (banChanged)
+				{
+					if (!isAccountLock)
+					{
+						if (rep == null)
+						{
+							rep = new Reputation { AccountId = id };
+							await db.Reputations.AddAsync(rep);
+						}
+						rep.ApplyBanPenalty(
+							permanent: banDuration == DateTime.MaxValue,
+							cheating: string.Equals(banMethod, "Anti-Cheat", StringComparison.OrdinalIgnoreCase));
+					}
+				banPenaltyApplied = true;
+
+
+
+
+
+					await AdminActionDiscord.LogBanAsync(db, id,
+						await GetPanelAdminUsernameAsync(),
+						causedByReports: false,
+						reason: banReason,
+						category: banCategory,
+						expiry: banDuration,
+						isModerator: banIsModerator,
+						banMethod: banMethod);
+				}
+			}
+			else if (existingBan != null)
+			{
+				db.Moderation.Remove(existingBan);
+
+
+
+				if (string.Equals(existingBan.BanMethod, "IP Ban", StringComparison.OrdinalIgnoreCase) && !string.IsNullOrWhiteSpace(playerIp))
+					await db.IpBans.Where(x => x.IpAddress == playerIp).ExecuteDeleteAsync();
+				if (string.Equals(existingBan.BanMethod, "Hardware Ban", StringComparison.OrdinalIgnoreCase) && !string.IsNullOrWhiteSpace(playerDevice))
+					await db.HardwareBans.Where(x => x.DeviceId == playerDevice).ExecuteDeleteAsync();
+
+				await db.SaveChangesAsync();
+
+
+				await BestEffort("the refresh-login notification", id,
+					() => Notify.SendNotify(id, new Notification { Id = NotificationType.RefreshLogin, Msg = profile }));
+				await BestEffort("the moderation-clear push", id,
+					() => PlayerUtils.ReleaseModerationHoldAsync(id));
+			}
+			else
+			{
+
+
+
+
+				var clearedIpBan = !string.IsNullOrWhiteSpace(playerIp)
+					&& await db.IpBans.Where(x => x.IpAddress == playerIp).ExecuteDeleteAsync() > 0;
+				var clearedHwBan = !string.IsNullOrWhiteSpace(playerDevice)
+					&& await db.HardwareBans.Where(x => x.DeviceId == playerDevice).ExecuteDeleteAsync() > 0;
+
+				if (clearedIpBan || clearedHwBan)
+				{
+					await BestEffort("the refresh-login notification", id,
+						() => Notify.SendNotify(id, new Notification { Id = NotificationType.RefreshLogin, Msg = profile }));
+					await BestEffort("the moderation-clear push", id,
+						() => PlayerUtils.ReleaseModerationHoldAsync(id));
+				}
+			}
+		}
+
+		if (player != null)
+		{
+			if (TryGetString(payload, "email", out var email))
+			{
+				player.Email = email;
+
+
+
+				player.EmailVerified = !string.IsNullOrWhiteSpace(email);
+				player.PendingEmail = null;
+				player.EmailVerifyToken = null;
+			}
+			if (TryGetString(payload, "device_id", out var deviceId)) player.DeviceId = deviceId;
+			if (TryGetEnum(payload, "jr_state", out JuniorState juniorState)) player.JuniorState = juniorState;
+			if (payload.TryGetProperty("is_junior", out var playerIsJunior)) player.IsJunior = playerIsJunior.GetBoolean();
+
+
+
+			if (payload.TryGetProperty("parent_account_id", out var parentProp))
+			{
+				if (parentProp.ValueKind == JsonValueKind.Null || (parentProp.ValueKind == JsonValueKind.String && string.IsNullOrWhiteSpace(parentProp.GetString())))
+				{
+					player.Parent = null;
+				}
+				else if (parentProp.ValueKind == JsonValueKind.Number && parentProp.TryGetInt64(out var rawParent))
+				{
+					player.Parent = rawParent > 0 ? rawParent : null;
+				}
+				else if (parentProp.ValueKind == JsonValueKind.String && long.TryParse(parentProp.GetString(), out var parsedParent))
+				{
+					player.Parent = parsedParent > 0 ? parsedParent : null;
+				}
+			}
+		}
+
+
+
+		if (payload.TryGetProperty("name_history", out var nameHistory) && nameHistory.ValueKind == JsonValueKind.Array)
+		{
+			var history = nameHistory.EnumerateArray()
+				.Select(x => x.GetString() ?? string.Empty)
+				.Where(x => !string.IsNullOrWhiteSpace(x))
+				.ToList();
+
+			if (settings == null)
+			{
+				settings = new PlayerSettings { AccountId = id };
+				await db.PlayerSettings.AddAsync(settings);
+			}
+			var existingSettings = settings.DeserializeSettings() ?? new List<Setting>();
+			existingSettings.RemoveAll(x => x.Key == "NameHistory");
+			existingSettings.Add(new Setting { Key = "NameHistory", Value = System.Text.Json.JsonSerializer.Serialize(history) });
+			settings.Settings = existingSettings.ToJson();
+		}
+
+
+
+
+		if (payload.TryGetProperty("settings", out var settingsProp) && settingsProp.ValueKind == JsonValueKind.Object)
+		{
+			var settingList = new List<Setting>();
+			foreach (var prop in settingsProp.EnumerateObject())
+			{
+				string? val = null;
+				if (prop.Value.ValueKind == JsonValueKind.String) val = prop.Value.GetString();
+				else if (prop.Value.ValueKind == JsonValueKind.True) val = "true";
+				else if (prop.Value.ValueKind == JsonValueKind.False) val = "false";
+				else if (prop.Value.ValueKind == JsonValueKind.Number) val = prop.Value.GetRawText();
+				else val = prop.Value.GetRawText();
+
+				if (val != null)
+					settingList.Add(new Setting { Key = prop.Name, Value = val });
+			}
+
+			if (settings == null)
+			{
+				settings = new PlayerSettings { AccountId = id };
+				await db.PlayerSettings.AddAsync(settings);
+			}
+			settings.Settings = settingList.ToJson();
+		}
+
+
+		var currency = await db.Currency.FirstOrDefaultAsync(x => x.AccountId == id);
+		bool hasBalanceField = HasAny(payload, "rec_tokens", "laser_tag_tickets", "gold", "dracula_silver");
+		if (currency == null && hasBalanceField)
+		{
+			currency = new Currency { AccountId = id };
+			await db.Currency.AddAsync(currency);
+		}
+		var balanceEdits = new List<(CurrencyType Type, long Balance, long Granted)>();
+		if (currency != null)
+		{
+			if (TryGetLong(payload, "rec_tokens", out var recTokens))
+			{
+				balanceEdits.Add((CurrencyType.RecCenterTokens, recTokens, recTokens - currency.RecTokens));
+				currency.RecTokens = recTokens;
+			}
+			if (TryGetLong(payload, "laser_tag_tickets", out var laserTickets))
+			{
+				balanceEdits.Add((CurrencyType.LaserTagTickets, laserTickets, laserTickets - currency.LaserTagTickets));
+				currency.LaserTagTickets = laserTickets;
+			}
+			if (TryGetLong(payload, "gold", out var gold))
+			{
+				balanceEdits.Add((CurrencyType.LostSkullsGold, gold, gold - currency.Gold));
+				currency.Gold = gold;
+			}
+			if (TryGetLong(payload, "dracula_silver", out var draculaSilver))
+			{
+				balanceEdits.Add((CurrencyType.DraculaSilver, draculaSilver, draculaSilver - currency.DraculaSilver));
+				currency.DraculaSilver = draculaSilver;
+			}
+		}
+
+		if (progress == null && (payload.TryGetProperty("level", out _) || payload.TryGetProperty("xp", out _)))
+		{
+			progress = new ProgressionData { PlayerId = id };
+			await db.Progression.AddAsync(progress);
+		}
+
+		if (progress != null)
+		{
+			if (TryGetInt(payload, "level", out var level)) progress.Level = level;
+			if (TryGetInt(payload, "xp", out var xp)) progress.XP = xp;
+		}
+
+		if (rep == null && HasAny(payload, "reputation", "noteriety", "cheer_general", "cheer_helpful", "cheer_great_host", "cheer_sportsman", "cheer_creative", "cheer_credit"))
+		{
+			rep = new Reputation { AccountId = id };
+			await db.Reputations.AddAsync(rep);
+		}
+
+		if (rep != null)
+		{
+
+
+
+			if (!banPenaltyApplied && TryGetDouble(payload, "reputation", out var reputationScore))
+				rep.ReputationScore = reputationScore;
+			if (TryGetDouble(payload, "noteriety", out var noteriety)) rep.Noteriety = noteriety;
+			if (TryGetInt(payload, "cheer_general", out var cheerGeneral)) rep.CheerGeneral = cheerGeneral;
+			if (TryGetInt(payload, "cheer_helpful", out var cheerHelpful)) rep.CheerHelpful = cheerHelpful;
+			if (TryGetInt(payload, "cheer_great_host", out var cheerGreatHost)) rep.CheerGreatHost = cheerGreatHost;
+			if (TryGetInt(payload, "cheer_sportsman", out var cheerSportsman)) rep.CheerSportsman = cheerSportsman;
+			if (TryGetInt(payload, "cheer_creative", out var cheerCreative)) rep.CheerCreative = cheerCreative;
+			if (TryGetInt(payload, "cheer_credit", out var cheerCredit)) rep.CheerCredit = cheerCredit;
+		}
+
+		await db.SaveChangesAsync();
+
+		foreach (var edit in balanceEdits)
+			await BestEffort($"the balance update notification ({edit.Type})", id,
+				() => StorefrontShared.SendBalanceUpdateAsync(id, edit.Type, edit.Balance, edit.Granted, StorefrontBalanceAddTypes.Manual_Thanks));
+
+		if (progress != null)
+		{
+			await BestEffort("level-up gift delivery", id,
+				() => LevelUpGiftService.DeliverLevelUpGiftsAsync(db, id, recomputeFromXp: true, fromLevel: priorLevel, notify: true));
+
+			await BestEffort("progression update push", id,
+				() => RoomProgressionService.PushProgressionUpdateAsync(db, id));
+		}
+
+		return Ok(new { success = true });
+	}
+
+	private static async Task BestEffort(string what, long playerId, Func<Task> action)
+	{
+		try
+		{
+			await action();
+		}
+		catch (Exception)
+		{
+		}
+	}
+
+	private static bool TryGetString(JsonElement payload, string prop, [System.Diagnostics.CodeAnalysis.NotNullWhen(true)] out string? value)
+	{
+		if (payload.TryGetProperty(prop, out var elem) && elem.ValueKind == JsonValueKind.String)
+		{
+			value = elem.GetString()!;
+			return true;
+		}
+		value = null;
+		return false;
+	}
+
+
+
+
+
+
+
+
+
+
+
+
+
+	[HttpPost("players/{playerId:long}/quitgame")]
+	public async Task<IActionResult> QuitPlayerGame(long playerId, [FromQuery] string key)
+	{
+		var rejection = await RejectInvalidKey(key);
+		if (rejection != null) return rejection;
+
+		var profile = await db.Profiles.FirstOrDefaultAsync(x => x.accountId == playerId);
+		if (profile == null) return NotFound("Player does not exist.");
+
+		var display = !string.IsNullOrWhiteSpace(profile.displayName) ? profile.displayName : profile.username;
+
+		Notify.SendReliably(playerId, new Notification { Id = NotificationType.ModerationQuitGame, Msg = "" },
+			TimeSpan.FromSeconds(10), TimeSpan.FromSeconds(1), Notify.EmptyObjectPayload(NotificationType.ModerationQuitGame));
+
+		var presence = await db.Presences.FirstOrDefaultAsync(x => x.playerId == playerId);
+		if (presence != null)
+		{
+			presence.isOnline = false;
+			presence.roomInstance = null;
+			await db.SaveChangesAsync();
+		}
+
+		AdminActionDiscord.LogAction("Quit Game", await GetPanelAdminUsernameAsync(),
+			$"Forced player {playerId} ({display}) to quit the game.");
+
+		return Ok(new { success = true, message = $"Sent quit-game to {display}." });
+	}
+
+	[HttpPost("players/{playerId:long}/forcelogout")]
+	public async Task<IActionResult> ForceLogoutPlayer(long playerId, [FromQuery] string key)
+	{
+		var rejection = await RejectInvalidKey(key);
+		if (rejection != null) return rejection;
+
+		var profile = await db.Profiles.FirstOrDefaultAsync(x => x.accountId == playerId);
+		if (profile == null) return NotFound("Player does not exist.");
+
+		var display = !string.IsNullOrWhiteSpace(profile.displayName) ? profile.displayName : profile.username;
+
+		await Notify.SendNotify(playerId, Notify.EmptyObjectPayload(NotificationType.Logout));
+
+		var player = await db.Players.FirstOrDefaultAsync(x => x.AccountId == playerId);
+		if (player != null)
+		{
+			player.TokenVersion++;
+			TokenRevocation.Bump(playerId, player.TokenVersion);
+		}
+
+		var presence = await db.Presences.FirstOrDefaultAsync(x => x.playerId == playerId);
+		if (presence != null)
+		{
+			presence.isOnline = false;
+			presence.roomInstance = null;
+		}
+
+		await db.SaveChangesAsync();
+
+		_ = Task.Run(async () =>
+		{
+			try
+			{
+				await Task.Delay(TimeSpan.FromMilliseconds(300));
+				Notify.DisconnectAccount(playerId, "force logout");
+			}
+			catch { }
+		});
+
+		AdminActionDiscord.LogAction("Force Logout", await GetPanelAdminUsernameAsync(),
+			$"Forced player {playerId} ({display}) to log out.");
+
+		return Ok(new { success = true, message = $"Sent force-logout to {display}." });
+	}
+
+	[HttpPost("players/{playerId:long}/forcejoin")]
+	public async Task<IActionResult> ForceJoinPlayer(long playerId, [FromQuery] string key, [FromQuery(Name = "target_player_id")] long targetPlayerId)
+	{
+		var rejection = await RejectInvalidKey(key);
+		if (rejection != null) return rejection;
+
+
+		var hostProfile = await db.Profiles.FirstOrDefaultAsync(x => x.accountId == playerId);
+		if (hostProfile == null) return NotFound("Host player does not exist.");
+
+		var targetProfile = await db.Profiles.FirstOrDefaultAsync(x => x.accountId == targetPlayerId);
+		if (targetProfile == null) return NotFound("Target player does not exist.");
+
+		var hostDisplay = !string.IsNullOrWhiteSpace(hostProfile.displayName) ? hostProfile.displayName : hostProfile.username;
+		var targetDisplay = !string.IsNullOrWhiteSpace(targetProfile.displayName) ? targetProfile.displayName : targetProfile.username;
+
+		var hostPresence = await db.Presences.FirstOrDefaultAsync(x => x.playerId == playerId);
+		if (hostPresence == null || !hostPresence.roomInstance.HasValue)
+			return BadRequest(new { success = false, message = $"{hostDisplay} is not currently in a room." });
+
+		var roomInstanceId = hostPresence.roomInstance.Value;
+		var roomInstance = await db.RoomInstances.FirstOrDefaultAsync(x => x.roomInstanceId == roomInstanceId);
+		if (roomInstance == null)
+			return BadRequest(new { success = false, message = $"The room instance {roomInstanceId} could not be found." });
+
+		var matchResult = await MatchmakingUtils.JoinRoom(targetPlayerId, roomInstanceId);
+		if (matchResult.errorCode != JoinStatus.Success)
+		{
+			return BadRequest(new { success = false, message = $"Failed to move {targetDisplay} into the room: {matchResult.errorCode}." });
+		}
+
+		db.ChangeTracker.Clear();
+		var targetPresence = await db.Presences.FirstOrDefaultAsync(x => x.playerId == targetPlayerId);
+		if (targetPresence != null)
+		{
+			try
+			{
+				await Notify.SendNotify(targetPlayerId, new Notification
+				{
+					Id = "PresenceUpdate",
+					Msg = await Presence.CreateAsync(db, targetPresence, roomInstance)
+				});
+			}
+			catch (Exception)
+			{
+			}
+		}
+
+		var targetBan = await db.ResolveBanAsync(targetPlayerId);
+		if (targetBan != null && !await db.IsDeveloper(targetPlayerId))
+		{
+			var banDetails = PlayerUtils.BuildBlockDetails(true, targetBan.Category, targetBan.Reason, targetBan.ExpiryUtc,
+				appealCode: targetBan.AppealCode, startedAtUtc: targetBan.StartedAtUtc,
+				relatedUsername: await PlayerUtils.RelatedAccountUsernameAsync(db, targetBan.BannedAccountId, targetPlayerId));
+			PlayerUtils.ApplyClientBanKind(banDetails, targetBan.BanMethod);
+			await Notify.SendNotify(targetPlayerId, new Notification { Id = NotificationType.ModerationKick, Msg = banDetails });
+		}
+
+		AdminActionDiscord.LogAction("Force Join", await GetPanelAdminUsernameAsync(),
+			$"Force-joined player {targetPlayerId} ({targetDisplay}) into room {roomInstance.name} (instance {roomInstanceId}) where player {playerId} ({hostDisplay}) is.");
+
+		return Ok(new
+		{
+			success = true,
+			message = $"{targetDisplay} has been moved to {hostDisplay}'s room ({roomInstance.name}).",
+			room_name = roomInstance.name,
+			room_instance_id = roomInstanceId
+		});
+	}
+
+	[HttpPost("players/{playerId:long}/warn")]
+	public async Task<IActionResult> WarnPlayer(long playerId, [FromQuery] string key, [FromQuery] int reportCategory, [FromQuery] string? reason, [FromQuery] string? note)
+	{
+		var rejection = await RejectInvalidKey(key);
+		if (rejection != null) return rejection;
+
+		var profile = await db.Profiles.FirstOrDefaultAsync(x => x.accountId == playerId);
+		if (profile == null) return NotFound("Player does not exist.");
+
+		var display = !string.IsNullOrWhiteSpace(profile.displayName) ? profile.displayName : profile.username;
+
+		if (!Enum.IsDefined(typeof(ReportCategory), reportCategory))
+			return BadRequest(new { success = false, message = $"Unknown report category {reportCategory}." });
+
+		var category = (ReportCategory)reportCategory;
+		var displayReason = string.IsNullOrWhiteSpace(reason) ? null : reason.Trim();
+		var moderatorNote = string.IsNullOrWhiteSpace(note) ? null : note.Trim();
+
+		var warning = await PlayerReportingAPI.IssueWarningAsync(db, playerId, category, displayReason, moderatorNote, 1);
+
+		if (warning == null)
+		{
+			var connected = Notify.GetClient(playerId) != null;
+
+			AdminActionDiscord.LogAction("Warn Player (awaiting decision)", await GetPanelAdminUsernameAsync(),
+				$"Warned developer {playerId} ({display}) - {category} - parked until they accept or deny" +
+				(connected ? string.Empty : " (no live notify connection at the time)"));
+
+			return Ok(new
+			{
+				success = true,
+				message = connected
+					? $"{display} is a developer: the accept/deny prompt was sent to their client and the warning is not applied unless they accept it."
+					: $"{display} is a developer and has no live connection right now, so the accept/deny prompt could not be shown. The warning is parked (nothing written) and prompts again on the next action aimed at them.",
+				warning_id = (long?)null
+			});
+		}
+
+		AdminActionDiscord.LogAction("Warn Player", await GetPanelAdminUsernameAsync(),
+			$"Warned player {playerId} ({display}) - {category}" +
+			(displayReason == null ? string.Empty : $": {displayReason}") +
+			(moderatorNote == null ? string.Empty : $" | note: {moderatorNote}"));
+
+		return Ok(new
+		{
+			success = true,
+			message = $"{display} was warned: moved to their dorm and shown the warning until they acknowledge it.",
+			warning_id = warning.Id
+		});
+	}
+
+		[HttpPost("players/{playerId:long}/voicerestriction")]
+	public async Task<IActionResult> ApplyVoiceChatRestriction(long playerId, [FromQuery] string key, [FromQuery] int minutes, [FromQuery] int? reportCategory, [FromQuery] string? reason, [FromQuery] string? note)
+	{
+		var rejection = await RejectInvalidKey(key);
+		if (rejection != null) return rejection;
+
+		var profile = await db.Profiles.FirstOrDefaultAsync(x => x.accountId == playerId);
+		if (profile == null) return NotFound("Player does not exist.");
+
+		var display = !string.IsNullOrWhiteSpace(profile.displayName) ? profile.displayName : profile.username;
+
+		var category = reportCategory.HasValue && Enum.IsDefined(typeof(ReportCategory), reportCategory.Value)
+			? (ReportCategory)reportCategory.Value
+			: ReportCategory.Misc;
+
+		var duration = TimeSpan.FromMinutes(minutes > 0 ? minutes : VoiceChatRestrictions.DefaultDuration.TotalMinutes);
+		var restriction = await VoiceChatRestrictions.ApplyAsync(db, playerId,
+			string.IsNullOrWhiteSpace(reason) ? "Restricted from voice chat for a Code of Conduct violation." : reason.Trim(),
+			category, duration, VoiceChatRestrictions.Method,
+			await GetPanelAdminUsernameAsync(), string.IsNullOrWhiteSpace(note) ? null : note.Trim());
+
+		await VoiceChatRestrictions.PushAsync(playerId, restriction);
+
+		AdminActionDiscord.LogAction("Voice Restriction", await GetPanelAdminUsernameAsync(),
+			$"Restricted {display} ({playerId}) from voice chat for {Math.Round((restriction.ExpiresAt - DateTime.UtcNow).TotalMinutes)} minutes ({category})" +
+			(string.IsNullOrWhiteSpace(reason) ? "" : $": {reason.Trim()}"));
+
+		return Ok(new
+		{
+			success = true,
+			message = $"{display} is restricted from voice chat until {restriction.ExpiresAt:u}.",
+			expires_at = DateTime.SpecifyKind(restriction.ExpiresAt, DateTimeKind.Utc),
+			minutes = (int)Math.Max(0, (restriction.ExpiresAt - DateTime.UtcNow).TotalMinutes)
+		});
+	}
+
+	[HttpDelete("players/{playerId:long}/voicerestriction")]
+	public async Task<IActionResult> ClearVoiceChatRestriction(long playerId, [FromQuery] string key)
+	{
+		var rejection = await RejectInvalidKey(key);
+		if (rejection != null) return rejection;
+
+		var profile = await db.Profiles.FirstOrDefaultAsync(x => x.accountId == playerId);
+		if (profile == null) return NotFound("Player does not exist.");
+
+		var display = !string.IsNullOrWhiteSpace(profile.displayName) ? profile.displayName : profile.username;
+
+		var cleared = await VoiceChatRestrictions.ClearAsync(db, playerId, await GetPanelAdminUsernameAsync());
+		if (!cleared)
+			return Ok(new { success = true, message = $"{display} is not restricted from voice chat." });
+
+		await VoiceChatRestrictions.PushAsync(playerId, null);
+
+		AdminActionDiscord.LogAction("Voice Restriction Lifted", await GetPanelAdminUsernameAsync(),
+			$"Lifted the voice chat restriction on {display} ({playerId}).");
+
+		return Ok(new { success = true, message = $"{display} can use voice chat again." });
+	}
+
+	[HttpPost("players/{playerId:long}/togglejunior")]
+	public async Task<IActionResult> ToggleJunior(long playerId, [FromQuery] string key)
+	{
+		var rejection = await RejectInvalidKey(key);
+		if (rejection != null) return rejection;
+
+		var profile = await db.Profiles.FirstOrDefaultAsync(x => x.accountId == playerId);
+		if (profile == null) return NotFound("Player does not exist.");
+
+		var player = await db.Players.FirstOrDefaultAsync(x => x.AccountId == playerId);
+		var display = !string.IsNullOrWhiteSpace(profile.displayName) ? profile.displayName : profile.username;
+
+		var makeJunior = !profile.isJunior;
+		profile.isJunior = makeJunior;
+		if (player != null)
+		{
+			player.IsJunior = makeJunior;
+			player.JuniorState = makeJunior ? JuniorState.ModerationOverride : JuniorState.BasedOnBirthday;
+		}
+
+		await db.SaveChangesAsync();
+
+		if (player != null) player.TokenVersion++;
+		await db.SaveChangesAsync();
+		if (player != null) TokenRevocation.Bump(playerId, player.TokenVersion);
+
+		await NotifyAccountChanged(playerId, profile, player, refreshSession: true);
+
+		AdminActionDiscord.LogAction(makeJunior ? "Junior Account" : "Lift Junior", await GetPanelAdminUsernameAsync(),
+			$"Set player {playerId} ({display}) junior status to {makeJunior}.");
+
+		return Ok(new
+		{
+			success = true,
+			is_junior = makeJunior,
+			jr_state = player?.JuniorState.ToString() ?? profile.isJunior.ToString(),
+			message = makeJunior ? $"{display} is now a Junior account." : $"Junior status removed from {display}."
+		});
+	}
+
+	private static bool TryGetInt(JsonElement payload, string prop, out int value)
+	{
+		value = 0;
+		if (!payload.TryGetProperty(prop, out var elem)) return false;
+
+		switch (elem.ValueKind)
+		{
+			case JsonValueKind.Number:
+				if (elem.TryGetInt64(out var asLong))
+				{
+					value = (int)Math.Clamp(asLong, int.MinValue, int.MaxValue);
+					return true;
+				}
+				if (elem.TryGetDouble(out var asDouble))
+				{
+					value = (int)Math.Clamp(asDouble, int.MinValue, int.MaxValue);
+					return true;
+				}
+				return false;
+			case JsonValueKind.String:
+				if (int.TryParse(elem.GetString(), out var parsed))
+				{
+					value = parsed;
+					return true;
+				}
+				if (double.TryParse(elem.GetString(), out var parsedDouble))
+				{
+					value = (int)Math.Clamp(parsedDouble, int.MinValue, int.MaxValue);
+					return true;
+				}
+				return false;
+			default:
+				return false;
+		}
+	}
+
+	private static bool TryGetLong(JsonElement payload, string prop, out long value)
+	{
+		value = 0;
+		if (!payload.TryGetProperty(prop, out var elem)) return false;
+
+		switch (elem.ValueKind)
+		{
+			case JsonValueKind.Number:
+				if (elem.TryGetInt64(out var asLong))
+				{
+					value = asLong;
+					return true;
+				}
+				if (elem.TryGetDouble(out var asDouble))
+				{
+					value = (long)Math.Clamp(asDouble, (double)long.MinValue, (double)long.MaxValue);
+					return true;
+				}
+				return false;
+			case JsonValueKind.String:
+				if (long.TryParse(elem.GetString(), out var parsed))
+				{
+					value = parsed;
+					return true;
+				}
+				if (double.TryParse(elem.GetString(), out var parsedDouble))
+				{
+					value = (long)Math.Clamp(parsedDouble, (double)long.MinValue, (double)long.MaxValue);
+					return true;
+				}
+				return false;
+			default:
+				return false;
+		}
+	}
+
+	/// <summary>
+	/// An account id out of a panel payload, where blank means "none". Distinct from
+	/// <see cref="TryGetLong"/> because a field the panel can clear has to accept "" (and a
+	/// cleared field must not silently keep the old id), and because a value that is neither a
+	/// number nor digits - the panel posts account ids as text to keep eighteen digits exact -
+	/// is reported rather than quietly dropped.
+	///
+	/// Returns false only when the property is absent, so a caller leaves the stored value alone
+	/// unless the panel actually sent the field. When it returns true, <paramref name="error"/> is
+	/// non-null for a value that cannot be an id, and the caller must not write it.
+	/// </summary>
+	private static bool TryGetAccountId(JsonElement payload, string prop, out long value, out string? error)
+	{
+		value = 0;
+		error = null;
+		if (!payload.TryGetProperty(prop, out var elem)) return false;
+
+		var text = elem.ValueKind switch
+		{
+			JsonValueKind.Number => elem.GetRawText(),
+			JsonValueKind.String => elem.GetString()?.Trim(),
+			JsonValueKind.Null => null,
+			_ => ""
+		};
+
+		if (string.IsNullOrEmpty(text)) return true;
+		if (long.TryParse(text, out var parsed) && parsed >= 0)
+		{
+			value = parsed;
+			return true;
+		}
+
+		error = $"'{prop}' must be an account id in digits, or blank for no sender.";
+		return true;
+	}
+
+	private static bool TryGetDouble(JsonElement payload, string prop, out double value)
+	{
+		value = 0;
+		if (!payload.TryGetProperty(prop, out var elem)) return false;
+
+		return elem.ValueKind switch
+		{
+			JsonValueKind.Number => elem.TryGetDouble(out value),
+			JsonValueKind.String => double.TryParse(elem.GetString(), out value),
+			_ => false,
+		};
+	}
+
+	private static bool TryGetEnum<T>(JsonElement payload, string prop, out T value) where T : struct
+	{
+		if (payload.TryGetProperty(prop, out var elem) && elem.ValueKind == JsonValueKind.String && Enum.TryParse<T>(elem.GetString(), true, out var parsed))
+		{
+			value = parsed;
+			return true;
+		}
+		value = default;
+		return false;
+	}
+
+	private static bool HasAny(JsonElement payload, params string[] props)
+	{
+		return props.Any(p => payload.TryGetProperty(p, out _));
+	}
+
+	private static string[] SplitRoles(string? roles) => string.IsNullOrWhiteSpace(roles) ? [] : roles.Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries);
+
+	private async Task NotifyAccountChanged(long id, Profile profile, PlayerData? player, bool refreshSession = false)
+	{
+		await Notify.SendNotify(id, new Notification { Id = "AccountUpdate", Msg = profile });
+		await Notify.UpdateSubscriptions(id, Notifs.SubscriptionUpdateProfile, profile);
+		if (player != null)
+			await Notify.SendNotify(id, new Notification { Id = "SelfAccountUpdate", Msg = PlayerUtils.BuildSelfAccount(profile, player) });
+		if (refreshSession)
+			await Notify.SendNotify(id, new Notification { Id = NotificationType.RefreshLogin, Msg = profile });
+	}
+
+	private static string JoinRoles(JsonElement roles)
+	{
+		if (roles.ValueKind != JsonValueKind.Array) return roles.ToString();
+		return string.Join(",", roles.EnumerateArray().Select(x => x.ToString()).Where(x => !string.IsNullOrWhiteSpace(x)));
+	}
+
+	private async Task<List<object>> GetRooms(string? order, bool ascending)
+	{
+		var roomsList = await db.Rooms.ToListAsync();
+		var roomIds = roomsList.Select(r => r.RoomId).ToList();
+		var stats = await db.RoomStats.Where(s => roomIds.Contains(s.RoomId)).ToDictionaryAsync(s => s.RoomId);
+		var giftRows = await db.RoomJoinGifts.Where(g => roomIds.Contains(g.RoomId)).ToListAsync();
+		var giftsByRoom = giftRows.GroupBy(g => g.RoomId).ToDictionary(g => g.Key, g => g.ToList());
+
+		object RoomRow(RoomData r, RoomStats? stat, bool banned, string banReason) => new
+		{
+			id = r.RoomId,
+			name = r.Name,
+			description = r.Description,
+			image_name = r.ImageName,
+			custom_warning = r.CustomWarning,
+			creator_account_id = r.CreatorAccountId,
+			publish_state = r.State.ToString(),
+			accessibility = r.Accessibility.ToString(),
+			is_radicade_approved = false,
+			banned = banned,
+			ban_reason = banReason,
+			exclude_from_lists = false,
+			exclude_from_search = false,
+			supports_screens = r.SupportsScreens,
+			supports_walk_vr = r.SupportsWalkVR,
+			supports_teleport_vr = r.SupportsTeleportVR,
+			supports_vr_low = r.SupportsVRLow,
+			supports_quest2 = r.SupportsQuest2,
+			supports_mobile = r.SupportsMobile,
+			supports_juniors = r.SupportsJuniors,
+			min_level = r.MinLevel,
+			age_rating = 0,
+			created_at = r.CreatedAt,
+			published_at = r.PublishedAt,
+			cheer_count = stat?.CheerCount ?? 0,
+			favorite_count = stat?.FavoriteCount ?? 0,
+			visitor_count = stat?.VisitorCount ?? 0,
+			visit_count = stat?.VisitCount ?? 0,
+			ranking_context = "",
+			is_dorm = r.IsDorm,
+			is_place_play = false,
+			max_player_calculation_mode = (int)r.MaxPlayerCalculationMode,
+			max_players = r.MaxPlayers,
+			cloning_allowed = r.CloningAllowed,
+			disable_mic_auto_mute = r.DisableMicAutoMute,
+			disable_room_comments = r.DisableRoomComments,
+			encrypt_voice_chat = r.EncryptVoiceChat,
+			join_gift_enabled = r.JoinGiftEnabled,
+			join_gift_once_per_player = r.JoinGiftOncePerPlayer,
+			join_gift_version = r.JoinGiftVersion,
+			join_gift_title = r.JoinGiftTitle,
+			join_gift_message = r.JoinGiftMessage,
+			join_gift_avatar_item = r.JoinGiftAvatarItem,
+			join_gift_equipment_item = r.JoinGiftEquipmentItem,
+			join_gift_consumable_item = r.JoinGiftConsumableItem,
+			join_gift_currency_amount = r.JoinGiftCurrencyAmount,
+			join_gift_currency_type = r.JoinGiftCurrencyType.ToString(),
+			join_gift_xp = r.JoinGiftXp,
+			join_gift_context = r.JoinGiftContext.ToString(),
+			join_gift_rarity = r.JoinGiftRarity.ToString(),
+			join_gift_avatar_item_type = r.JoinGiftAvatarItemType.ToString(),
+			join_gift_equipment_modification_guid = r.JoinGiftEquipmentModificationGuid,
+			join_gift_from_player_id = Math.Max(0, r.JoinGiftFromPlayerId).ToString(CultureInfo.InvariantCulture),
+			// The room's whole list of boxes. A room saved before the list existed answers with
+			// the one box its row still describes, so the editor always opens on something real.
+			join_gifts = JoinGiftRows(r, giftsByRoom.GetValueOrDefault(r.RoomId)),
+			toxmod_enabled = false,
+			load_screen_locked = false,
+			persistence_version = 0,
+			min_ugc_sub_version = 0,
+			auto_localize_room = false,
+			is_developer_owned = false,
+			tags = r.Tags,
+			featured = SafeRoomTags(r.Tags).Any(t => string.Equals(t, "featured", StringComparison.OrdinalIgnoreCase))
+		};
+
+		var rooms = roomsList.Select(r =>
+		{
+			stats.TryGetValue(r.RoomId, out var stat);
+			return RoomRow(r, stat, false, "");
+		}).ToList();
+
+		var liveRoomIds = roomsList.Select(r => r.RoomId).ToHashSet();
+		foreach (var entry in RoomBanStore.Load())
+		{
+			if (liveRoomIds.Contains(entry.RoomId)) continue;
+			rooms.Add(RoomRow(entry.Room, entry.Stats, true, entry.Reason));
+		}
+
+		return OrderRows(rooms, order, ascending);
+	}
+
+	private async Task<List<object>> GetRoomComments(string? order, bool ascending)
+	{
+		var rows = await db.RoomComments
+			.AsNoTracking()
+			.Select(c => new
+			{
+				id = c.Id,
+				comment = c.Comment,
+				comment_type = c.CommentType,
+				room_id = c.RoomId,
+				creator_account_id = c.CreatorAccountId,
+				created_at = c.CreatedAt,
+				position_x = c.PositionX,
+				position_y = c.PositionY,
+				position_z = c.PositionZ
+			})
+			.ToListAsync();
+
+		return OrderRows(rows.Cast<object>().ToList(), order, ascending);
+	}
+
+	private List<object> GetCommunityBoard()
+	{
+		var state = LoadState();
+		if (state.CommunityBoard == null)
+		{
+			state.CommunityBoard = new JsonObject
+			{
+				["id"] = 1,
+				["featured_player_id"] = null,
+				["instagram_images"] = new JsonArray(),
+				["board_message"] = "",
+				["announcement_url"] = "",
+				["videos"] = new JsonArray(),
+				["featured_rooms"] = new JsonArray()
+			};
+			SaveState(state);
+		}
+
+		return new List<object> { state.CommunityBoard };
+	}
+
+	private async Task<JsonObject> UpdateCommunityBoard(AdminPanelState state, JsonElement payload)
+	{
+		if (state.CommunityBoard == null)
+		{
+			state.CommunityBoard = new JsonObject
+			{
+				["id"] = 1,
+				["featured_player_id"] = null,
+				["instagram_images"] = new JsonArray(),
+				["board_message"] = "",
+				["announcement_url"] = "",
+				["videos"] = new JsonArray(),
+				["featured_rooms"] = new JsonArray()
+			};
+		}
+
+		foreach (var prop in payload.EnumerateObject())
+		{
+			try
+			{
+				state.CommunityBoard[prop.Name] = JsonNode.Parse(prop.Value.GetRawText());
+			}
+			catch
+			{
+				if (prop.Value.ValueKind == JsonValueKind.String)
+					state.CommunityBoard[prop.Name] = prop.Value.GetString();
+				else if (prop.Value.ValueKind == JsonValueKind.Number)
+					state.CommunityBoard[prop.Name] = prop.Value.GetRawText();
+				else if (prop.Value.ValueKind == JsonValueKind.True)
+					state.CommunityBoard[prop.Name] = true;
+				else if (prop.Value.ValueKind == JsonValueKind.False)
+					state.CommunityBoard[prop.Name] = false;
+				else if (prop.Value.ValueKind == JsonValueKind.Null)
+					state.CommunityBoard[prop.Name] = null;
+				else
+					state.CommunityBoard[prop.Name] = prop.Value.GetRawText();
+			}
+		}
+
+
+
+
+		var instagramNode = state.CommunityBoard["instagram_images"];
+		if (instagramNode != null && instagramNode.GetValueKind() == JsonValueKind.Array)
+		{
+			foreach (var img in instagramNode.AsArray())
+			{
+				var url = img?["image_url"]?.ToString();
+				var existingName = img?["image_name"]?.ToString();
+				if (string.IsNullOrWhiteSpace(existingName)
+					&& url != null
+					&& url.StartsWith("data:", StringComparison.OrdinalIgnoreCase))
+				{
+					var saved = SaveDataUrlFile(url, DBConfig.CDNImages);
+					if (saved != null)
+						img!["image_name"] = saved;
+				}
+			}
+		}
+
+
+		SaveState(state);
+
+
+		var boardConfig = await db.ServerConfig.FirstOrDefaultAsync(x => x.Key == "CommunityBoard");
+
+
+		var instagramImages = new List<RecNet.Board.InstagramImage>();
+		if (instagramNode != null && instagramNode.GetValueKind() == JsonValueKind.Array)
+		{
+			foreach (var img in instagramNode.AsArray())
+			{
+				if (img == null) continue;
+				instagramImages.Add(new RecNet.Board.InstagramImage
+				{
+					ImageName = img["image_name"]?.ToString() ?? "",
+					ImageUrl = img["image_url"]?.ToString() ?? ""
+				});
+			}
+		}
+
+
+
+		var videos = new List<RecNet.Board.BoardVideo>();
+		var videosNode = state.CommunityBoard["videos"];
+		if (videosNode != null && videosNode.GetValueKind() == JsonValueKind.Array)
+		{
+			foreach (var vid in videosNode.AsArray())
+			{
+				if (vid == null) continue;
+
+
+
+				var blob = Path.GetFileName(vid["blob_name"]?.ToString() ?? "");
+				if (!string.IsNullOrWhiteSpace(blob) && !System.IO.File.Exists(Path.Join(DBConfig.CDNVideos, blob)))
+					blob = "";
+
+				var thumb = vid["thumbnail_blob_name"]?.ToString();
+				var thumbName = thumb != null && thumb.StartsWith("data:", StringComparison.OrdinalIgnoreCase)
+					? SaveDataUrlFile(thumb, DBConfig.CDNImages) ?? thumb
+					: thumb ?? "";
+
+				videos.Add(new RecNet.Board.BoardVideo
+				{
+					BlobName = blob,
+					Title = vid["title"]?.ToString() ?? "",
+					Description = vid["description"]?.ToString() ?? "",
+					ThumbnailBlobName = thumbName,
+					SourceUrl = vid["source_url"]?.ToString() ?? ""
+				});
+			}
+		}
+
+		var communityBoard = new RecNet.Board.CommunityBoard
+		{
+			FeaturedPlayer = new RecNet.Board.FeaturedPlayer
+			{
+				Id = (int)(state.CommunityBoard["featured_player_id"]?.GetValue<long>() ?? 0),
+				TitleOverride = state.CommunityBoard["featured_player_title"]?.ToString() ?? "",
+				UrlOverride = state.CommunityBoard["featured_player_url"]?.ToString() ?? ""
+			},
+			FeaturedRoomGroup = await BuildFeaturedRoomGroup(state.CommunityBoard),
+			CurrentAnnouncement = new RecNet.Board.BoardAnnouncement
+			{
+				Message = state.CommunityBoard["board_message"]?.ToString() ?? "",
+				MoreInfoUrl = state.CommunityBoard["announcement_url"]?.ToString() ?? ""
+			},
+			InstagramImages = instagramImages,
+			Videos = videos
+		};
+
+		if (boardConfig == null)
+		{
+			boardConfig = new RecNet.Config.ServerConfigVal { Key = "CommunityBoard", Value = JsonSerializer.Serialize(communityBoard) };
+			db.ServerConfig.Add(boardConfig);
+		}
+		else
+		{
+			boardConfig.Value = JsonSerializer.Serialize(communityBoard);
+		}
+		await db.SaveChangesAsync();
+
+
+		await CommunityBoardBroadcast.PushAsync(communityBoard);
+
+		return state.CommunityBoard;
+	}
+
+
+
+	private static long TryGetEntryId(JsonNode? entry)
+	{
+		if (entry == null) return 0;
+		foreach (var key in new[] { "id", "room_id", "RoomId" })
+		{
+			var raw = entry[key]?.ToString();
+			if (raw != null && long.TryParse(raw, out var parsed) && parsed > 0) return parsed;
+		}
+		return 0;
+	}
+
+
+
+
+
+
+
+	private async Task<RecNet.Board.FeaturedRoomGroup> BuildFeaturedRoomGroup(JsonObject board)
+	{
+		var rooms = new List<RecNet.Board.FeaturedRoom>();
+
+		var featuredRooms = board["featured_rooms"];
+		if (featuredRooms != null && featuredRooms.GetValueKind() == JsonValueKind.Array)
+		{
+			var roomIds = new List<long>();
+			foreach (var entry in featuredRooms.AsArray())
+			{
+				if (entry == null) continue;
+
+			var id = TryGetEntryId(entry);
+			if (id > 0) roomIds.Add(id);
+			}
+
+
+			var dbRooms = roomIds.Count > 0
+				? await db.Rooms.Where(x => roomIds.Contains(x.RoomId)).ToDictionaryAsync(x => x.RoomId)
+				: new Dictionary<long, RadicadeServer.RecNet.Rooms.RoomData>();
+
+			foreach (var entry in featuredRooms.AsArray())
+			{
+				if (entry == null) continue;
+
+				var id = TryGetEntryId(entry);
+				if (id <= 0) continue;
+
+				var name = entry["name"]?.ToString() ?? entry["room_name"]?.ToString() ?? entry["RoomName"]?.ToString() ?? "";
+				dbRooms.TryGetValue(id, out var dbRoom);
+				if (dbRoom != null)
+				{
+					if (string.IsNullOrWhiteSpace(name)) name = dbRoom.Name;
+				}
+
+				rooms.Add(new RecNet.Board.FeaturedRoom
+				{
+					RoomId = id,
+					RoomName = name,
+					ImageName = dbRoom?.ImageName ?? ""
+				});
+			}
+		}
+
+		return new RecNet.Board.FeaturedRoomGroup
+		{
+
+			FeaturedRoomGroupId = 1,
+			Name = board["featured_rooms_title"]?.ToString() ?? "Top Picks",
+			Rooms = rooms
+		};
+	}
+
+		private static Announcement ToAnnouncement(JsonObject row)
+		{
+			string? Text(string key) => row[key]?.ToString();
+			return new Announcement
+			{
+				AnnouncementId = ReadAnnouncementId(row) ?? 0,
+				AnnouncementStatus = TryGetJsonInt(row, "AnnouncementStatus") ?? 0,
+				AnnouncementType = TryGetJsonInt(row, "AnnouncementType") ?? 0,
+				Title = Text("Title") ?? Text("title") ?? string.Empty,
+				Body = Text("Body") ?? Text("message") ?? string.Empty,
+				ImageName = Text("ImageName") ?? string.Empty,
+				LinkName = Text("LinkName") ?? Text("link_name") ?? string.Empty,
+				LinkType = TryGetJsonInt(row, "LinkType") ?? 0,
+				LinkUri = Text("LinkUri") ?? Text("link_uri") ?? string.Empty,
+				Platform = Platforms.All,
+				CreatedAt = DateTime.UtcNow
+			};
+		}
+
+		private static long? ReadAnnouncementId(JsonObject row)
+		{
+			if (row["id"] is not JsonValue value) return null;
+			if (value.TryGetValue<long>(out var asLong)) return asLong;
+			if (value.TryGetValue<double>(out var asDouble) && asDouble <= long.MaxValue && asDouble >= long.MinValue) return (long)asDouble;
+			if (value.TryGetValue<string>(out var asString) && long.TryParse(asString, out var parsed)) return parsed;
+			return null;
+		}
+
+		private List<object> GetAnnouncements()
+		{
+
+
+			var config = db.ServerConfig.FirstOrDefault(x => x.Key == "Announcement");
+			if (config == null || string.IsNullOrWhiteSpace(config.Value))
+			{
+				return new List<object>();
+			}
+			try
+			{
+				var deserialized = config.Value.FromJson<List<JsonObject>>();
+				return deserialized?.Cast<object>().ToList() ?? new List<object>();
+			}
+			catch
+			{
+				return new List<object>();
+			}
+		}
+
+		private async Task<IActionResult> UpdateAnnouncements(JsonElement payload)
+		{
+			try
+			{
+
+				var items = new List<JsonElement>();
+				if (payload.ValueKind == JsonValueKind.Array)
+				{
+					foreach (var el in payload.EnumerateArray()) items.Add(el);
+				}
+				else
+				{
+					items.Add(payload);
+				}
+				if (items.Count == 0) return Ok(new JsonObject());
+
+				var config = await db.ServerConfig.FirstOrDefaultAsync(x => x.Key == "Announcement");
+				if (config == null)
+				{
+					config = new RecNet.Config.ServerConfigVal { Key = "Announcement", Value = "[]" };
+					db.ServerConfig.Add(config);
+				}
+
+
+				List<JsonObject> list;
+				try
+				{
+					list = (config.Value ?? "[]").FromJson<List<JsonObject>>() ?? new List<JsonObject>();
+				}
+				catch
+				{
+					list = new List<JsonObject>();
+				}
+				long nextId = 1;
+				foreach (var existing in list)
+				{
+					var existingId = ReadAnnouncementId(existing);
+					if (existingId == null) continue;
+					existing["id"] = existingId.Value;
+					if (existingId.Value >= nextId) nextId = existingId.Value + 1;
+				}
+				var pendingNotifs = new List<Notification>();
+				int? maintenanceMinutes = null;
+
+				JsonObject? created = null;
+				foreach (var announcement in items)
+				{
+					var type = announcement.TryGetProperty("type", out var typeProp)
+						? (typeProp.GetString() ?? "Regular Announcement")
+						: "Regular Announcement";
+					var message = announcement.TryGetProperty("message", out var msgProp) ? msgProp.GetString() ?? "" : "";
+					var imageRaw = announcement.TryGetProperty("image", out var imgProp) && imgProp.ValueKind == JsonValueKind.String
+						? imgProp.GetString()
+						: null;
+					var minutes = TryGetInt(announcement, "minutes", out var minutesValue) ? minutesValue : (int?)null;
+					var expiresAt = announcement.TryGetProperty("expires_at", out var expProp) && expProp.ValueKind == JsonValueKind.String
+						? expProp.GetString()
+						: null;
+
+					var linkName = announcement.TryGetProperty("link_name", out var lnProp) ? lnProp.GetString() : null;
+					var linkTypeRaw = TryGetInt(announcement, "link_type", out var linkTypeValue) ? linkTypeValue : (int?)null;
+					var linkUri = announcement.TryGetProperty("link_uri", out var luProp) ? luProp.GetString() : null;
+					var title = announcement.TryGetProperty("title", out var tProp) ? tProp.GetString() : null;
+					var normalized = type.ToLower().Replace(" ", "_");
+
+
+					string? imageName = null;
+					if (!string.IsNullOrWhiteSpace(imageRaw))
+					{
+						imageName = SaveDataUrlFile(imageRaw, DBConfig.CDNImages);
+						imageName ??= imageRaw;
+					}
+
+
+
+
+					var panelImage = imageRaw;
+					if (!string.IsNullOrWhiteSpace(imageName) && imageName != imageRaw && !imageName.StartsWith("data:", StringComparison.OrdinalIgnoreCase))
+						panelImage = $"{DBConfig.ServerUrl}/images/img/{imageName}";
+
+					var buttonType = linkTypeRaw ?? 0;
+					var platformType = -1;
+					var buttonName = string.IsNullOrWhiteSpace(linkName)
+						? (normalized == "maintenance" || normalized == "game_update" ? string.Empty : "Learn More")
+						: linkName;
+					var buttonUri = string.IsNullOrWhiteSpace(linkUri) ? string.Empty : linkUri;
+					var annStatus = normalized == "maintenance" ? 4 : 0;
+
+					var row = new JsonObject
+					{
+						["id"] = nextId,
+						["type"] = type,
+						["message"] = message,
+						["image"] = panelImage,
+						["minutes"] = minutes,
+						["expires_at"] = expiresAt,
+						["created_at"] = DateTime.UtcNow,
+						["title"] = string.IsNullOrWhiteSpace(title) ? type : title,
+						["link_name"] = buttonName,
+						["link_type"] = buttonType,
+						["link_uri"] = buttonUri,
+
+						["AnnouncementId"] = nextId,
+						["AnnouncementStatus"] = annStatus,
+						["AnnouncementType"] = buttonType,
+						["Title"] = string.IsNullOrWhiteSpace(title) ? type : title,
+						["Body"] = message,
+						["ImageName"] = imageName ?? "",
+						["IsMostRecent"] = true,
+						["LinkName"] = buttonName,
+						["LinkType"] = platformType,
+						["LinkUri"] = buttonUri,
+
+
+
+						["Platform"] = -1,
+						["CreatedAt"] = DateTime.UtcNow
+					};
+					list.Add(row);
+					created = row;
+
+
+
+					var annObject = new Announcement
+					{
+						AnnouncementId = nextId,
+						AnnouncementStatus = annStatus,
+						AnnouncementType = buttonType,
+						Title = string.IsNullOrWhiteSpace(title) ? type : title,
+						Body = message,
+						ImageName = imageName ?? "",
+						IsMostRecent = true,
+						LinkName = buttonName,
+						LinkType = platformType,
+						LinkUri = buttonUri,
+						Platform = Platforms.All,
+						CreatedAt = DateTime.UtcNow
+					};
+					nextId++;
+
+
+
+
+
+
+					Notification? notif = null;
+					if (normalized == "maintenance")
+					{
+
+
+						var startsInMinutes = Math.Clamp(minutes ?? 30, 0, 61);
+						notif = new Notification
+						{
+							Id = NotificationType.ServerMaintenance,
+							Msg = new ServerMaintenance { StartsInMinutes = startsInMinutes }
+						};
+						maintenanceMinutes = startsInMinutes;
+					}
+					else if (normalized == "game_update")
+					{
+						notif = Notify.EmptyObjectPayload(GameUpdateVersionCheck.AppVersionUpdateNotificationId);
+					}
+					else
+					{
+						notif = AnnouncementBroadcast.Update(annObject);
+					}
+					if (notif != null) pendingNotifs.Add(notif);
+				}
+
+				config.Value = JsonSerializer.Serialize(list);
+				await db.SaveChangesAsync();
+
+
+
+
+
+
+				if (maintenanceMinutes.HasValue)
+					await ApplyMaintenanceToConfig(maintenanceMinutes.Value);
+
+
+
+				foreach (var notif in pendingNotifs)
+				{
+					try { await Notify.SendGlobalNotify(notif); }
+					catch (Exception) { }
+				}
+
+				return Ok(created ?? new JsonObject());
+			}
+			catch (Exception ex)
+			{
+				return StatusCode(StatusCodes.Status500InternalServerError, new JsonObject { ["error"] = ex.Message });
+			}
+		}
+
+	private List<object> GetModerationReports(string? order, bool ascending)
+	{
+		var state = LoadState();
+		if (state.ModerationReports.Count == 0)
+		{
+			state.ModerationReports = new List<JsonObject>();
+			SaveState(state);
+		}
+
+		return OrderRows(state.ModerationReports.Cast<object>().ToList(), order, ascending);
+	}
+
+	private List<object> GetAvatarItems()
+	{
+
+
+
+		var avatarItems = DBConfig.DefaultAvatarCatalog.FromJson<List<AvatarItem>>() ?? new List<AvatarItem>();
+		return avatarItems
+			.Where(item => item != null && !string.IsNullOrWhiteSpace(item.AvatarItemDesc))
+			.Select(item => new
+			{
+				avatar_item_desc = item.AvatarItemDesc,
+				unlocked_level = item.UnlockedLevel,
+				platform_mask = item.PlatformMask,
+				friendly_name = item.FriendlyName ?? "",
+				tooltip = item.Tooltip ?? "",
+				rarity = ((Rarity)item.Rarity).ToString(),
+				// The picture the game shows for this item. The panel builds its own URL from
+				// it (the same /images/img/<name> the server serves), so an item that has one
+				// is shown as a tile rather than as a line of text.
+				thumbnail_image = item.ThumbnailImage ?? ""
+			}).Cast<object>().ToList();
+	}
+
+	private async Task<List<object>> GetPlayerEvents(string? order, bool ascending)
+	{
+
+
+		var events = await db.PlayerEvents.ToListAsync();
+
+		var rows = events.Select(ev => new
+		{
+			id = ev.PlayerEventId,
+			creator_player_id = ev.CreatorPlayerId,
+			image_name = ev.ImageName,
+			room_id = ev.RoomId,
+			name = ev.Name,
+			description = ev.Description,
+			sub_room_id = ev.SubRoomId,
+			club_id = (long?)null,
+			start_time = ev.StartTime,
+			end_time = ev.EndTime,
+			attendee_count = ev.AttendeeCount,
+			state = 0,
+			moderation_state = ev.ModerationState,
+			accessibility = (int)ev.Accessibility,
+			is_multi_instance = false,
+			support_multi_instance_room_chat = false,
+			broadcasting_room_instance_id = (long?)null,
+			default_broadcast_permissions = 0,
+			can_request_broadcast_permissions = 0,
+			recurrence_schedule = (string?)null,
+			created_at = ev.CreatedAt
+		}).Cast<object>().ToList();
+
+		return OrderRows(rows, order, ascending);
+	}
+
+	private async Task<List<object>> GetPlayerEventResponses(string? eqCol, string? eqVal, string? order, bool ascending)
+	{
+		var query = db.PlayerEventResponses.AsQueryable();
+		if (eqCol == "player_event_id" && long.TryParse(eqVal, out var eventId))
+			query = query.Where(x => x.PlayerEventId == eventId);
+
+		var responses = await query.ToListAsync();
+		var playerIds = responses.Select(r => r.PlayerId).Distinct().ToList();
+		var profiles = await db.Profiles.Where(p => playerIds.Contains(p.accountId)).ToDictionaryAsync(p => p.accountId);
+
+		var rows = responses.Select(r => new
+		{
+			id = r.PlayerEventResponseId,
+			player_event_id = r.PlayerEventId,
+			player_id = r.PlayerId,
+			player_name = profiles.TryGetValue(r.PlayerId, out var profile) ? profile.displayName : ("Player " + r.PlayerId),
+			type = (int)r.Type,
+			type_name = r.Type.ToString(),
+			created_at = r.CreatedAt
+		}).Cast<object>().ToList();
+
+		return OrderRows(rows, order, ascending);
+	}
+
+	private async Task<List<object>> GetEventInvitations(string? eqCol, string? eqVal, string? order, bool ascending)
+	{
+		var query = db.Messages.Where(m => m.Type == MessageType.PlayerEventInvitation);
+		if (eqCol == "player_event_id" && long.TryParse(eqVal, out var eventId))
+			query = query.Where(m => m.PlayerEventId == eventId);
+
+		var invitations = await query.ToListAsync();
+		var playerIds = invitations.SelectMany(m => new[] { m.FromPlayerId, m.ToPlayerId }).Distinct().ToList();
+		var profiles = await db.Profiles.Where(p => playerIds.Contains(p.accountId)).ToDictionaryAsync(p => p.accountId);
+
+		var rows = invitations.Select(m => new
+		{
+			id = m.Id,
+			player_event_id = m.PlayerEventId,
+			from_player_id = m.FromPlayerId,
+			from_name = profiles.TryGetValue(m.FromPlayerId, out var from) ? from.displayName : ("Player " + m.FromPlayerId),
+			to_player_id = m.ToPlayerId,
+			to_name = profiles.TryGetValue(m.ToPlayerId, out var to) ? to.displayName : ("Player " + m.ToPlayerId),
+			sent_time = m.SentTime
+		}).Cast<object>().ToList();
+
+		return OrderRows(rows, order, ascending);
+	}
+
+	private async Task<object> UpdatePlayerEvent(long id, JsonElement payload)
+	{
+		var ev = await db.PlayerEvents.FirstOrDefaultAsync(x => x.PlayerEventId == id);
+		if (ev == null) return NotFound();
+
+		if (TryGetString(payload, "name", out var name)) ev.Name = name;
+		if (TryGetString(payload, "description", out var description)) ev.Description = description;
+		if (TryGetString(payload, "image_name", out var imageName)) ev.ImageName = imageName;
+		if (TryGetLong(payload, "room_id", out var roomId) && roomId > 0) ev.RoomId = roomId;
+		if (TryGetDate(payload, "start_time", out var startTime)) ev.StartTime = startTime;
+		if (TryGetDate(payload, "end_time", out var endTime)) ev.EndTime = endTime;
+		if (TryGetInt(payload, "attendee_count", out var attendeeCount)) ev.AttendeeCount = attendeeCount;
+		if (TryGetInt(payload, "accessibility", out var accessibility)) ev.Accessibility = (Accessibility)accessibility;
+		if (TryGetLong(payload, "creator_player_id", out var creatorId) && creatorId > 0) ev.CreatorPlayerId = creatorId;
+		if (TryGetInt(payload, "moderation_state", out var moderationState)) ev.ModerationState = moderationState;
+		if (payload.TryGetProperty("sub_room_id", out var subRoomElem) && subRoomElem.ValueKind != JsonValueKind.Undefined)
+		{
+			if (subRoomElem.ValueKind == JsonValueKind.Null) ev.SubRoomId = null;
+			else if (subRoomElem.ValueKind == JsonValueKind.Number && subRoomElem.TryGetInt64(out var subRoomId)) ev.SubRoomId = subRoomId;
+			else if (subRoomElem.ValueKind == JsonValueKind.String && long.TryParse(subRoomElem.GetString(), out var subRoomStr)) ev.SubRoomId = subRoomStr;
+		}
+
+		await db.SaveChangesAsync();
+		return Ok(new { success = true });
+	}
+
+	private async Task<List<object>> DeletePlayerEvents(List<long> ids)
+	{
+		var events = await db.PlayerEvents.Where(x => ids.Contains(x.PlayerEventId)).ToListAsync();
+		if (events.Count == 0) return new List<object>();
+
+		var eventIds = events.Select(x => x.PlayerEventId).ToList();
+		var responses = await db.PlayerEventResponses.Where(x => eventIds.Contains(x.PlayerEventId)).ToListAsync();
+		db.PlayerEventResponses.RemoveRange(responses);
+		db.PlayerEvents.RemoveRange(events);
+		await db.SaveChangesAsync();
+
+		return events.Select(ev => new { id = ev.PlayerEventId, name = ev.Name }).Cast<object>().ToList();
+	}
+
+	private static bool TryGetDate(JsonElement payload, string prop, out DateTime value)
+	{
+		if (payload.TryGetProperty(prop, out var elem) && elem.ValueKind == JsonValueKind.String && DateTime.TryParse(elem.GetString(), out var parsed))
+		{
+			value = parsed.ToUniversalTime();
+			return true;
+		}
+		value = default;
+		return false;
+	}
+
+	/// <summary>
+	/// A room's join gift boxes as the panel reads them. A room with no list answers with the
+	/// single box its own row describes, so a room configured before the list existed opens on the
+	/// box it actually hands out rather than on an empty editor.
+	/// </summary>
+	private static List<object> JoinGiftRows(RoomData room, List<RoomJoinGift>? rows)
+	{
+		var source = rows is { Count: > 0 } ? rows : [RoomJoinGiftUtils.Snapshot(room)];
+		return source
+			.OrderBy(x => x.SortOrder)
+			.ThenBy(x => x.RoomJoinGiftId)
+			.Select(JoinGiftRow)
+			.ToList();
+	}
+
+	private static object JoinGiftRow(RoomJoinGift gift) => new
+	{
+		id = gift.RoomJoinGiftId,
+		sort_order = gift.SortOrder,
+		version = gift.Version,
+		enabled = gift.Enabled,
+		once_per_player = gift.OncePerPlayer,
+		title = gift.Title,
+		message = gift.Message,
+		// Digits in a string, for the same reason the room's own sender is: an account id is
+		// eighteen digits and a JSON number would arrive in the panel rounded.
+		from_player_id = Math.Max(0, gift.FromPlayerId).ToString(CultureInfo.InvariantCulture),
+		avatar_item = gift.AvatarItem,
+		avatar_item_type = gift.AvatarItemType.ToString(),
+		equipment_item = gift.EquipmentItem,
+		equipment_modification_guid = gift.EquipmentModificationGuid,
+		consumable_item = gift.ConsumableItem,
+		currency_type = gift.CurrencyType.ToString(),
+		currency_amount = gift.CurrencyAmount,
+		xp = gift.Xp,
+		context = gift.Context.ToString(),
+		rarity = gift.Rarity.ToString()
+	};
+
+	/// <summary>
+	/// Replaces a room's list of join gift boxes with the list the panel sent. A box that is new is
+	/// inserted; a box whose contents changed keeps its identity but gets a new version, so players
+	/// who already opened the old box are handed the new one; a box the panel left out is deleted.
+	/// Anything that cannot be read refuses the save before a row is touched, so a mistyped id never
+	/// leaves the room half-written.
+	/// </summary>
+	private async Task<IActionResult?> ApplyJoinGiftListAsync(RoomData room, JsonElement list)
+	{
+		var wanted = new List<RoomJoinGift>();
+		var index = 0;
+		foreach (var element in list.EnumerateArray())
+		{
+			var gift = ReadJoinGift(element, index, out var error);
+			if (gift == null) return BadRequest(error);
+			gift.SortOrder = index;
+			wanted.Add(gift);
+			index++;
+		}
+
+		if (wanted.Count > MaxJoinGiftsPerRoom)
+			return BadRequest($"A room can hold at most {MaxJoinGiftsPerRoom} join gift boxes.");
+
+		var existing = await db.RoomJoinGifts.Where(x => x.RoomId == room.RoomId).ToListAsync();
+		var kept = new HashSet<long>();
+		var changed = false;
+
+		foreach (var gift in wanted)
+		{
+			RoomJoinGift? row = null;
+			if (gift.RoomJoinGiftId > 0)
+			{
+				row = existing.FirstOrDefault(x => x.RoomJoinGiftId == gift.RoomJoinGiftId);
+				if (row == null)
+					return BadRequest($"join_gifts[{gift.SortOrder}].id {gift.RoomJoinGiftId} is not one of this room's gift boxes.");
+			}
+
+			if (row == null)
+			{
+				var added = new RoomJoinGift
+				{
+					RoomId = room.RoomId,
+					SortOrder = gift.SortOrder,
+					Version = 1
+				};
+				CopyJoinGiftValues(gift, added);
+				db.RoomJoinGifts.Add(added);
+				changed = true;
+				continue;
+			}
+
+			kept.Add(row.RoomJoinGiftId);
+			if (!SameJoinGift(row, gift))
+			{
+				CopyJoinGiftValues(gift, row);
+				row.Version++;
+				changed = true;
+			}
+
+			// Moving a box up or down the list reissues nothing: the box itself did not change.
+			row.SortOrder = gift.SortOrder;
+		}
+
+		var removed = existing.Where(x => !kept.Contains(x.RoomJoinGiftId)).ToList();
+		if (removed.Count > 0)
+		{
+			db.RoomJoinGifts.RemoveRange(removed);
+			changed = true;
+		}
+
+		// The room's own fields describe its first box, so a reader that only knows those fields -
+		// and the editor of a room saved before the list existed - still sees what it hands out.
+		var first = wanted.OrderBy(x => x.SortOrder).FirstOrDefault();
+		room.JoinGiftEnabled = wanted.Any(x => x.Enabled);
+		room.JoinGiftOncePerPlayer = first?.OncePerPlayer ?? true;
+		room.JoinGiftTitle = first?.Title ?? "Room Visit Gift";
+		room.JoinGiftMessage = first?.Message ?? "";
+		room.JoinGiftAvatarItem = first?.AvatarItem ?? "";
+		room.JoinGiftAvatarItemType = first?.AvatarItemType ?? AvatarItemType.Outfit;
+		room.JoinGiftEquipmentItem = first?.EquipmentItem ?? "";
+		room.JoinGiftEquipmentModificationGuid = first?.EquipmentModificationGuid ?? "";
+		room.JoinGiftConsumableItem = first?.ConsumableItem ?? "";
+		room.JoinGiftCurrencyType = first?.CurrencyType ?? CurrencyType.RecCenterTokens;
+		room.JoinGiftCurrencyAmount = first?.CurrencyAmount ?? 0;
+		room.JoinGiftXp = first?.Xp ?? 0;
+		room.JoinGiftContext = first?.Context ?? GiftContext.Game_Drop;
+		room.JoinGiftRarity = first?.Rarity ?? Rarity.Common;
+		room.JoinGiftFromPlayerId = first?.FromPlayerId ?? 0;
+
+		if (changed) room.JoinGiftVersion++;
+
+		await db.SaveChangesAsync();
+		return null;
+	}
+
+	private const int MaxJoinGiftsPerRoom = 20;
+
+	/// <summary>One box as the panel sent it, or null with the reason it could not be read.</summary>
+	private static RoomJoinGift? ReadJoinGift(JsonElement element, int index, out string? error)
+	{
+		error = null;
+		if (element.ValueKind != JsonValueKind.Object)
+		{
+			error = $"join_gifts[{index}] must be a gift box.";
+			return null;
+		}
+
+		var gift = new RoomJoinGift { RoomJoinGiftId = Math.Max(0, TryGetJsonLong(element, "id") ?? 0) };
+
+		if (TryGetJsonBool(element, "enabled") is { } enabled) gift.Enabled = enabled;
+		if (TryGetJsonBool(element, "once_per_player") is { } oncePerPlayer) gift.OncePerPlayer = oncePerPlayer;
+		if (GetJsonString(element, "title") is { } title) gift.Title = title;
+		if (GetJsonString(element, "message") is { } message) gift.Message = message;
+		if (GetJsonString(element, "avatar_item") is { } avatarItem) gift.AvatarItem = avatarItem;
+		if (ParseAvatarItemType(GetJsonString(element, "avatar_item_type")) is { } avatarItemType) gift.AvatarItemType = avatarItemType;
+		if (GetJsonString(element, "equipment_item") is { } equipmentItem) gift.EquipmentItem = equipmentItem;
+		if (GetJsonString(element, "equipment_modification_guid") is { } modificationGuid) gift.EquipmentModificationGuid = modificationGuid;
+		if (GetJsonString(element, "consumable_item") is { } consumableItem) gift.ConsumableItem = consumableItem;
+		if (ParseCurrencyType(GetJsonString(element, "currency_type")) is { } currencyType) gift.CurrencyType = currencyType;
+		if (TryGetJsonInt(element, "currency_amount") is { } currencyAmount) gift.CurrencyAmount = Math.Max(0, currencyAmount);
+		if (TryGetJsonInt(element, "xp") is { } xp) gift.Xp = Math.Max(0, xp);
+		if (ParseGiftContext(GetJsonString(element, "context")) is { } context) gift.Context = context;
+		if (ParseRarity(GetJsonString(element, "rarity")) is { } rarity) gift.Rarity = rarity;
+
+		// Named with the box it belongs to: an eighteen-digit account id has to stay digits, and a
+		// refusal has to say which box it came from.
+		if (TryGetAccountId(element, "from_player_id", out var fromPlayerId, out var fromError))
+		{
+			if (fromError != null)
+			{
+				error = $"join_gifts[{index}].from_player_id must be an account id in digits, or blank for no sender.";
+				return null;
+			}
+
+			gift.FromPlayerId = fromPlayerId;
+		}
+
+		return gift;
+	}
+
+	private static bool SameJoinGift(RoomJoinGift row, RoomJoinGift sent)
+	{
+		return row.Enabled == sent.Enabled &&
+			row.OncePerPlayer == sent.OncePerPlayer &&
+			string.Equals(row.Title ?? "", sent.Title ?? "", StringComparison.Ordinal) &&
+			string.Equals(row.Message ?? "", sent.Message ?? "", StringComparison.Ordinal) &&
+			string.Equals(row.AvatarItem ?? "", sent.AvatarItem ?? "", StringComparison.Ordinal) &&
+			row.AvatarItemType == sent.AvatarItemType &&
+			string.Equals(row.EquipmentItem ?? "", sent.EquipmentItem ?? "", StringComparison.Ordinal) &&
+			string.Equals(row.EquipmentModificationGuid ?? "", sent.EquipmentModificationGuid ?? "", StringComparison.Ordinal) &&
+			string.Equals(row.ConsumableItem ?? "", sent.ConsumableItem ?? "", StringComparison.Ordinal) &&
+			row.CurrencyType == sent.CurrencyType &&
+			row.CurrencyAmount == sent.CurrencyAmount &&
+			row.Xp == sent.Xp &&
+			row.Context == sent.Context &&
+			row.Rarity == sent.Rarity &&
+			row.FromPlayerId == sent.FromPlayerId;
+	}
+
+	/// <summary>The fields that make a box a box - never its id, room, order or version.</summary>
+	private static void CopyJoinGiftValues(RoomJoinGift from, RoomJoinGift to)
+	{
+		to.Enabled = from.Enabled;
+		to.OncePerPlayer = from.OncePerPlayer;
+		to.Title = from.Title ?? "";
+		to.Message = from.Message ?? "";
+		to.AvatarItem = from.AvatarItem ?? "";
+		to.AvatarItemType = from.AvatarItemType;
+		to.EquipmentItem = from.EquipmentItem ?? "";
+		to.EquipmentModificationGuid = from.EquipmentModificationGuid ?? "";
+		to.ConsumableItem = from.ConsumableItem ?? "";
+		to.CurrencyType = from.CurrencyType;
+		to.CurrencyAmount = from.CurrencyAmount;
+		to.Xp = from.Xp;
+		to.Context = from.Context;
+		to.Rarity = from.Rarity;
+		to.FromPlayerId = from.FromPlayerId;
+	}
+
+	private async Task<object> UpdateRoom(long id, JsonElement payload)
+	{
+		var room = await db.Rooms.FirstOrDefaultAsync(x => x.RoomId == id);
+		if (room == null)
+		{
+			if (payload.TryGetProperty("banned", out var liftBan) && liftBan.ValueKind == JsonValueKind.False)
+			{
+				var restored = await RoomBanStore.RestoreAsync(db, id);
+				if (restored) return Ok(new { success = true, room_id = id, banned = false, restored = true });
+			}
+
+			return NotFound("Room does not exist.");
+		}
+
+		if (TryGetString(payload, "name", out var name)) room.Name = name;
+		if (TryGetString(payload, "description", out var description)) room.Description = description;
+		if (TryGetString(payload, "image_name", out var imageName)) room.ImageName = imageName;
+		if (TryGetString(payload, "custom_warning", out var customWarning)) room.CustomWarning = customWarning;
+
+		if (payload.TryGetProperty("supports_screens", out var supportsScreens)) room.SupportsScreens = supportsScreens.GetBoolean();
+		if (payload.TryGetProperty("supports_walk_vr", out var supportsWalk)) room.SupportsWalkVR = supportsWalk.GetBoolean();
+		if (payload.TryGetProperty("supports_teleport_vr", out var supportsTeleport)) room.SupportsTeleportVR = supportsTeleport.GetBoolean();
+		if (payload.TryGetProperty("supports_vr_low", out var supportsVrLow)) room.SupportsVRLow = supportsVrLow.GetBoolean();
+		if (payload.TryGetProperty("supports_quest2", out var supportsQuest2)) room.SupportsQuest2 = supportsQuest2.GetBoolean();
+		if (payload.TryGetProperty("supports_mobile", out var supportsMobile)) room.SupportsMobile = supportsMobile.GetBoolean();
+		if (payload.TryGetProperty("supports_juniors", out var supportsJuniors)) room.SupportsJuniors = supportsJuniors.GetBoolean();
+		if (payload.TryGetProperty("cloning_allowed", out var cloningAllowed)) room.CloningAllowed = cloningAllowed.GetBoolean();
+		if (payload.TryGetProperty("disable_mic_auto_mute", out var disableMicAutoMute)) room.DisableMicAutoMute = disableMicAutoMute.GetBoolean();
+		if (payload.TryGetProperty("disable_room_comments", out var disableRoomComments)) room.DisableRoomComments = disableRoomComments.GetBoolean();
+		if (payload.TryGetProperty("encrypt_voice_chat", out var encryptVoiceChat)) room.EncryptVoiceChat = encryptVoiceChat.GetBoolean();
+		if (payload.TryGetProperty("is_dorm", out var isDorm)) room.IsDorm = isDorm.GetBoolean();
+
+		if (TryGetInt(payload, "min_level", out var minLevel)) room.MinLevel = minLevel;
+		if (TryGetInt(payload, "max_players", out var maxPlayers)) room.MaxPlayers = maxPlayers;
+		if (TryGetInt(payload, "max_player_calculation_mode", out var maxCalcMode)) room.MaxPlayerCalculationMode = (MaxPlayerMode)maxCalcMode;
+
+		// A room's boxes arrive as a list. When the panel sends one, it is the whole truth about
+		// that room's boxes and the single-box fields below are not read: the list is written to
+		// RoomJoinGifts and the room's own fields are then filled in from its first box, so every
+		// older reader of those fields still sees the box the room hands out first.
+		if (payload.TryGetProperty("join_gifts", out var joinGiftList) && joinGiftList.ValueKind == JsonValueKind.Array)
+		{
+			var refusal = await ApplyJoinGiftListAsync(room, joinGiftList);
+			if (refusal != null) return refusal;
+		}
+		else
+		{
+			var giftChanged = false;
+			if (payload.TryGetProperty("join_gift_enabled", out var joinGiftEnabled)) room.JoinGiftEnabled = joinGiftEnabled.GetBoolean();
+			if (payload.TryGetProperty("join_gift_once_per_player", out var joinGiftOnce)) room.JoinGiftOncePerPlayer = joinGiftOnce.GetBoolean();
+			if (TryGetString(payload, "join_gift_title", out var giftTitle)) { room.JoinGiftTitle = giftTitle ?? ""; giftChanged = true; }
+			if (TryGetString(payload, "join_gift_message", out var giftMessage)) { room.JoinGiftMessage = giftMessage ?? ""; giftChanged = true; }
+			if (TryGetString(payload, "join_gift_avatar_item", out var giftAvatar)) { room.JoinGiftAvatarItem = giftAvatar ?? ""; giftChanged = true; }
+			if (TryGetString(payload, "join_gift_equipment_item", out var giftEquip)) { room.JoinGiftEquipmentItem = giftEquip ?? ""; giftChanged = true; }
+			if (TryGetString(payload, "join_gift_consumable_item", out var giftCons)) { room.JoinGiftConsumableItem = giftCons ?? ""; giftChanged = true; }
+			if (TryGetInt(payload, "join_gift_currency_amount", out var giftCurrencyAmount)) { room.JoinGiftCurrencyAmount = Math.Max(0, giftCurrencyAmount); giftChanged = true; }
+			if (TryGetInt(payload, "join_gift_xp", out var giftXp)) { room.JoinGiftXp = Math.Max(0, giftXp); giftChanged = true; }
+			if (TryGetString(payload, "join_gift_currency_type", out var giftCurrencyTypeRaw) &&
+				StorefrontShared.TryParseCurrencyType(giftCurrencyTypeRaw, out var giftCurrencyType))
+			{
+				room.JoinGiftCurrencyType = giftCurrencyType;
+				giftChanged = true;
+			}
+			if (TryGetString(payload, "join_gift_context", out var giftContextRaw) && ParseGiftContext(giftContextRaw) is { } giftContext)
+			{
+				room.JoinGiftContext = giftContext;
+				giftChanged = true;
+			}
+			if (TryGetString(payload, "join_gift_rarity", out var giftRarityRaw) && ParseRarity(giftRarityRaw) is { } giftRarity)
+			{
+				room.JoinGiftRarity = giftRarity;
+				giftChanged = true;
+			}
+			if (TryGetString(payload, "join_gift_avatar_item_type", out var giftAvatarTypeRaw) && ParseAvatarItemType(giftAvatarTypeRaw) is { } giftAvatarType)
+			{
+				room.JoinGiftAvatarItemType = giftAvatarType;
+				giftChanged = true;
+			}
+			if (TryGetString(payload, "join_gift_equipment_modification_guid", out var giftEquipMod))
+			{
+				room.JoinGiftEquipmentModificationGuid = giftEquipMod ?? "";
+				giftChanged = true;
+			}
+			if (TryGetAccountId(payload, "join_gift_from_player_id", out var giftFrom, out var giftFromError))
+			{
+				if (giftFromError != null) return BadRequest(giftFromError);
+				// Only a sender that actually changed re-issues the box: this field is not carried by
+				// every panel that saves a room, so it must not bump the gift version on its own.
+				if (room.JoinGiftFromPlayerId != giftFrom)
+				{
+					room.JoinGiftFromPlayerId = giftFrom;
+					giftChanged = true;
+				}
+			}
+			if (TryGetInt(payload, "join_gift_version", out var giftVersion) && giftVersion > 0)
+				room.JoinGiftVersion = giftVersion;
+			else if (giftChanged)
+				room.JoinGiftVersion++;
+		}
+
+
+		var stats = await db.RoomStats.FirstOrDefaultAsync(x => x.RoomId == room.RoomId);
+			if (stats == null && HasAny(payload, "cheer_count", "favorite_count", "visitor_count", "visit_count"))
+			{
+				stats = new RadicadeServer.RecNet.Rooms.RoomStats { RoomId = room.RoomId };
+				db.RoomStats.Add(stats);
+			}
+		if (stats != null)
+		{
+			if (TryGetInt(payload, "cheer_count", out var cheerCount)) stats.CheerCount = cheerCount;
+			if (TryGetInt(payload, "favorite_count", out var favoriteCount)) stats.FavoriteCount = favoriteCount;
+			if (TryGetInt(payload, "visitor_count", out var visitorCount)) stats.VisitorCount = visitorCount;
+			if (TryGetInt(payload, "visit_count", out var visitCount)) stats.VisitCount = visitCount;
+		}
+
+
+
+		if (TryGetString(payload, "publish_state", out var publishState) && Enum.TryParse<RoomState>(publishState, true, out var state))
+			room.State = state;
+		if (payload.TryGetProperty("banned", out var banned))
+		{
+			if (banned.ValueKind == JsonValueKind.True)
+			{
+				var banReason = TryGetString(payload, "ban_reason", out var reason) ? reason ?? "" : "";
+				await RoomBanStore.BanAsync(db, room, banReason, await GetPanelAdminUsernameAsync());
+				return Ok(new { success = true, room_id = id, banned = true, reason = banReason });
+			}
+
+			room.State = RoomState.Active;
+		}
+
+		if (payload.TryGetProperty("accessibility", out var accessibilityProp))
+		{
+			var accessibilityText = accessibilityProp.ValueKind switch
+			{
+				JsonValueKind.Number => accessibilityProp.GetRawText(),
+				JsonValueKind.String => accessibilityProp.GetString(),
+				_ => null
+			};
+			if (TryParseRoomAccessibility(accessibilityText, out var parsedAccessibility))
+				room.Accessibility = parsedAccessibility;
+		}
+
+		var featuredFlag = TryGetJsonBool(payload, "featured") ?? TryGetJsonBool(payload, "is_featured");
+		if (featuredFlag != null)
+		{
+			var tags = StringTools.ReadTags(room.Tags);
+			var featuredTag = tags.FirstOrDefault(x => string.Equals(x.Tag, "featured", StringComparison.OrdinalIgnoreCase));
+			if (featuredFlag.Value)
+			{
+				if (featuredTag == null)
+					tags.Add(new ItemTag { Type = TagType.Auto, Tag = "featured" });
+			}
+			else if (featuredTag != null)
+			{
+				tags.Remove(featuredTag);
+			}
+
+			room.Tags = StringTools.CreateTagString(tags);
+		}
+		else if (payload.TryGetProperty("tags", out var tagsElement) || payload.TryGetProperty("Tags", out tagsElement))
+		{
+			var tagString = ParseRoomTags(tagsElement);
+			if (tagString != null) room.Tags = tagString;
+		}
+
+		await db.SaveChangesAsync();
+		return Ok(new { success = true });
+	}
+
+	private static string? ParseRoomTags(JsonElement element)
+	{
+		try
+		{
+			var tags = new List<ItemTag>();
+
+			if (element.ValueKind == JsonValueKind.String)
+			{
+				AddTagsFromString(element.GetString());
+			}
+			else if (element.ValueKind == JsonValueKind.Array)
+			{
+				foreach (var entry in element.EnumerateArray())
+				{
+					if (entry.ValueKind == JsonValueKind.String)
+					{
+						AddTagsFromString(entry.GetString());
+						continue;
+					}
+
+					if (entry.ValueKind != JsonValueKind.Object) continue;
+					var name = (GetJsonString(entry, "Tag") ?? GetJsonString(entry, "tag"))?.Trim().TrimStart('#');
+					if (string.IsNullOrWhiteSpace(name)) continue;
+
+					var type = TagType.General;
+					var rawType = GetJsonString(entry, "Type") ?? GetJsonString(entry, "type");
+					if (rawType != null)
+					{
+						if (int.TryParse(rawType, out var typeValue) && Enum.IsDefined(typeof(TagType), typeValue))
+							type = (TagType)typeValue;
+						else if (Enum.TryParse<TagType>(rawType, true, out var parsedType))
+							type = parsedType;
+					}
+
+					tags.Add(new ItemTag { Tag = name, Type = type });
+				}
+			}
+			else
+			{
+				return null;
+			}
+
+			return StringTools.CreateTagString(tags);
+
+			void AddTagsFromString(string? raw)
+			{
+				if (string.IsNullOrWhiteSpace(raw)) return;
+				foreach (var part in raw.Split(new[] { ',', ' ', ';' }, StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries))
+				{
+					var name = part.TrimStart('#');
+					if (!string.IsNullOrWhiteSpace(name))
+						tags.Add(new ItemTag { Tag = name, Type = TagType.General });
+				}
+			}
+		}
+		catch
+		{
+			return null;
+		}
+	}
+
+
+
+
+
+
+
+	private async Task<List<JsonObject>> AddGiftLogRows(AdminPanelState state, JsonElement payload)
+	{
+		var added = AddRows(state, state.GiftLog, payload);
+
+		foreach (var gift in added)
+		{
+			var playerId = long.TryParse(gift["player_id"]?.ToString(), out var pid) ? pid : 0;
+			if (playerId > 0)
+			{
+				await ProcessGiftRowAsync(playerId, gift);
+			}
+			else
+			{
+				gift["error"] = "Invalid or missing player_id.";
+			}
+		}
+
+		SaveState(state);
+		return added;
+	}
+
+
+
+
+
+
+
+
+
+	private async Task<long> ProcessGiftRowAsync(long playerId, JsonObject gift)
+	{
+		long giftDropId = 0;
+		try
+		{
+			var message = gift["message"]?.ToString() ?? "A gift from the Radicade Team!";
+			var currencyAmount = TryGetJsonInt(gift, "currency") ?? 0;
+			var xpAmount = TryGetJsonInt(gift, "xp") ?? 0;
+			var avatar = gift["avatar"]?.ToString() ?? "";
+			var cons = gift["cons"]?.ToString() ?? "";
+			var equip = gift["equip"]?.ToString() ?? "";
+			var currencyTypeRaw = gift["currency_type"]?.ToString() ?? gift["currencyType"]?.ToString() ?? "";
+
+			var fromPlayerId = long.TryParse(gift["from_player_id"]?.ToString(), out var typedFrom) && typedFrom > 0
+				? typedFrom
+				: RadicadeTeamAccountId;
+
+			var equipModificationGuid = gift["equipment_modification_guid"]?.ToString()
+				?? gift["prefab_modify"]?.ToString()
+				?? "";
+
+
+
+
+			bool isRoomCurrency = string.Equals(currencyTypeRaw, "RoomCurrency", StringComparison.OrdinalIgnoreCase);
+			var currencyType = StorefrontShared.TryParseCurrencyType(currencyTypeRaw, out var parsed) ? parsed : CurrencyType.Invalid;
+
+			if (currencyAmount > 0 && currencyType == CurrencyType.Invalid && !isRoomCurrency)
+				throw new InvalidOperationException($"Unknown currency type '{currencyTypeRaw}' - gift not routed to avoid crediting the wrong wallet.");
+
+
+
+
+			if (isRoomCurrency && currencyAmount > 0)
+				throw new InvalidOperationException("RoomCurrency gifts are not supported yet: no room currency storage exists and no room_id was supplied.");
+
+			bool hasReward = currencyAmount > 0 || xpAmount > 0
+				|| !string.IsNullOrWhiteSpace(avatar) || !string.IsNullOrWhiteSpace(cons) || !string.IsNullOrWhiteSpace(equip);
+			if (!hasReward)
+				throw new InvalidOperationException("Gift has no rewards (item, currency or XP).");
+
+
+
+
+			giftDropId = NewGiftDropId();
+
+			var giftBox = new Gift
+			{
+				GiftDropId = giftDropId,
+				ItemSetId = 0,
+				ItemSetFriendlyName = "Radicade Gift",
+				FriendlyName = gift["title"]?.ToString() ?? "A Gift from Radicade!",
+				Tooltip = message,
+				IsQuery = false,
+				Unique = false,
+				SubscribersOnly = false,
+				ConsumableItemDesc = cons,
+				AvatarItemDesc = avatar,
+				AvatarItemType = AvatarItemType.Outfit,
+				EquipmentPrefabName = equip,
+				EquipmentModificationGuid = equipModificationGuid,
+				CurrencyType = currencyType,
+				Currency = currencyAmount,
+				Xp = xpAmount,
+				Context = TryParseGiftContext(gift["context"]?.ToString()) ?? GiftContext.Game_Drop,
+				Rarity = TryParseRarity(gift["rarity"]?.ToString()) ?? Rarity.Common,
+				FromPlayerId = fromPlayerId
+			};
+
+			await PersistGiftBoxAsync(playerId, giftBox, gift);
+
+
+			gift["sent"] = true;
+			gift["sent_at"] = DateTime.UtcNow;
+			gift["gift_drop_id"] = giftDropId;
+			gift["boxed"] = true;
+
+			gift["from_player_id"] = fromPlayerId;
+		}
+		catch (Exception ex)
+		{
+
+			gift["error"] = ex.Message;
+		}
+		return giftDropId;
+	}
+
+
+
+
+
+	private async Task PersistGiftBoxAsync(long playerId, Gift giftBox, JsonObject? logRow)
+	{
+		var overwritten = await StorefrontShared.PersistGiftBoxAsync(db, playerId, giftBox);
+		if (overwritten != 0 && logRow != null)
+			logRow["overwrote_gift_drop_id"] = overwritten;
+	}
+
+	private async Task<List<object>> ProcessGiftLog(string? eqCol, string? eqVal, string? order, bool ascending)
+	{
+		var state = LoadState();
+		var filtered = state.GiftLog.AsEnumerable();
+
+		if (!string.IsNullOrWhiteSpace(eqCol) && eqVal != null)
+			filtered = filtered.Where(x => x[eqCol]?.ToString() == eqVal);
+
+
+
+
+		var pendingGifts = filtered.Where(x => !string.Equals(x["sent"]?.ToString(), "true", StringComparison.OrdinalIgnoreCase)).ToList();
+		foreach (var gift in pendingGifts)
+		{
+			var playerId = long.TryParse(gift["player_id"]?.ToString(), out var pid) ? pid : 0;
+			if (playerId > 0)
+			{
+				await ProcessGiftRowAsync(playerId, gift);
+			}
+		}
+
+		SaveState(state);
+		return OrderRows(filtered.Cast<object>().ToList(), order, ascending);
+	}
+}
+
+public class WeeklyScheduleRequest
+{
+    public string Revision { get; set; } = "";
+    public string Title { get; set; } = "Weekly Challenges";
+    public bool Enabled { get; set; } = true;
+    public string RewardKey { get; set; } = "";
+    public int FallbackTokens { get; set; } = 300;
+    public int ChallengeMapId { get; set; }
+    public List<long> ChallengeIds { get; set; } = new();
+}
+
+public class AdminPanelState
+{
+	public List<JsonObject> Storefronts { get; set; } = new();
+	public List<JsonObject> Challenges { get; set; } = new();
+	public List<JsonObject> ModerationLog { get; set; } = new();
+	public List<JsonObject> GiftLog { get; set; } = new();
+	public List<JsonObject> Notes { get; set; } = new();
+	public List<JsonObject> AuditLog { get; set; } = new();
+	public List<JsonObject> RoomComments { get; set; } = new();
+	public JsonObject? CommunityBoard { get; set; }
+	public List<JsonObject> ModerationReports { get; set; } = new();
+	public List<JsonObject> PlayerEvents { get; set; } = new();
+}

Server/Admin/AdminProfileAPI.cs

@@ -0,0 +1,477 @@
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Cors;
+using Microsoft.EntityFrameworkCore;
+using System.Text.Json;
+using RadicadeServer.API.Notifications;
+using RadicadeServer.Auth;
+using RadicadeServer.DB;
+using RadicadeServer.Extensions;
+using RadicadeServer.Radicade.Discord;
+using RadicadeServer.RecNet.Accounts;
+using RadicadeServer.RecNet.Auth;
+using RadicadeServer.RecNet.Enums.Messages;
+using RadicadeServer.RecNet.Enums.Moderation;
+using RadicadeServer.RecNet.Enums.Players;
+using RadicadeServer.RecNet.Messages;
+using RadicadeServer.RecNet.Moderation;
+using RadicadeServer.RecNet.Notifications;
+using RadicadeServer.RecNet.Rooms;
+using RadicadeServer.Utils;
+
+namespace RadicadeServer.Admin
+{
+	[Route("admin/profiles")]
+	[EnableCors("AdminPanel")]
+	public class AdminProfileAPI(RecDBContext db) : Controller
+	{
+		private Task<IActionResult?> RejectInvalidKey(string key)
+		{
+			return Task.FromResult<IActionResult?>(key.IsAdminKey() ? null : Unauthorized("Invalid secret"));
+		}
+
+		private async Task NotifyUser(long playerId)
+		{
+			var profile = await db.Profiles.FirstOrDefaultAsync(x => x.accountId == playerId);
+			if (profile == null)
+				return;
+
+			var plrData = await db.Players.FirstOrDefaultAsync(x => x.AccountId == playerId);
+			if (plrData == null)
+				return;
+
+			await Notify.SendNotify(playerId, new Notification
+			{
+				Id = "AccountUpdate",
+				Msg = profile
+			});
+			await Notify.UpdateSubscriptions(playerId, Notifs.SubscriptionUpdateProfile, profile);
+
+			await Notify.SendNotify(playerId, new Notification
+			{
+				Id = "SelfAccountUpdate",
+				Msg = new SelfAccount
+				{
+					juniorState = plrData.Birthday != null && plrData.Birthday.Value.Year > 1900
+						? JuniorState.BasedOnBirthday : JuniorState.PendingOverride,
+					accountId = playerId,
+					parentAccountId = plrData.Parent,
+					availableUsernameChanges = 99,
+					bio = profile.bio,
+					displayName = profile.displayName,
+					email = plrData.Email,
+					createdAt = profile.createdAt,
+					isJunior = profile.isJunior,
+					phone = plrData.Phone,
+					platforms = profile.platforms,
+					profileImage = profile.profileImage,
+					username = profile.username
+				}
+			});
+		}
+		[HttpGet("whitelist")]
+		public async Task<IActionResult> WhitelistUser([FromQuery] string key, [FromQuery] long playerId)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+
+			var profile = await db.Profiles.FirstOrDefaultAsync(x => x.accountId == playerId);
+			if (profile == null) return NotFound();
+
+			var cachedLogins = await db.CachedLogins.Where(x => x.accountId == playerId).ToListAsync();
+
+			string addedIds = "";
+			List<string> ids = new();
+			foreach (var cached in cachedLogins)
+			{
+				if (cached.platform != Platforms.Steam) continue;
+				if (!SteamWhitelist.Contains(cached.platformId))
+				{
+					SteamWhitelist.Add(cached.platformId);
+					addedIds += cached.platformId + ",";
+					ids.Add(cached.platformId);
+				}
+			}
+
+			addedIds = addedIds.Trim().TrimEnd(',');
+
+			return Ok($"Whitelisted @{profile.username}! Added Steam IDs: {addedIds}");
+		}
+		[HttpGet("whitelist/toggle")]
+		public async Task<IActionResult> ToggleWhitelist([FromQuery] string key, [FromQuery] bool enabled)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+
+			SteamWhitelist.Enabled = enabled;
+
+			return Ok(enabled
+				? "Steam whitelist is now ENABLED. Only approved Steam IDs can sign in.\nConfig: " + SteamWhitelist.FilePath
+				: "Steam whitelist is now DISABLED. Anyone can sign in.");
+		}
+		[HttpGet("whitelist/list")]
+		public async Task<IActionResult> GetWhitelist([FromQuery] string key)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+
+			return Ok($"Whitelist {(SteamWhitelist.Enabled ? "ENABLED" : "disabled")} ({SteamWhitelist.SteamIds.Count} IDs)\nFilename: {SteamWhitelist.FilePath}\n```json\n{new SteamWhitelist.WhitelistFile { Enabled = SteamWhitelist.Enabled, SteamIds = SteamWhitelist.SteamIds.ToList() }.ToJson()}\n```");
+		}
+		[HttpGet("whitelist/add")]
+		public async Task<IActionResult> AddWhitelistId([FromQuery] string key, [FromQuery] string steamId)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+			if (string.IsNullOrWhiteSpace(steamId)) return BadRequest("No steamId given.");
+
+			var added = SteamWhitelist.Add(steamId);
+			return Ok(added
+				? $"Steam ID {steamId} was added to the whitelist."
+				: $"Steam ID {steamId} is already on the whitelist.");
+		}
+		[HttpGet("whitelist/remove")]
+		public async Task<IActionResult> RemoveWhitelistId([FromQuery] string key, [FromQuery] string steamId)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+			if (string.IsNullOrWhiteSpace(steamId)) return BadRequest("No steamId given.");
+
+			var removed = SteamWhitelist.Remove(steamId);
+			return Ok(removed
+				? $"Steam ID {steamId} was removed from the whitelist."
+				: $"Steam ID {steamId} is not on the whitelist.");
+		}
+		[HttpGet("set/uname")]
+		public async Task<IActionResult> SetUsername([FromQuery] string key, [FromQuery] long playerId, [FromQuery] string newName)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+
+			var profile = await db.Profiles.FirstOrDefaultAsync(x => x.accountId == playerId);
+			if (profile == null) return NotFound();
+
+			profile.username = newName;
+
+			await db.SaveChangesAsync();
+			await NotifyUser(profile.accountId);
+
+			return Ok("Updated profile!\n```json" + profile.ToJson() + "```");
+		}
+		[HttpGet("set/dname")]
+		public async Task<IActionResult> SetDisplayName([FromQuery] string key, [FromQuery] long playerId, [FromQuery] string newName)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+
+			var profile = await db.Profiles.FirstOrDefaultAsync(x => x.accountId == playerId);
+			if (profile == null) return NotFound();
+
+			profile.displayName = newName;
+
+			await db.SaveChangesAsync();
+			await NotifyUser(profile.accountId);
+
+			return Ok("Updated profile!\n```json" + profile.ToJson() + "```");
+		}
+		[HttpGet("set/image")]
+		public async Task<IActionResult> SetProfileImage([FromQuery] string key, [FromQuery] long playerId, [FromQuery] string imgName)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+
+			var profile = await db.Profiles.FirstOrDefaultAsync(x => x.accountId == playerId);
+			if (profile == null) return NotFound();
+
+			profile.profileImage = imgName;
+
+			await db.SaveChangesAsync();
+			await NotifyUser(profile.accountId);
+
+			return Ok("Updated profile!\n```json" + profile.ToJson() + "```");
+		}
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+		[HttpGet("profiles/{profileId}")]
+		public async Task<IActionResult> GetRoom([FromQuery] string key, long profileId)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+
+			var profile = await db.Profiles.FirstOrDefaultAsync(x => x.accountId == profileId);
+			if (profile == null) return NotFound();
+			return Ok(profile);
+		}
+		[HttpGet("ban")]
+		public async Task<IActionResult> BanUser([FromQuery] string key, [FromQuery] long userId, [FromQuery] ReportCategory category, [FromQuery] int duration, [FromQuery] string reason)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+
+			var profile = await db.Profiles.FirstOrDefaultAsync(x => x.accountId == userId);
+			if (profile == null) return NotFound("User does not exist.");
+
+			bool didBan = false;
+
+
+			DateTime banExpiry = DateTime.MaxValue;
+			string appealCode = string.Empty;
+			var existingModeration = await db.Moderation.FirstOrDefaultAsync(x => x.PlayerId == userId && x.IsBan);
+			if (existingModeration != null)
+			{
+				if (duration > 0)
+				{
+
+					var expireTime = DateTime.UtcNow.AddMinutes(duration);
+					existingModeration.ExpireDuration = expireTime;
+					existingModeration.Message = reason;
+					existingModeration.Category = category;
+					existingModeration.IsBan = true;
+					didBan = true;
+					banExpiry = expireTime;
+				}
+				else if (duration == -1)
+				{
+
+					existingModeration.ExpireDuration = DateTime.MaxValue;
+					existingModeration.Message = reason;
+					existingModeration.Category = category;
+					existingModeration.IsBan = true;
+					didBan = true;
+					banExpiry = DateTime.MaxValue;
+				}
+				else
+				{
+					db.Moderation.Remove(existingModeration);
+					didBan = false;
+					
+
+
+
+					await Notify.SendNotify(userId, new Notification { Id = NotificationType.RefreshLogin, Msg = profile });
+					
+					await PlayerUtils.ReleaseModerationHoldAsync(userId);
+				}
+			}
+			else
+			{
+				if (duration > 0)
+				{
+
+
+
+					var expireTime = DateTime.UtcNow.AddMinutes(duration);
+					var (newCode, _) = await PlayerUtils.GetAppealForNewBanAsync(db, userId);
+					var newModeration = new ModerationDB
+					{
+						Category = category,
+						ExpireDuration = expireTime,
+						IsBan = true,
+						Message = reason,
+						PlayerId = userId,
+						AppealCode = newCode
+					};
+					await db.Moderation.AddAsync(newModeration);
+					appealCode = newCode ?? string.Empty;
+					didBan = true;
+					banExpiry = expireTime;
+				}
+				else if (duration == -1)
+				{
+
+					var expireTime = DateTime.MaxValue;
+					var (newCode, _) = await PlayerUtils.GetAppealForNewBanAsync(db, userId);
+					var newModeration = new ModerationDB
+					{
+						Category = category,
+						ExpireDuration = expireTime,
+						IsBan = true,
+						Message = reason,
+						PlayerId = userId,
+						AppealCode = newCode
+					};
+					await db.Moderation.AddAsync(newModeration);
+					appealCode = newCode ?? string.Empty;
+					didBan = true;
+					banExpiry = expireTime;
+				}
+			}
+
+
+
+			if (didBan)
+			{
+
+
+
+
+
+
+				var activeBan = existingModeration ?? await db.Moderation.FirstOrDefaultAsync(x => x.PlayerId == userId && x.IsBan);
+				if (activeBan != null && string.IsNullOrWhiteSpace(activeBan.AppealCode))
+				{
+					var (newCode, _) = await PlayerUtils.GetAppealForNewBanAsync(db, userId);
+					activeBan.AppealCode = newCode;
+					appealCode = newCode ?? string.Empty;
+				}
+				else if (string.IsNullOrWhiteSpace(appealCode) && activeBan != null)
+				{
+					appealCode = activeBan.AppealCode ?? string.Empty;
+				}
+
+				await db.VoteKicks.AddAsync(new VoteKickLog
+				{
+					PlayerId = userId,
+					Reason = reason,
+					Category = category,
+					IsForce = true,
+					CreatedAt = DateTime.UtcNow,
+					ExpiresAt = banExpiry
+				});
+
+
+
+				var rep = await db.Reputations.FirstOrDefaultAsync(x => x.AccountId == userId);
+				if (rep != null)
+					rep.ApplyBanPenalty(permanent: duration == -1, cheating: false);
+			}
+
+			await db.SaveChangesAsync();
+
+
+
+
+			if (didBan)
+			{
+				await AdminActionDiscord.LogBanAsync(db, userId,
+					bannedBy: "Admin (Profile API)",
+					causedByReports: false,
+					reason: reason,
+					category: category,
+					expiry: banExpiry,
+					isModerator: false);
+			}
+
+
+
+
+
+
+
+			if (didBan)
+			{
+				var banStart = (await db.Moderation.AsNoTracking().FirstOrDefaultAsync(x => x.PlayerId == userId && x.IsBan))?.CreatedAt;
+				await PlayerUtils.KickOrPromptAsync(db, userId, PlayerUtils.BuildBlockDetails(true, category, reason, banExpiry, appealCode: appealCode, startedAtUtc: banStart ?? DateTime.UtcNow));
+			}
+
+			if (didBan)
+			{
+
+				return Ok(duration == -1
+					? $"Successfully banned @{profile.username} permanently!"
+					: $"Successfully banned @{profile.username} for {duration} minutes!");
+			}
+			else
+				return Ok($"Successfully unbanned @{profile.username}!");
+		}
+
+		[HttpGet("coach")]
+		public async Task<IActionResult> SendCoachMessage([FromQuery] string key, [FromQuery] long userId, [FromQuery] string message)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+
+			var profile = await db.Profiles.FirstOrDefaultAsync(x => x.accountId == userId);
+			if (profile == null) return NotFound("User does not exist.");
+
+
+
+
+			await Notify.SendMessage(userId, new Message
+			{
+				Type = MessageType.CoachMessage,
+				Data = message,
+				FromPlayerId = 1
+			});
+
+			return Ok($"Successfully sent coach message to @{profile.username}!");
+		}
+
+		[HttpGet("coach/all")]
+		public async Task<IActionResult> SendCoachMessageToAll([FromQuery] string key, [FromQuery] string message)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+
+			var profiles = await db.Profiles.ToListAsync();
+			long playerCount = 0;
+			foreach (var profile in profiles)
+			{
+
+				if (profile.accountId == 1) continue;
+
+				await Notify.SendMessage(profile.accountId, new Message
+				{
+					Type = MessageType.CoachMessage,
+					Data = message,
+					FromPlayerId = 1
+				});
+				playerCount++;
+			}
+
+			return Ok($"Successfully sent coach message to {playerCount} players!");
+		}
+
+		[HttpGet("forcequit")]
+		public async Task<IActionResult> ForceQuitPlayer([FromQuery] string key, [FromQuery] long userId)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+
+			var profile = await db.Profiles.FirstOrDefaultAsync(x => x.accountId == userId);
+			if (profile == null) return NotFound("User does not exist.");
+
+
+
+			Notify.SendReliably(userId, new Notification { Id = NotificationType.ModerationQuitGame, Msg = "" },
+				TimeSpan.FromSeconds(10), TimeSpan.FromSeconds(1), Notify.EmptyObjectPayload(NotificationType.ModerationQuitGame));
+
+
+			var presence = await db.Presences.FirstOrDefaultAsync(x => x.playerId == userId);
+			if (presence != null)
+			{
+				presence.isOnline = false;
+				presence.roomInstance = null;
+				presence.LoginLock = null;
+				await db.SaveChangesAsync();
+			}
+
+			return Ok($"Successfully force quit @{profile.username}!");
+		}
+	}
+}

Server/Admin/AdminRoomAPI.cs

@@ -0,0 +1,1042 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Cors;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using System.Data;
+using System.IO;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using RadicadeServer.API.Notifications;
+using RadicadeServer.DB;
+using RadicadeServer.Extensions;
+using RadicadeServer.RecNet;
+using RadicadeServer.RecNet.Accounts;
+using RadicadeServer.RecNet.Auth;
+using RadicadeServer.RecNet.Enums;
+using RadicadeServer.RecNet.Enums.Messages;
+using RadicadeServer.RecNet.Enums.Moderation;
+using RadicadeServer.RecNet.Enums.Rooms;
+using RadicadeServer.RecNet.Notifications;
+using RadicadeServer.RecNet.Progression;
+using RadicadeServer.RecNet.Responses;
+using RadicadeServer.RecNet.Rooms;
+using RadicadeServer.Utils;
+
+namespace RadicadeServer.Admin
+{
+	[Route("admin/rooms")]
+	[EnableCors("AdminPanel")]
+	public class AdminRoomAPI(RecDBContext db) : Controller
+	{
+		private Task<IActionResult?> RejectInvalidKey(string key)
+		{
+			return Task.FromResult<IActionResult?>(key.IsAdminKey() ? null : Unauthorized("Invalid secret"));
+		}
+
+		[HttpGet("room/{roomId}")]
+		public async Task<IActionResult> GetRoom([FromQuery] string key, long roomId)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+
+			var room = await RoomUtils.GetRoom(roomId);
+			if (room == null) return NotFound();
+
+			return Ok(room);
+		}
+
+		[HttpPost("create/room")]
+		public async Task<IActionResult> CreateRoom([FromQuery] string key, [FromQuery] long newOwner, [FromBody] JsonNode fullRoom)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+
+			var roomData = new RoomData
+			{
+				EncryptVoiceChat = fullRoom.Get("EncryptVoiceChat", false),
+				Accessibility = fullRoom.Get("Accessibility", Accessibility.Private),
+				CloningAllowed = fullRoom.Get("CloningAllowed", false),
+
+				CreatedAt = fullRoom["CreatedAt"]?.GetValue<DateTime>() ?? DateTime.UtcNow,
+
+				CreatorAccountId = newOwner,
+				CustomWarning = fullRoom.Get("CustomWarning", ""),
+				Description = fullRoom.Get("Description", ""),
+
+				DisableMicAutoMute = fullRoom.Get("DisableMicAutoMute", false),
+				DisableRoomComments = fullRoom.Get("DisableRoomComments", false),
+
+				ImageName = fullRoom.Get("ImageName", ""),
+
+				IsDorm = fullRoom.Get("IsDorm", false),
+				IsRRO = fullRoom.Get("IsRRO", false),
+
+				IsDeveloperOwned = fullRoom["IsDeveloperOwned"] != null
+					? fullRoom.Get("IsDeveloperOwned", false)
+					: await db.IsDeveloper(newOwner),
+
+				loadScreen = fullRoom["LoadScreens"]?.ToJson() ?? "[]",
+
+				MaxPlayerCalculationMode = fullRoom.Get("MaxPlayerCalculationMode", MaxPlayerMode.AllSubrooms),
+				MaxPlayers = fullRoom.Get("MaxPlayers", 10),
+				MinLevel = fullRoom.Get("MinLevel", 0),
+
+				Name = fullRoom.Get("Name", ""),
+				State = fullRoom.Get("State", RoomState.Active),
+
+				SupportsJuniors = fullRoom.Get("SupportsJuniors", false),
+				SupportsLevelVoting = fullRoom.Get("SupportsLevelVoting", false),
+				SupportsMobile = fullRoom.Get("SupportsMobile", false),
+				SupportsQuest2 = fullRoom.Get("SupportsQuest2", false),
+				SupportsScreens = fullRoom.Get("SupportsScreens", false),
+				SupportsTeleportVR = fullRoom.Get("SupportsTeleportVR", false),
+				SupportsVRLow = fullRoom.Get("SupportsVRLow", false),
+				SupportsWalkVR = fullRoom.Get("SupportsWalkVR", false),
+
+				Tags = StringTools.CreateTagString(fullRoom.Get<List<ItemTag>>("Tags", [])),
+
+				Version = 1,
+				WarningMask = fullRoom.Get("WarningMask", WarningMask.None)
+			};
+
+			await db.Rooms.AddAsync(roomData);
+
+			await db.SaveChangesAsync();
+
+			foreach (var subRoom in fullRoom["SubRooms"]?.AsArray() ?? new JsonArray())
+			{
+				if (subRoom == null) continue;
+				var subRoomSceneId = subRoom["UnitySceneId"]?.ToString() ?? SceneLocations.MakerRoom;
+				if (!SceneLocations.IsValid(subRoomSceneId))
+					subRoomSceneId = SceneLocations.MakerRoom;
+
+				// A new room's subroom can arrive with its Unity bundle already uploaded,
+				// named exactly as it was imported (see UploadRoom).
+				var bundleName = subRoom["UnityAssetId"]?.ToString();
+				if (!string.IsNullOrWhiteSpace(bundleName))
+				{
+					if (!AdminUtils.TryResolveBundleName(bundleName, out var resolvedBundle, out var bundleError))
+						return BadRequest(bundleError);
+					bundleName = resolvedBundle;
+				}
+
+				await db.AddAsync(new SubRoom
+				{
+					Accessibility = (Accessibility)(subRoom["Accessibility"]?.GetValue<int>() ?? 0),
+					CreatedAt = subRoom["CreatedAt"]?.GetValue<DateTime>() ?? DateTime.UtcNow,
+					SavedByAccountId = newOwner,
+					IsSandbox = subRoom["IsSandbox"]?.GetValue<bool>() ?? false,
+					MaxPlayers = subRoom["MaxPlayers"]?.GetValue<int>() ?? 0,
+					Name = subRoom["Name"]?.ToString() ?? "",
+					RoomId = roomData.RoomId,
+					UnitySceneId = subRoomSceneId,
+					DataBlob = subRoom["DataBlob"]?.ToString() ?? "",
+					UnityAssetId = bundleName ?? "",
+				});
+			}
+
+			await db.RoomRoles.AddAsync(new RoomRole
+			{
+				AccountId = newOwner,
+				InvitedRole = RoleType.None,
+				Role = RoleType.Creator,
+				RoomId = roomData.RoomId
+			});
+
+			await db.SaveChangesAsync();
+
+			return Ok($"Created as {roomData.RoomId}!");
+		}
+
+		[HttpGet("rename/room")]
+		public async Task<IActionResult> RenameRoom([FromQuery] string key, [FromQuery] long roomId, [FromQuery] string newName)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+
+			var room = await db.Rooms.FirstOrDefaultAsync(x => x.RoomId == roomId);
+			if (room == null) return NotFound("Room does not exist.");
+
+			room.Name = newName;
+
+			await db.SaveChangesAsync();
+
+			return Ok($"Changed to ^{newName}!");
+		}
+
+		[HttpGet("delete/room")]
+		public async Task<IActionResult> DeleteRoom([FromQuery] string key, [FromQuery] long roomId)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+
+			var room = await db.Rooms.FirstOrDefaultAsync(x => x.RoomId == roomId);
+			if (room == null) return NotFound("Room does not exist.");
+
+			if (room.IsRRO || room.IsDorm || room.CreatorAccountId == 1) return Ok("You cannot delete RROs.");
+
+			db.Rooms.Remove(room);
+			await db.SaveChangesAsync();
+
+			return Ok($"Deleted.");
+		}
+
+		[HttpGet("set/datablob")]
+		public async Task<IActionResult> SetDatablob([FromQuery] string key, [FromQuery] long roomId, [FromQuery] string subRoomName, [FromQuery] string datablobName)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+
+			var subRoom = await db.SubRooms.FirstOrDefaultAsync(x => x.RoomId == roomId && x.Name == subRoomName);
+			if (subRoom == null) return NotFound("Subroom not found.");
+
+			subRoom.DataBlob = datablobName;
+
+			await db.SaveChangesAsync();
+
+			return Ok($"Set datablob to {datablobName} for {subRoom.Name}!");
+		}
+
+		// The other half of importing a subroom: its .assetbundle. The file name is
+		// the asset id - RoomServerAPI serves /rooms/unity_assets/<name> out of the CDN
+		// by that name - so binding means pointing the subroom at an uploaded bundle,
+		// and an empty name clears it again. BindAssetBundle below is the narrower,
+		// Studio-side counterpart for 40-character manifest ids; this one takes the
+		// '<name>.assetbundle' files an import actually produces.
+		[HttpGet("set/bundle")]
+		public async Task<IActionResult> SetBundle([FromQuery] string key, [FromQuery] long roomId, [FromQuery] string subRoomName, [FromQuery] string bundleName)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+
+			var subRoom = await db.SubRooms.FirstOrDefaultAsync(x => x.RoomId == roomId && x.Name == subRoomName);
+			if (subRoom == null) return NotFound("Subroom not found.");
+
+			if (string.IsNullOrWhiteSpace(bundleName))
+			{
+				subRoom.UnityAssetId = "";
+				await db.SaveChangesAsync();
+				return Ok($"Cleared the Unity bundle for {subRoom.Name}!");
+			}
+
+			if (!AdminUtils.TryResolveBundleName(bundleName, out var resolvedBundle, out var bundleError))
+				return BadRequest(bundleError);
+
+			subRoom.UnityAssetId = resolvedBundle ?? "";
+
+			await db.SaveChangesAsync();
+
+			return Ok($"Set bundle to {subRoom.UnityAssetId} for {subRoom.Name}!");
+		}
+
+		[HttpPost("create/subroom")]
+		public async Task<IActionResult> CreateSubRoom([FromQuery] string key, [FromQuery] long roomId, [FromBody] JsonNode subRoom)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+
+			var room = await db.Rooms.FirstOrDefaultAsync(x => x.RoomId == roomId);
+			if (room == null) return NotFound("Room does not exist.");
+
+			var name = (subRoom.Get("Name", "") ?? "").Trim();
+			if (string.IsNullOrWhiteSpace(name)) return BadRequest("Subroom name is required.");
+
+			if (await db.SubRooms.AnyAsync(x => x.RoomId == roomId && x.Name == name))
+				return BadRequest($"A subroom named \"{name}\" already exists in this room.");
+
+			// The Unity bundle the subroom loads, if one was imported alongside the save.
+			var bundleName = subRoom.Get("UnityAssetId", "") ?? "";
+			if (!string.IsNullOrWhiteSpace(bundleName))
+			{
+				if (!AdminUtils.TryResolveBundleName(bundleName, out var resolvedBundle, out var bundleError))
+					return BadRequest(bundleError);
+				bundleName = resolvedBundle ?? "";
+			}
+
+			var mainSubRoom = await db.SubRooms.FirstOrDefaultAsync(x => x.RoomId == roomId);
+
+			var maxPlayers = subRoom.Get("MaxPlayers", mainSubRoom?.MaxPlayers ?? 10);
+			if (maxPlayers <= 0) maxPlayers = mainSubRoom?.MaxPlayers ?? 10;
+
+			var unitySceneId = subRoom.Get("UnitySceneId", "");
+			if (string.IsNullOrWhiteSpace(unitySceneId))
+				unitySceneId = mainSubRoom?.UnitySceneId ?? "a75f7547-79eb-47c6-8986-6767abcb4f92";
+
+			var dbSubRoom = new SubRoom
+			{
+				Accessibility = (Accessibility)(subRoom["Accessibility"]?.GetValue<int>() ?? (int)Accessibility.Public),
+				CreatedAt = subRoom.Get("CreatedAt", DateTime.UtcNow),
+				SavedByAccountId = room.CreatorAccountId,
+				IsSandbox = subRoom.Get("IsSandbox", true),
+				MaxPlayers = maxPlayers,
+				Name = name,
+				RoomId = roomId,
+				UnitySceneId = unitySceneId,
+				DataBlob = subRoom.Get("DataBlob", ""),
+				UnityAssetId = bundleName,
+			};
+
+			await db.AddAsync(dbSubRoom);
+			await db.SaveChangesAsync();
+
+			return Ok($"Created as {dbSubRoom.SubRoomId}!");
+		}
+
+		[HttpGet("rename/subroom")]
+		public async Task<IActionResult> RenameSubRoom([FromQuery] string key, [FromQuery] long roomId, [FromQuery] long subRoomId, [FromQuery] string newName)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+
+			var subRoom = await db.SubRooms.FirstOrDefaultAsync(x => x.SubRoomId == subRoomId && x.RoomId == roomId);
+			if (subRoom == null) return NotFound("Subroom not found.");
+
+			newName = (newName ?? "").Trim();
+			if (string.IsNullOrWhiteSpace(newName)) return BadRequest("Subroom name is required.");
+
+			if (await db.SubRooms.AnyAsync(x => x.RoomId == roomId && x.SubRoomId != subRoomId && x.Name == newName))
+				return BadRequest($"A subroom named \"{newName}\" already exists in this room.");
+
+			subRoom.Name = newName;
+
+			await db.SaveChangesAsync();
+
+			return Ok($"Renamed to {newName}!");
+		}
+
+		[HttpGet("delete/subroom")]
+		public async Task<IActionResult> DeleteSubRoom([FromQuery] string key, [FromQuery] long roomId, [FromQuery] long subRoomId)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+
+			var subRoom = await db.SubRooms.FirstOrDefaultAsync(x => x.SubRoomId == subRoomId && x.RoomId == roomId);
+			if (subRoom == null) return NotFound("Subroom not found.");
+
+
+			var subroomCount = await db.SubRooms.CountAsync(x => x.RoomId == roomId);
+			if (subroomCount <= 1) return BadRequest("A room must keep at least one subroom.");
+
+			var history = await db.SubRoomHistory.Where(x => x.RoomId == roomId && x.SubRoomId == subRoomId).ToListAsync();
+			foreach (var historyItem in history)
+				db.SubRoomHistory.Remove(historyItem);
+
+			db.SubRooms.Remove(subRoom);
+
+			await db.SaveChangesAsync();
+
+			return Ok($"Deleted {subRoom.Name}!");
+		}
+
+		[HttpPost("rooms/{roomId:long}/subrooms/{subRoomId:long}/assetbundle")]
+		public async Task<IActionResult> BindAssetBundle([FromQuery] string key, long roomId, long subRoomId,
+			[FromBody] string assetId)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+			if (!ModelState.IsValid || !RadicadeServer.API.Studio.StudioUnityAssetRegistry.IsValidAssetId(assetId))
+				return BadRequest("Expected a 40-character Unity asset ID.");
+
+			var subRoom = await db.SubRooms.FirstOrDefaultAsync(x => x.RoomId == roomId && x.SubRoomId == subRoomId);
+			if (subRoom == null) return NotFound("Subroom not found in this room.");
+
+
+
+			if (!System.IO.File.Exists(Path.Join(DBConfig.CDNStorage, assetId + ".assetbundle")))
+				return BadRequest("Upload the bundle as <assetId>.assetbundle before linking it.");
+			if (System.IO.File.Exists(Path.Join(DBConfig.CDNStorage, assetId)))
+				return BadRequest("This ID belongs to a Studio manifest; choose an ID for the archived bundle.");
+
+			var previousAssetId = subRoom.UnityAssetId;
+			subRoom.UnityAssetId = assetId;
+			await db.SaveChangesAsync();
+			return Ok(new { RoomId = roomId, SubRoomId = subRoomId, PreviousUnityAssetId = previousAssetId, UnityAssetId = assetId });
+		}
+
+		[HttpPost("upload/datablob")]
+		[RequestSizeLimit(256L * 1024 * 1024)]
+		public async Task<IActionResult> UploadDatablob([FromQuery] string key, [FromQuery] string name, [FromForm] IFormFile file)
+		{
+
+			if (!ModelState.IsValid) return BadRequest("Invalid upload request. Use a multipart form no larger than 256 MiB.");
+
+		var rejection = await RejectInvalidKey(key);
+		if (rejection != null) return rejection;
+
+			var path = Path.Join(DBConfig.CDNStorage, name);
+
+			using (var stream = new FileStream(path, FileMode.Create))
+			{
+				await file.CopyToAsync(stream);
+			}
+
+			return Ok($"Uploaded {name}!\nURL: {DBConfig.ServerUrl}/cdn/room/{name}");
+		}
+
+		[HttpPost("upload/image")]
+		public async Task<IActionResult> UploadImage([FromQuery] string key, [FromQuery] long roomId, [FromForm] IFormFile file)
+		{
+
+		var rejection = await RejectInvalidKey(key);
+		if (rejection != null) return rejection;
+
+			var room = await db.Rooms.FirstOrDefaultAsync(x => x.RoomId == roomId);
+			if (room == null) return NotFound("Room does not exist.");
+
+			if (file == null || file.Length == 0) return BadRequest("No file provided.");
+
+
+			var allowed = new[] { ".png", ".jpg", ".jpeg", ".gif", ".webp", ".bmp" };
+			var ext = Path.GetExtension(file.FileName).ToLowerInvariant();
+			if (string.IsNullOrEmpty(ext) || !allowed.Contains(ext))
+				return BadRequest($"Unsupported image format '{(string.IsNullOrEmpty(ext) ? "no extension" : ext)}'. Use png/jpg/jpeg/gif/webp.");
+
+			string guid = Guid.NewGuid().ToString();
+			var path = Path.Join(DBConfig.CDNImages, guid + ext);
+
+			using (var stream = new FileStream(path, FileMode.Create))
+			{
+				await file.CopyToAsync(stream);
+			}
+
+			room.ImageName = guid + ext;
+
+			await db.SaveChangesAsync();
+
+			return Ok($"Uploaded {guid}{ext}!\nURL: {DBConfig.ServerUrl}/images/img/{guid}{ext}");
+		}
+
+		[HttpGet("set/image")]
+		public async Task<IActionResult> SetImage([FromQuery] string key, [FromQuery] long roomId, [FromQuery] string imgName)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+
+			var room = await db.Rooms.FirstOrDefaultAsync(x => x.RoomId == roomId);
+			if (room == null) return NotFound("Room does not exist.");
+
+
+			imgName = Path.GetFileName(imgName ?? "").Trim();
+
+
+			room.ImageName = imgName;
+
+			await db.SaveChangesAsync();
+
+			return Ok($"Set to {imgName}!\nURL: {DBConfig.ServerUrl}/images/img/{imgName}");
+		}
+
+		[HttpGet("set/role/{roleType}")]
+		public async Task<IActionResult> SetRoleOfUser([FromQuery] string key, [FromQuery] long roomId, [FromQuery] long target, RoleType roleType)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+
+			var existingRole = await db.RoomRoles.FirstOrDefaultAsync(x => x.AccountId == target && x.RoomId == roomId);
+
+			if (existingRole == null)
+			{
+				var newRole = new RoomRole
+				{
+					AccountId = target,
+					InvitedRole = RoleType.None,
+					Role = roleType,
+					RoomId = roomId
+				};
+
+				await db.RoomRoles.AddAsync(newRole);
+			}
+			else
+			{
+				if (existingRole.Role == roleType)
+					return Ok($"Player already has {Enum.GetName(roleType)}.");
+
+				existingRole.Role = roleType;
+			}
+
+			await db.SaveChangesAsync();
+
+			try
+			{
+				var updatedRoom = await RoomUtils.GetRoom(roomId);
+				if (updatedRoom != null)
+					await Notify.SendNotify(target, new Notification { Id = "RoomUpdate", Msg = updatedRoom });
+			}
+			catch (Exception) { }
+
+			return Ok($"Set to {Enum.GetName(roleType)}!");
+		}
+
+		[HttpGet("set/rro")]
+		public async Task<IActionResult> SetRRO([FromQuery] string key, [FromQuery] long roomId)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+
+			var room = await db.Rooms.FirstOrDefaultAsync(x => x.RoomId == roomId);
+			if (room == null) return NotFound("Room does not exist.");
+
+			room.IsRRO = true;
+			var tags = StringTools.ReadTags(room.Tags);
+			if (tags.FirstOrDefault(x => x.Tag == "rro" && x.Type == TagType.Auto) == null)
+				tags.Add(new ItemTag { Type = TagType.Auto, Tag = "rro" });
+			room.Tags = StringTools.CreateTagString(tags);
+
+			await db.SaveChangesAsync();
+
+			return Ok($"Set to RRO {room.Name}!");
+		}
+
+		[HttpGet("remove/rro")]
+		public async Task<IActionResult> RemoveRRO([FromQuery] string key, [FromQuery] long roomId)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+
+			var room = await db.Rooms.FirstOrDefaultAsync(x => x.RoomId == roomId);
+			if (room == null) return NotFound("Room does not exist.");
+
+			room.IsRRO = false;
+			var tags = StringTools.ReadTags(room.Tags);
+			var existingRROTag = tags.FirstOrDefault(x => x.Tag == "rro" && x.Type == TagType.Auto);
+			if (existingRROTag != null)
+				tags.Remove(existingRROTag);
+			room.Tags = StringTools.CreateTagString(tags);
+
+			await db.SaveChangesAsync();
+
+			return Ok($"Removed RRO from {room.Name}!");
+		}
+
+		[HttpGet("fulldelete/room")]
+		public async Task<IActionResult> FullyDeleteRoom([FromQuery] string key, [FromQuery] long roomId)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+
+			var room = await db.Rooms.FirstOrDefaultAsync(x => x.RoomId == roomId);
+			if (room == null) return NotFound("Room does not exist.");
+
+			if (room.IsRRO || room.IsDorm || room.CreatorAccountId == 1) return Ok("You cannot delete RROs.");
+
+			var roles = await db.RoomRoles.Where(x => x.RoomId == roomId).ToListAsync();
+			foreach (var role in roles)
+			{
+				db.RoomRoles.Remove(role);
+			}
+
+			var interactions = await db.RoomInteractions.Where(x => x.RoomId == roomId).ToListAsync();
+			foreach (var i in interactions)
+			{
+				db.RoomInteractions.Remove(i);
+			}
+
+			var keys = await db.RoomKeys.Where(x => x.RoomId == roomId).ToListAsync();
+			foreach (var k in keys)
+			{
+				db.RoomKeys.Remove(k);
+			}
+
+			var stats = await db.RoomStats.FirstOrDefaultAsync(x => x.RoomId == roomId);
+			if (stats != null)
+				db.RoomStats.Remove(stats);
+
+			var subrooms = await db.SubRooms.Where(x => x.RoomId == roomId).ToListAsync();
+			foreach (var subroom in subrooms)
+			{
+				db.SubRooms.Remove(subroom);
+			}
+
+			var prevSubrooms = await db.SubRoomHistory.Where(x => x.RoomId == roomId).ToListAsync();
+			foreach (var subroom in prevSubrooms)
+			{
+				db.SubRoomHistory.Remove(subroom);
+			}
+
+			await db.SaveChangesAsync();
+
+			return Ok("Deleted.");
+		}
+
+		[HttpGet("set/owner")]
+		public async Task<IActionResult> SetRoomOwner([FromQuery] string key, [FromQuery] long roomId, [FromQuery] long target)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+
+			var room = await db.Rooms.FirstOrDefaultAsync(x => x.RoomId == roomId);
+			if (room == null) return NotFound("Room does not exist.");
+
+			long oldOwnerId = room.CreatorAccountId;
+			room.CreatorAccountId = target;
+
+			var existingRole = await db.RoomRoles.FirstOrDefaultAsync(x => x.AccountId == target && x.RoomId == roomId);
+
+			if (existingRole == null)
+			{
+				var newRole = new RoomRole
+				{
+					AccountId = target,
+					InvitedRole = RoleType.None,
+					Role = RoleType.Creator,
+					RoomId = roomId
+				};
+
+				await db.RoomRoles.AddAsync(newRole);
+			}
+			else
+			{
+				existingRole.Role = RoleType.Creator;
+			}
+
+
+
+			if (oldOwnerId != target)
+			{
+				var oldOwnerRole = await db.RoomRoles.FirstOrDefaultAsync(x => x.AccountId == oldOwnerId && x.RoomId == roomId);
+				if (oldOwnerRole != null && oldOwnerRole.Role == RoleType.Creator)
+					oldOwnerRole.Role = RoleType.CoOwner;
+			}
+
+			await db.SaveChangesAsync();
+
+			return Ok($"Set to owner!");
+		}
+
+
+
+
+
+		[HttpGet("instances/live")]
+		public async Task<IActionResult> GetLiveRoomInstances([FromQuery] string key)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+
+			var instances = await db.RoomInstances.ToListAsync();
+			var roomIds = instances.Select(i => i.roomId).Distinct().ToList();
+			var rooms = roomIds.Count > 0
+				? await db.Rooms.Where(r => roomIds.Contains(r.RoomId)).ToDictionaryAsync(r => r.RoomId)
+				: new Dictionary<long, RoomData>();
+
+
+			var presences = await db.Presences.Where(p => p.isOnline && p.roomInstance != null).ToListAsync();
+			var profileIds = presences.Select(p => p.playerId).Distinct().ToList();
+			var profiles = profileIds.Count > 0
+				? await db.Profiles.Where(x => profileIds.Contains(x.accountId)).ToDictionaryAsync(x => x.accountId)
+				: new Dictionary<long, RadicadeServer.RecNet.Auth.Profile>();
+
+			var result = instances.Select(instance =>
+			{
+				var players = presences
+					.Where(p => p.roomInstance == instance.roomInstanceId)
+					.Select(p => new
+					{
+						player_id = p.playerId,
+						name = profiles.TryGetValue(p.playerId, out var profile) ? profile.displayName : $"Player {p.playerId}"
+					})
+					.OrderBy(p => p.player_id)
+					.ToList();
+
+				return new
+				{
+					instance_id = instance.roomInstanceId,
+					room_id = instance.roomId,
+					room_name = rooms.TryGetValue(instance.roomId, out var room) ? room.Name : "Unknown Room",
+					sub_room_id = instance.subRoomId,
+					event_id = instance.eventId,
+					instance_type = instance.roomInstanceType.ToString(),
+					location = instance.location ?? "",
+					room_code = instance.roomCode ?? "",
+					photon_room_id = instance.photonRoomId,
+					is_private = instance.isPrivate,
+					is_in_progress = instance.isInProgress,
+					is_full = instance.isFull,
+					max_capacity = instance.maxCapacity,
+					player_count = players.Count,
+					players
+				};
+			})
+			.OrderByDescending(i => i.player_count)
+			.ToList();
+
+			return Ok(new { count = result.Count, instances = result });
+		}
+
+
+
+
+
+		[HttpGet("instances/{instanceId:long}")]
+		public async Task<IActionResult> GetLiveInstanceDetail(long instanceId, [FromQuery] string key)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+
+			var instance = await db.RoomInstances.FirstOrDefaultAsync(x => x.roomInstanceId == instanceId);
+			if (instance == null) return NotFound("Instance not found.");
+
+			var room = await db.Rooms.FirstOrDefaultAsync(x => x.RoomId == instance.roomId);
+			var subrooms = await db.SubRooms.Where(s => s.RoomId == instance.roomId).ToListAsync();
+
+			var presences = await db.Presences.Where(p => p.isOnline && p.roomInstance == instanceId).ToListAsync();
+			var profileIds = presences.Select(p => p.playerId).Distinct().ToList();
+			var profiles = profileIds.Count > 0
+				? await db.Profiles.Where(x => profileIds.Contains(x.accountId)).ToDictionaryAsync(x => x.accountId)
+				: new Dictionary<long, Profile>();
+			var playerData = profileIds.Count > 0
+				? await db.Players.Where(x => profileIds.Contains(x.AccountId)).ToDictionaryAsync(x => x.AccountId)
+				: new Dictionary<long, PlayerData>();
+			var progression = profileIds.Count > 0
+				? await db.Progression.Where(x => profileIds.Contains(x.PlayerId)).ToDictionaryAsync(x => x.PlayerId)
+				: new Dictionary<long, ProgressionData>();
+
+			var playerRows = presences.Select(p =>
+			{
+				profiles.TryGetValue(p.playerId, out var profile);
+				playerData.TryGetValue(p.playerId, out var player);
+				progression.TryGetValue(p.playerId, out var progress);
+				return new
+				{
+					player_id = p.playerId,
+					name = profile?.displayName ?? $"Player {p.playerId}",
+					username = profile?.username ?? "",
+					level = progress?.Level ?? 0,
+					device_class = p.deviceClass.ToString(),
+					is_online = p.isOnline
+				};
+			}).OrderBy(p => p.player_id).ToList();
+
+			return Ok(new
+			{
+				instance = new
+				{
+					instance_id = instance.roomInstanceId,
+					room_id = instance.roomId,
+					room_name = room?.Name ?? "Unknown Room",
+					sub_room_id = instance.subRoomId,
+					instance_type = instance.roomInstanceType.ToString(),
+					location = instance.location ?? "",
+					room_code = instance.roomCode ?? "",
+					is_private = instance.isPrivate,
+					is_in_progress = instance.isInProgress,
+					is_full = instance.isFull,
+					max_capacity = instance.maxCapacity,
+					player_count = playerRows.Count
+				},
+				players = playerRows,
+				subrooms = subrooms.Select(s => new
+				{
+					sub_room_id = s.SubRoomId,
+					name = s.Name,
+					max_players = s.MaxPlayers
+				}).ToList()
+			});
+		}
+
+
+
+
+
+		[HttpPost("instances/{instanceId:long}/kick")]
+		public async Task<IActionResult> KickFromInstance(long instanceId, [FromQuery] string key, [FromQuery] long playerId, [FromQuery] string? reason = null)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+
+			var instance = await db.RoomInstances.FirstOrDefaultAsync(x => x.roomInstanceId == instanceId);
+			if (instance == null) return NotFound("Instance not found.");
+
+			var presence = await db.Presences.FirstOrDefaultAsync(x => x.playerId == playerId);
+			if (presence == null || presence.roomInstance != instanceId) return NotFound("Player is not in this instance.");
+
+
+			var dorm = await RoomUtils.GetOrCreateDorm(playerId);
+			RoomInstance? dormInstance = null;
+			if (dorm != null)
+				dormInstance = await MatchmakingUtils.CreateRoomInstance(dorm.RoomId, true, null, null, null);
+			if (dormInstance == null) return StatusCode(500, "Could not resolve a dorm instance for this player.");
+
+			presence.roomInstance = dormInstance.roomInstanceId;
+			presence.errorCode = JoinStatus.Success;
+			presence.isOnline = true;
+			MatchmakingUtils.MarkInRoom(playerId);
+
+			await RecomputeInstanceCapacity(instance);
+			await db.SaveChangesAsync();
+
+
+
+
+			try
+			{
+				await Notify.SendNotify(playerId, new Notification
+				{
+					Id = NotificationType.ModerationKick,
+					Msg = PlayerUtils.BuildBlockDetails(false, ReportCategory.Misc, reason ?? "Kicked from room", null, isHostKick: true)
+				});
+			}
+			catch (Exception) { }
+
+			try
+			{
+				await Notify.SendNotify(playerId, new Notification
+				{
+					Id = "PresenceUpdate",
+					Msg = await Presence.CreateAsync(db, presence, dormInstance)
+				});
+			}
+			catch (Exception) { }
+
+			var profile = await db.Profiles.FirstOrDefaultAsync(x => x.accountId == playerId);
+			return Ok(new
+			{
+				player_id = playerId,
+				name = profile?.displayName ?? $"Player {playerId}",
+				kicked = true,
+				instance_id = instanceId
+			});
+		}
+
+
+
+
+
+
+		[HttpPost("instances/{instanceId:long}/move")]
+		public async Task<IActionResult> MovePlayerToSubRoom(long instanceId, [FromQuery] string key, [FromQuery] long playerId, [FromQuery] long toSubRoomId)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+
+			var instance = await db.RoomInstances.FirstOrDefaultAsync(x => x.roomInstanceId == instanceId);
+			if (instance == null) return NotFound("Instance not found.");
+
+			var presence = await db.Presences.FirstOrDefaultAsync(x => x.playerId == playerId);
+			if (presence == null || presence.roomInstance != instanceId) return NotFound("Player is not in this instance.");
+
+
+
+			var subRoom = await db.SubRooms.FirstOrDefaultAsync(x => x.RoomId == instance.roomId && x.SubRoomId == toSubRoomId);
+			if (subRoom == null) return BadRequest("Target subroom does not belong to this room.");
+			if (instance.subRoomId == toSubRoomId)
+				return Ok(new { player_id = playerId, already_in_subroom = true, instance_id = instanceId });
+
+
+
+			var targetInstance = await db.RoomInstances
+				.FirstOrDefaultAsync(x => x.roomId == instance.roomId && x.subRoomId == toSubRoomId && !x.isFull);
+			bool created = false;
+			if (targetInstance == null)
+			{
+				targetInstance = await MatchmakingUtils.CreateRoomInstance(instance.roomId, instance.isPrivate, toSubRoomId, instance.clubId, instance.eventId);
+				if (targetInstance == null) return StatusCode(500, "Could not create the target subroom instance.");
+
+
+				db.RoomInstances.Attach(targetInstance);
+				created = true;
+			}
+
+			presence.roomInstance = targetInstance.roomInstanceId;
+			presence.errorCode = JoinStatus.Success;
+			presence.isOnline = true;
+			MatchmakingUtils.MarkInRoom(playerId);
+
+			await RecomputeInstanceCapacity(instance);
+			await RecomputeInstanceCapacity(targetInstance);
+			await db.SaveChangesAsync();
+
+			try
+			{
+				await Notify.SendNotify(playerId, new Notification
+				{
+					Id = "PresenceUpdate",
+					Msg = await Presence.CreateAsync(db, presence, targetInstance)
+				});
+			}
+			catch (Exception) { }
+
+			var profile = await db.Profiles.FirstOrDefaultAsync(x => x.accountId == playerId);
+			return Ok(new
+			{
+				player_id = playerId,
+				name = profile?.displayName ?? $"Player {playerId}",
+				instance_id = targetInstance.roomInstanceId,
+				sub_room_id = toSubRoomId,
+				created
+			});
+		}
+
+
+
+
+		private async Task RecomputeInstanceCapacity(RoomInstance instance)
+		{
+			var count = await MatchmakingUtils.GetPlayerCountInInstance(instance.roomInstanceId);
+			instance.isFull = count >= instance.maxCapacity;
+		}
+
+		[HttpGet("roles")]
+		public async Task<IActionResult> GetRoomRoles([FromQuery] string key, [FromQuery] long roomId)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+
+			var room = await db.Rooms.FirstOrDefaultAsync(x => x.RoomId == roomId);
+			if (room == null) return NotFound("Room does not exist.");
+
+			var roles = await db.RoomRoles.Where(x => x.RoomId == roomId).ToListAsync();
+			var accountIds = roles.Select(r => r.AccountId).Distinct().ToList();
+			var profiles = accountIds.Count > 0
+				? await db.Profiles.Where(x => accountIds.Contains(x.accountId)).ToDictionaryAsync(x => x.accountId)
+				: new Dictionary<long, RadicadeServer.RecNet.Auth.Profile>();
+
+			string? NameOf(long id) => profiles.TryGetValue(id, out var p)
+				? $"{p.displayName} (@{p.username})"
+				: id.ToString();
+
+			var result = roles.Select(r => new
+			{
+				account_id = r.AccountId,
+				name = NameOf(r.AccountId),
+				role = r.Role.ToString(),
+				role_value = (int)r.Role,
+				invited_role = r.InvitedRole.ToString(),
+				is_creator = r.AccountId == room.CreatorAccountId || r.Role == RoleType.Creator
+			}).ToList();
+
+
+			if (!result.Any(x => x.account_id == room.CreatorAccountId))
+			{
+				result.Insert(0, new
+				{
+					account_id = room.CreatorAccountId,
+					name = NameOf(room.CreatorAccountId),
+					role = "Creator",
+					role_value = (int)RoleType.Creator,
+					invited_role = "None",
+					is_creator = true
+				});
+			}
+
+			return Ok(new { room_id = roomId, creator_account_id = room.CreatorAccountId, roles = result });
+		}
+
+
+
+
+
+		[HttpGet("room/{roomId}/bans")]
+		public async Task<IActionResult> GetRoomBans([FromQuery] string key, long roomId)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+
+			var room = await db.Rooms.FirstOrDefaultAsync(x => x.RoomId == roomId);
+			if (room == null) return NotFound("Room does not exist.");
+
+
+			var bans = await db.RoomBans
+				.Where(x => x.roomId == roomId && (!x.expiresAt.HasValue || x.expiresAt.Value > DateTime.UtcNow))
+				.OrderByDescending(x => x.bannedAt)
+				.ToListAsync();
+
+			var ids = bans.Select(b => b.bannedPlayerId).Concat(bans.Select(b => b.actorId)).Distinct().ToList();
+			var profiles = ids.Count > 0
+				? await db.Profiles.AsNoTracking().Where(x => ids.Contains(x.accountId)).ToDictionaryAsync(x => x.accountId)
+				: new Dictionary<long, Profile>();
+
+			string? NameOf(long id) => profiles.TryGetValue(id, out var p) ? p.displayName : null;
+
+			var result = bans.Select(b => new
+			{
+				ban_id = b.BanId,
+				room_id = b.roomId,
+				player_id = b.bannedPlayerId,
+				player_name = NameOf(b.bannedPlayerId),
+				banned_by_id = b.actorId,
+				banned_by_name = string.IsNullOrWhiteSpace(b.bannedByName) ? (NameOf(b.actorId) ?? $"Player {b.actorId}") : b.bannedByName,
+				reason = b.reason,
+				banned_at = b.bannedAt,
+				expires_at = b.expiresAt
+			}).ToList();
+
+			return Ok(new { room_id = roomId, room_name = room.Name, count = result.Count, bans = result });
+		}
+
+
+
+
+
+
+		[HttpPost("room/{roomId}/bans")]
+		public async Task<IActionResult> BanPlayerFromRoom([FromQuery] string key, long roomId, [FromBody] JsonNode body)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+
+			var room = await db.Rooms.FirstOrDefaultAsync(x => x.RoomId == roomId);
+			if (room == null) return NotFound("Room does not exist.");
+
+			long playerId = body["player_id"]?.GetValue<long>() ?? 0;
+			if (playerId <= 0) return BadRequest("player_id is required.");
+
+			var profile = await db.Profiles.FirstOrDefaultAsync(x => x.accountId == playerId);
+			if (profile == null) return NotFound("Player does not exist.");
+
+			var existing = await db.RoomBans.FirstOrDefaultAsync(x => x.roomId == roomId && x.bannedPlayerId == playerId &&
+				(!x.expiresAt.HasValue || x.expiresAt.Value > DateTime.UtcNow));
+			if (existing != null) return Ok($"Player is already banned from this room.");
+
+			var reason = body["reason"]?.GetValue<string>()?.Trim() ?? "";
+			var ban = new RoomBan
+			{
+				roomId = roomId,
+				actorId = 1,
+				bannedPlayerId = playerId,
+				bannedByName = "Admin",
+				reason = reason,
+				bannedAt = DateTime.UtcNow,
+				expiresAt = null
+			};
+
+			await db.RoomBans.AddAsync(ban);
+			await db.SaveChangesAsync();
+
+
+			await MatchmakingUtils.KickPlayerFromRoom(playerId, roomId,
+				string.IsNullOrWhiteSpace(reason) ? "You were banned from this room." : $"You were banned from this room: {reason}");
+
+			return Ok(new
+			{
+				ban_id = ban.BanId,
+				room_id = roomId,
+				player_id = playerId,
+				player_name = profile.displayName,
+				reason = reason,
+				banned_at = ban.bannedAt
+			});
+		}
+
+
+
+
+		[HttpDelete("room/{roomId}/bans/{playerId}")]
+		public async Task<IActionResult> UnbanPlayerFromRoom([FromQuery] string key, long roomId, long playerId)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+
+			var room = await db.Rooms.FirstOrDefaultAsync(x => x.RoomId == roomId);
+			if (room == null) return NotFound("Room does not exist.");
+
+			var ban = await db.RoomBans.FirstOrDefaultAsync(x => x.roomId == roomId && x.bannedPlayerId == playerId);
+			if (ban == null) return NotFound("Player is not banned from this room.");
+
+			db.RoomBans.Remove(ban);
+			await db.SaveChangesAsync();
+
+			return Ok($"Ban lifted for player {playerId}.");
+		}
+	}
+}

Server/Admin/AdminRuntime.cs

@@ -0,0 +1,7 @@
+namespace RadicadeServer.Utils
+{
+	public static class AdminRuntime
+	{
+		public static readonly DateTime ServerStartedAtUtc = DateTime.UtcNow;
+	}
+}

Server/Admin/AdminStatusAPI.cs

@@ -0,0 +1,76 @@
+using Microsoft.AspNetCore.Cors;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using RadicadeServer.DB;
+using RadicadeServer.Utils;
+
+namespace RadicadeServer.Admin
+{
+	[Route("admin/status")]
+	[EnableCors("AdminPanel")]
+	public class AdminStatusAPI(RecDBContext db) : Controller
+	{
+		private Task<IActionResult?> RejectInvalidKey(string key)
+		{
+			return Task.FromResult<IActionResult?>(key.IsAdminKey() ? null : Unauthorized("Invalid secret"));
+		}
+
+		[HttpGet("players/active")]
+		public async Task<IActionResult> GetActivePlayerCount([FromQuery] string key)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+
+			var activePlayerCount = await db.Presences.CountAsync(x => x.isOnline);
+
+			return Ok(new
+			{
+				activePlayerCount
+			});
+		}
+
+		[HttpGet("")]
+		public async Task<IActionResult> GetServerStatus([FromQuery] string key)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+
+			var activePlayerCount = await db.Presences.CountAsync(x => x.isOnline);
+			var playersInRoomsCount = await db.Presences.CountAsync(x => x.isOnline && x.roomInstance != null);
+			var activeRoomInstanceCount = await db.RoomInstances.CountAsync();
+			var gameVersion = await db.ServerConfig
+				.Where(x => x.Key == "GameVersion")
+				.Select(x => x.Value)
+				.FirstOrDefaultAsync() ?? DBConfig.GameVersion;
+			var barrelVersion = await db.ServerConfig
+				.Where(x => x.Key == "BarrelVersion")
+				.Select(x => x.Value)
+				.FirstOrDefaultAsync();
+			var barrelKey = await db.ServerConfig
+				.Where(x => x.Key == "BarrelKey")
+				.Select(x => x.Value)
+				.FirstOrDefaultAsync();
+			var barrelCheck = await db.ServerConfig
+				.Where(x => x.Key == "BarrelCheck")
+				.Select(x => x.Value)
+				.FirstOrDefaultAsync();
+			var config = await db.Config.FirstOrDefaultAsync();
+
+			return Ok(new
+			{
+				status = "online",
+				serverUrl = DBConfig.ServerUrl,
+				activePlayerCount,
+				playersInRoomsCount,
+				activeRoomInstanceCount,
+				gameVersion,
+				barrelVersion,
+				barrelKey,
+				barrelCheck,
+				maintenance = config?.ServerMaintenance,
+				startedAtUtc = AdminRuntime.ServerStartedAtUtc,
+				uptimeSeconds = (long)(DateTime.UtcNow - AdminRuntime.ServerStartedAtUtc).TotalSeconds
+			});
+		}
+	}
+}

Server/Admin/AdminStorefrontsAPI.cs

@@ -0,0 +1,51 @@
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Cors;
+using Microsoft.EntityFrameworkCore;
+using RadicadeServer.DB;
+using RadicadeServer.RecNet.Store;
+using RadicadeServer.Utils;
+
+namespace RadicadeServer.Admin;
+
+[Route("admin/store")]
+[EnableCors("AdminPanel")]
+public class AdminStorefrontsAPI(RecDBContext db) : Controller
+{
+    private Task<IActionResult?> RejectInvalidKey(string key)
+    {
+        return Task.FromResult<IActionResult?>(key.IsAdminKey() ? null : Unauthorized("Invalid secret"));
+    }
+
+    [HttpGet("{key}/itemset/{itemSetId}")]
+    public async Task<IActionResult> GetItemSet(string key, long itemSetId)
+    {
+        var rejection = await RejectInvalidKey(key);
+        if (rejection != null) return rejection;
+        
+        return Ok("Item sets not implemented for GiftDropDB.");
+    }
+
+    [HttpGet("{key}/gift/{giftId}")]
+    public async Task<IActionResult> GetGift(string key, long giftId)
+    {
+        var rejection = await RejectInvalidKey(key);
+        if (rejection != null) return rejection;
+
+        var gift = await db.GiftItems.FirstOrDefaultAsync(x => x.GiftDropId == giftId);
+        if (gift == null) return Ok("Not found.");
+
+        return Ok(gift);
+    }
+
+    [HttpGet("{key}/gift/{giftId}/set")]
+    public async Task<ActionResult> SetGift()
+    {
+        return Ok("todo.");
+    }
+    
+    [HttpGet("{key}/gift/new")]
+    public async Task<ActionResult> CreateGift()
+    {
+        return Ok("todo.");
+    }
+}

Server/Admin/AdminUtils.cs

@@ -0,0 +1,122 @@
+using System.Security.Cryptography;
+using System.Text;
+using RadicadeServer.DB;
+
+namespace RadicadeServer.Utils
+{
+	public static class AdminUtils
+	{
+		/// <summary>
+		/// The ceiling every admin upload is held to, on the request and on the multipart form.
+		///
+		/// Kestrel's own default is 30 MB, and no room import fits under it: an .assetbundle or
+		/// a .room save routinely runs to tens or hundreds of megabytes. A route that does not
+		/// raise the limit has its connection killed part-way through the body, so the panel sees
+		/// a broken connection instead of an answer - which is what made importing a large room
+		/// look like an authentication failure. Named once here so the next upload route cannot
+		/// quietly forget it.
+		/// </summary>
+		public const long MaxUploadBytes = 256L * 1024 * 1024;
+
+		/// <summary>
+		/// A room file being assembled from parts lives beside its final name under this suffix
+		/// until the last part lands. Nothing serves or lists one, so a half-imported bundle can
+		/// never be fetched by the client, and a name ending in this suffix is refused outright.
+		/// </summary>
+		public const string PartSuffix = ".uploading";
+
+		/// The multipart ceiling this server answers with, in the words the panel shows an admin.
+		public const string MaxUploadLabel = "256 MiB";
+
+		public static bool IsUploadPart(string? name) =>
+			!string.IsNullOrEmpty(name) && name.EndsWith(PartSuffix, StringComparison.OrdinalIgnoreCase);
+
+		private static bool SecretMatches(string? given, string? stored)
+		{
+			if (string.IsNullOrEmpty(given) || string.IsNullOrEmpty(stored))
+				return false;
+
+			return CryptographicOperations.FixedTimeEquals(
+				Encoding.UTF8.GetBytes(given),
+				Encoding.UTF8.GetBytes(stored));
+		}
+
+		public static bool IsAdminKey(this string? key)
+		{
+			return SecretMatches(key, DBConfig.AdminApiKey);
+		}
+
+		public static bool IsSupportKey(this string? key)
+		{
+			return SecretMatches(key, DBConfig.AdminApiKey)
+				|| SecretMatches(key, DBConfig.SupportApiKey);
+		}
+
+		public static bool TryResolveUploadName(string? requested, out string? name, out string? error)
+		{
+			name = null;
+			error = null;
+
+			if (string.IsNullOrWhiteSpace(requested)) return true;
+
+			var trimmed = requested.Trim();
+
+			if (trimmed.Length > 128)
+			{
+				error = "Name is too long.";
+				return false;
+			}
+
+			if (trimmed != Path.GetFileName(trimmed) || trimmed.Contains(".."))
+			{
+				error = "Name must be a bare file name.";
+				return false;
+			}
+
+			foreach (var c in trimmed)
+			{
+				if (!char.IsLetterOrDigit(c) && c != '-' && c != '_' && c != '.')
+				{
+					error = "Name may only contain letters, digits, '-', '_' and '.'.";
+					return false;
+				}
+			}
+
+			name = trimmed;
+			return true;
+		}
+
+		/// A subroom's Unity bundle is served under the name it is stored as
+		/// (RoomServerAPI's unity_assets route hands the client that file name, and
+		/// the client then fetches it from the CDN by name), so binding accepts any
+		/// uploaded '<name>.assetbundle'. That is deliberately wider than
+		/// StudioUnityAssetRegistry.IsValidAssetId, which only covers the
+		/// 40-character manifest ids the Studio pipeline mints.
+		public static bool TryResolveBundleName(string? requested, out string? name, out string? error)
+		{
+			if (!TryResolveUploadName(requested, out name, out error)) return false;
+
+			if (name == null)
+			{
+				error = "A bundle file name is required.";
+				return false;
+			}
+
+			if (!name.EndsWith(".assetbundle", StringComparison.OrdinalIgnoreCase))
+			{
+				error = $"'{name}' is not a .assetbundle file.";
+				name = null;
+				return false;
+			}
+
+			if (!System.IO.File.Exists(Path.Join(DBConfig.CDNStorage, name)))
+			{
+				error = $"No uploaded bundle named '{name}'.";
+				name = null;
+				return false;
+			}
+
+			return true;
+		}
+	}
+}

Server/Admin/AdminVersionAPI.cs

@@ -0,0 +1,127 @@
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Cors;
+using Microsoft.EntityFrameworkCore;
+using Newtonsoft.Json.Linq;
+using RadicadeServer.DB;
+using RadicadeServer.RecNet.Config;
+using RadicadeServer.Utils;
+
+namespace RadicadeServer.Admin
+{
+	[Route("admin/version")]
+	[EnableCors("AdminPanel")]
+	public class AdminVersionAPI(RecDBContext db) : Controller
+	{
+		private Task<IActionResult?> RejectInvalidKey(string key)
+		{
+			return Task.FromResult<IActionResult?>(key.IsAdminKey() ? null : Unauthorized("Invalid secret"));
+		}
+
+		private async Task<IActionResult> SetServerConfigValue(string keyName, string key, string value)
+		{
+			var rejection = await RejectInvalidKey(key);
+			if (rejection != null) return rejection;
+
+			var existingValue = await db.ServerConfig.FirstOrDefaultAsync(x => x.Key == keyName);
+
+			if (existingValue != null)
+			{
+				existingValue.Value = value;
+			}
+			else
+			{
+				await db.ServerConfig.AddAsync(new ServerConfigVal { Key = keyName, Value = value });
+			}
+
+			await db.SaveChangesAsync();
+
+			return Ok("Set to: " + value);
+		}
+
+		[HttpGet("setgameversion")]
+		public async Task<IActionResult> SetGameVersion([FromQuery] string key, [FromQuery] string value)
+		{
+			return await SetServerConfigValue("GameVersion", key, value);
+		}
+		[HttpGet("setversion")]
+		public async Task<IActionResult> SetVersion([FromQuery] string key, [FromQuery] string value)
+		{
+			return await SetServerConfigValue("BarrelVersion", key, value);
+		}
+		[HttpGet("setkey")]
+		public async Task<IActionResult> SetKey([FromQuery] string key, [FromQuery] string value)
+		{
+			return await SetServerConfigValue("BarrelKey", key, value);
+		}
+		[HttpGet("setcheck")]
+		public async Task<IActionResult> SetCheck([FromQuery] string key, [FromQuery] string value)
+		{
+			return await SetServerConfigValue("BarrelCheck", key, value);
+		}
+		[HttpGet("setmanifestversion")]
+		public async Task<IActionResult> SetManifestVersion([FromQuery] string key, [FromQuery] string value)
+		{
+			return await SetServerConfigValue("ApprovedManifestVersion", key, value);
+		}
+		[HttpGet("setmanifestsha256")]
+		public async Task<IActionResult> SetManifestSha256([FromQuery] string key, [FromQuery] string value)
+		{
+			return await SetServerConfigValue("ApprovedManifestSha256", key, value);
+		}
+		[HttpGet("setgamedownloadurl")]
+		public async Task<IActionResult> SetGameDownloadUrl([FromQuery] string key, [FromQuery] string value)
+		{
+			return await SetServerConfigValue("GameDownloadUrl", key, value);
+		}
+		[HttpGet("setlaunchticket")]
+		public async Task<IActionResult> SetLaunchTicket([FromQuery] string key, [FromQuery] string value)
+		{
+			return await SetServerConfigValue("LaunchTicket", key, value);
+		}
+		[HttpGet("setlaunchticketrequired")]
+		public async Task<IActionResult> SetLaunchTicketRequired([FromQuery] string key, [FromQuery] bool value)
+		{
+			return await SetServerConfigValue("LaunchTicketRequired", key, value.ToString());
+		}
+		[HttpGet("setlaunchticketurl")]
+		public async Task<IActionResult> SetLaunchTicketUrl([FromQuery] string key, [FromQuery] string value)
+		{
+			return await SetServerConfigValue("LaunchTicketUrl", key, value);
+		}
+		[HttpGet("setlaunchticketaudience")]
+		public async Task<IActionResult> SetLaunchTicketAudience([FromQuery] string key, [FromQuery] string value)
+		{
+			return await SetServerConfigValue("LaunchTicketAudience", key, value);
+		}
+		[HttpGet("setlaunchticketnonce")]
+		public async Task<IActionResult> SetLaunchTicketNonce([FromQuery] string key, [FromQuery] string value)
+		{
+			return await SetServerConfigValue("LaunchTicketNonce", key, value);
+		}
+		[HttpGet("setgamepackagesha256")]
+		public async Task<IActionResult> SetGamePackageSha256([FromQuery] string key, [FromQuery] string value)
+		{
+			return await SetServerConfigValue("GamePackageSha256", key, value);
+		}
+		[HttpGet("setgamepackagesize")]
+		public async Task<IActionResult> SetGamePackageSize([FromQuery] string key, [FromQuery] long value)
+		{
+			return await SetServerConfigValue("GamePackageSize", key, value.ToString());
+		}
+		[HttpGet("setgameextractsubdirectory")]
+		public async Task<IActionResult> SetGameExtractSubdirectory([FromQuery] string key, [FromQuery] string value)
+		{
+			return await SetServerConfigValue("GameExtractSubdirectory", key, value);
+		}
+		[HttpGet("setlaunchermanifestnotes")]
+		public async Task<IActionResult> SetLauncherManifestNotes([FromQuery] string key, [FromQuery] string value)
+		{
+			return await SetServerConfigValue("LauncherManifestNotes", key, value);
+		}
+		[HttpGet("setlaunchermanifestdelete")]
+		public async Task<IActionResult> SetLauncherManifestDelete([FromQuery] string key, [FromQuery] string value)
+		{
+			return await SetServerConfigValue("LauncherManifestDelete", key, value);
+		}
+	}
+}

Server/Admin/RoomBanStore.cs

@@ -0,0 +1,201 @@
+using System.Text.Json;
+using Microsoft.EntityFrameworkCore;
+using RadicadeServer.API.Notifications;
+using RadicadeServer.DB;
+using RadicadeServer.RecNet.Enums.Messages;
+using RadicadeServer.RecNet.Messages;
+using RadicadeServer.RecNet.Rooms;
+
+namespace RadicadeServer.Admin;
+
+public static class RoomBanStore
+{
+	private static readonly JsonSerializerOptions JsonOptions = new() { WriteIndented = true };
+	private static readonly object FileLock = new();
+
+	private const long CoachAccountId = 1;
+
+	private static string ClosedMessage(string roomName, string reason) =>
+		$"We have closed the room '{roomName}' for: {reason}. We encourage creators to review our Creator Code of Conduct to help make Radicade a fun and safe place for everyone.";
+
+	private static string RestoredMessage(string roomName) =>
+		$"We have restored the room '{roomName}' after a thorough review of the previous accusations. Thank you for continuing to follow the Creator Code of Conduct, and making Radicade a better place.";
+
+	public static string FilePath => Path.Join(DBConfig.PersistentLogs, "banned-rooms.json");
+
+	public static List<BannedRoom> Load()
+	{
+		lock (FileLock) return LoadLocked();
+	}
+
+	public static BannedRoom? Find(long roomId) => Load().FirstOrDefault(x => x.RoomId == roomId);
+
+	public static bool IsBanned(long roomId) => Find(roomId) != null;
+
+	public static async Task<BannedRoom> BanAsync(RecDBContext db, RoomData room, string reason, string bannedBy)
+	{
+		var entry = new BannedRoom
+		{
+			RoomId = room.RoomId,
+			Name = room.Name,
+			Reason = reason,
+			BannedBy = bannedBy,
+			BannedAt = DateTime.UtcNow,
+			PublishedAt = room.PublishedAt,
+			Room = room,
+			SubRooms = await db.SubRooms.AsNoTracking().Where(x => x.RoomId == room.RoomId).ToListAsync(),
+			Roles = await db.RoomRoles.AsNoTracking().Where(x => x.RoomId == room.RoomId).ToListAsync(),
+			Stats = await db.RoomStats.AsNoTracking().FirstOrDefaultAsync(x => x.RoomId == room.RoomId)
+		};
+
+		Upsert(entry);
+
+		db.Rooms.Remove(room);
+		await db.SaveChangesAsync();
+
+		var why = string.IsNullOrWhiteSpace(reason) ? "a breach of the Creator Code of Conduct" : reason;
+		await TellOwnerAsync(room.CreatorAccountId, ClosedMessage(room.Name, why));
+
+		return entry;
+	}
+
+	public static async Task<bool> RestoreAsync(RecDBContext db, long roomId)
+	{
+		var entry = Find(roomId);
+		if (entry == null) return false;
+
+		await InsertRoomWithItsIdAsync(db, entry.Room, entry.PublishedAt);
+
+		Remove(roomId);
+
+		await TellOwnerAsync(entry.Room.CreatorAccountId, RestoredMessage(entry.Name));
+		return true;
+	}
+
+	private static async Task InsertRoomWithItsIdAsync(RecDBContext db, RoomData room, DateTime publishedAt)
+	{
+		var entity = db.Model.FindEntityType(typeof(RoomData))
+			?? throw new InvalidOperationException("RoomData is not part of the model.");
+
+		var table = entity.GetTableName() ?? nameof(RoomData);
+		var qualified = entity.GetSchema() is { Length: > 0 } schema ? $"[{schema}].[{table}]" : $"[{table}]";
+
+		var columns = new List<string>();
+		var cells = new List<string>();
+		var parameters = new List<object>();
+		foreach (var property in entity.GetProperties())
+		{
+			if (property.IsShadowProperty() || property.PropertyInfo == null) continue;
+
+			var value = property.Name == nameof(RoomData.PublishedAt)
+				? publishedAt
+				: property.PropertyInfo.GetValue(room);
+
+			columns.Add($"[{property.GetColumnName()}]");
+
+			var sqlValue = ToSqlValue(value);
+			if (sqlValue == null)
+			{
+				cells.Add("NULL");
+			}
+			else
+			{
+				cells.Add("{" + parameters.Count + "}");
+				parameters.Add(sqlValue);
+			}
+		}
+
+		var sql =
+			$"SET IDENTITY_INSERT {qualified} ON;\n" +
+			$"INSERT INTO {qualified} ({string.Join(", ", columns)}) VALUES ({string.Join(", ", cells)});\n" +
+			$"SET IDENTITY_INSERT {qualified} OFF;";
+
+		await db.Database.ExecuteSqlRawAsync(sql, parameters);
+	}
+
+	private static async Task TellOwnerAsync(long ownerAccountId, string message)
+	{
+		if (ownerAccountId <= 0) return;
+
+		try
+		{
+			await Notify.SendMessage(ownerAccountId, new Message
+			{
+				Type = MessageType.CoachMessage,
+				Data = message,
+				FromPlayerId = CoachAccountId
+			});
+		}
+		catch (Exception)
+		{
+		}
+	}
+
+	private static object? ToSqlValue(object? value) => value switch
+	{
+		null => null,
+		Enum enumValue => Convert.ChangeType(enumValue, Enum.GetUnderlyingType(enumValue.GetType())),
+		_ => value
+	};
+
+	private static void Upsert(BannedRoom entry)
+	{
+		lock (FileLock)
+		{
+			var rooms = LoadLocked();
+			rooms.RemoveAll(x => x.RoomId == entry.RoomId);
+			rooms.Add(entry);
+			SaveLocked(rooms);
+		}
+	}
+
+	private static void Remove(long roomId)
+	{
+		lock (FileLock)
+		{
+			var rooms = LoadLocked();
+			if (rooms.RemoveAll(x => x.RoomId == roomId) == 0) return;
+			SaveLocked(rooms);
+		}
+	}
+
+	private static List<BannedRoom> LoadLocked()
+	{
+		if (!File.Exists(FilePath)) return new List<BannedRoom>();
+
+		try
+		{
+			var json = File.ReadAllText(FilePath);
+			var rooms = JsonSerializer.Deserialize<List<BannedRoom>>(json, JsonOptions) ?? new List<BannedRoom>();
+
+			foreach (var room in rooms) room.Room.PublishedAt = room.PublishedAt;
+
+			return rooms;
+		}
+		catch (Exception)
+		{
+			return new List<BannedRoom>();
+		}
+	}
+
+	private static void SaveLocked(List<BannedRoom> rooms)
+	{
+		Directory.CreateDirectory(DBConfig.PersistentLogs);
+		File.WriteAllText(FilePath, JsonSerializer.Serialize(rooms, JsonOptions));
+	}
+}
+
+public class BannedRoom
+{
+	public long RoomId { get; set; }
+	public string Name { get; set; } = "";
+	public string Reason { get; set; } = "";
+	public string BannedBy { get; set; } = "";
+	public DateTime BannedAt { get; set; }
+	public DateTime PublishedAt { get; set; }
+
+	public RoomData Room { get; set; } = new();
+	public List<SubRoom> SubRooms { get; set; } = new();
+	public List<RoomRole> Roles { get; set; } = new();
+	public RoomStats? Stats { get; set; }
+}