[www] increase role drop

apps/www/src/client/App.tsx

@@ -3672,6 +3672,9 @@ function MaintenanceForm() {
  */
 const MAX_TOKEN_DROP = 1_000
 
+/** The role drop's own, higher cap — a mirror of www's `MAX_ROLE_TOKEN_DROP`. */
+const MAX_ROLE_TOKEN_DROP = 10_000
+
 /**
  * Developer-only: give every player online right now the same number of tokens, in a gift
  * box carrying the operator's message — the server-wide cousin of the room page's staff gift.
@@ -3750,7 +3753,8 @@ function TokenDropForm() {
  *
  * The audience is the roles the website recorded at each player's benefits claim and
  * refreshes once a day, so it trails Discord by up to a day and never includes a member who
- * hasn't claimed; the copy says so. Same cap as the online drop, repeated on the input.
+ * hasn't claimed; the copy says so. Its own cap (`MAX_ROLE_TOKEN_DROP`, 10,000 each), repeated
+ * on the input.
  */
 function RoleTokenDropForm() {
 	const [roleId, setRoleId] = useState('')
@@ -3765,8 +3769,8 @@ function RoleTokenDropForm() {
 				Give everyone holding a Discord role the same number of tokens, whether or not they are
 				online — a player who is signed out finds the gift box waiting. Only players who have
 				claimed benefits on this site are counted, and their roles are refreshed once a day, so a
-				role given or taken since then isn't seen yet. Up to {MAX_TOKEN_DROP.toLocaleString()}{' '}
-				tokens each.
+				role given or taken since then isn't seen yet. Up to{' '}
+				{MAX_ROLE_TOKEN_DROP.toLocaleString()} tokens each.
 			</p>
 			<form
 				onSubmit={(e) => {
@@ -3817,7 +3821,7 @@ function RoleTokenDropForm() {
 					<input
 						type="number"
 						min={1}
-						max={MAX_TOKEN_DROP}
+						max={MAX_ROLE_TOKEN_DROP}
 						step={1}
 						value={tokens}
 						required

apps/www/src/staff.ts

@@ -579,6 +579,13 @@ export const DEFAULT_MAX_XP_GIFT = 100
  */
 export const MAX_TOKEN_DROP = 1_000
 
+/**
+ * The most the Discord ROLE drop can carry per player. Higher than {@link MAX_TOKEN_DROP}:
+ * the audience is a named role, not whoever happens to be on, so the operator chooses who is
+ * paid and the drop is a reward rather than a server-wide thank-you.
+ */
+export const MAX_ROLE_TOKEN_DROP = 10_000
+
 /** The longest message a staff box may carry — the same cap a client message has. */
 const MAX_GIFT_MESSAGE = 256
 
@@ -1048,9 +1055,10 @@ export async function giftOnlineTokensHandler(c: Context<App>) {
  * their next read, as they do for every box the server hands over.
  *
  * The role is a Discord snowflake — all digits, compared exactly, as the sweep stores them.
- * The amount is bounded as the online drop's is ({@link MAX_TOKEN_DROP} each, positive only):
- * this one multiplies by a role's whole membership, which can be larger than the server has
- * ever had online at once. The message is required for the same reason.
+ * The amount is bounded as the online drop's is, positive only, but with its own cap
+ * ({@link MAX_ROLE_TOKEN_DROP} each): this one multiplies by a role's whole membership, which
+ * can be larger than the server has ever had online at once. The message is required for the
+ * same reason.
  */
 export async function giftRoleTokensHandler(c: Context<App>) {
 	const roleId = c.req.param('roleId') ?? ''
@@ -1063,9 +1071,11 @@ export async function giftRoleTokensHandler(c: Context<App>) {
 	if (!Number.isInteger(amount) || amount <= 0) {
 		return c.json({ error: 'Enter a whole number of tokens greater than 0' }, 400)
 	}
-	if (amount > MAX_TOKEN_DROP) {
+	if (amount > MAX_ROLE_TOKEN_DROP) {
 		return c.json(
-			{ error: `A token drop can carry at most ${MAX_TOKEN_DROP.toLocaleString()} tokens each` },
+			{
+				error: `A token drop can carry at most ${MAX_ROLE_TOKEN_DROP.toLocaleString()} tokens each`,
+			},
 			400
 		)
 	}

apps/www/src/test/integration/api.test.ts

@@ -2042,15 +2042,15 @@ it('drops tokens on every account whose Discord link holds the role, online or n
 	})
 })
 
-// Same bounds as the online drop, plus the role has to be a snowflake, and a role nobody's
-// link records is a 404 rather than a silent success.
+// Same bounds as the online drop but with a higher cap (10,000), plus the role has to be a
+// snowflake, and a role nobody's link records is a 404 rather than a silent success.
 it('refuses a role drop over the cap, without a message, with a bad role, or with no holders', async () => {
 	const drop = (role: string, body: unknown) =>
 		devPost(`/api/staff/discord-roles/${role}/gift-tokens`, 8110, body)
 	await linkPlatformIdentity(env.DB, 8396, PlatformType.Discord, '900000000000008396', [
 		'1077000000000000779',
 	])
-	expect((await drop('1077000000000000779', { amount: 1_001, message: 'hi' })).status).toBe(400)
+	expect((await drop('1077000000000000779', { amount: 10_001, message: 'hi' })).status).toBe(400)
 	expect((await drop('1077000000000000779', { amount: 0, message: 'hi' })).status).toBe(400)
 	expect((await drop('1077000000000000779', { amount: -5, message: 'hi' })).status).toBe(400)
 	expect((await drop('1077000000000000779', { amount: 10, message: '   ' })).status).toBe(400)