/* Admin "Users & accounts": approve sign-ins, see every exchange account, name
strategies (the public name is the only thing regular users ever see of a trader),
and pick which Telegram channels the reader follows. */
const adminCell = { padding: '9px 10px', borderBottom: '1px solid var(--border-soft)', fontSize: 12, verticalAlign: 'middle' };
const adminHead = { ...adminCell, fontSize: 9.5, color: 'var(--text-4)', letterSpacing: '0.1em', textTransform: 'uppercase', textAlign: 'left', fontWeight: 500 };
const adminFmtTs = (ts) => ts ? new Date(ts).toISOString().slice(0, 16).replace('T', ' ') : '—';
function adminFetchJson(url, opts) {
return fetch(url, { credentials: 'include', ...(opts || {}) }).then(r => r.json())
.catch(e => ({ ok: false, error: String(e.message || e) }));
}
function W_UsersAdmin() {
return (
);
}
function AdminUsersCard() {
const [users, setUsers] = React.useState(null);
const [error, setError] = React.useState(null);
const [notice, setNotice] = React.useState(null); // a green confirmation, e.g. "email sent"
const [busyId, setBusyId] = React.useState(null);
const [invEmail, setInvEmail] = React.useState('');
const [invRole, setInvRole] = React.useState('user');
const [invBusy, setInvBusy] = React.useState(false);
const [showDeleted, setShowDeleted] = React.useState(false);
const load = React.useCallback((keepError) => {
fetch('/api/admin/users' + (showDeleted ? '?include_deleted=1' : ''), { credentials: 'include' }).then(r => r.json())
.then(j => { if (j.ok) { setUsers(j.data); if (keepError !== true) setError(null); } else setError(j.error); })
.catch(e => setError(String(e.message || e)));
}, [showDeleted]);
React.useEffect(() => { load(); }, [load]);
// Soft delete / restore. A deleted person leaves the list (their row, and so the record of who joined and
// when, stays); "Show deleted" brings them back into view.
async function deleteOrRestore(u, kind) {
if (kind === 'delete' && !window.confirm(
`Delete ${u.name || u.email}?\n\nThey lose access and leave this list. The record that they joined stays, `
+ `and "Show deleted" brings them back into view. Refused if they still have open positions.`)) return;
setBusyId(u.id); setError(null); setNotice(null);
const j = await adminFetchJson(`/api/admin/users/${u.id}/${kind}`, { method: 'POST' });
setBusyId(null);
if (!j.ok) setError(j.error || 'That did not work');
else setNotice(kind === 'delete' ? `${u.email} deleted.` : `${u.email} restored (as pending: approve to give access).`);
load(true);
}
async function setRole(u, role) {
setBusyId(u.id);
setError(null);
setNotice(null);
// A request that never answers must not freeze the page: give up after 20s and say so.
const ctl = new AbortController();
const timer = setTimeout(() => ctl.abort(), 20000);
try {
const j = await fetch(`/api/admin/users/${u.id}/role`, {
method: 'POST', credentials: 'include', signal: ctl.signal,
headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ role }),
}).then(r => r.json());
if (!j.ok) setError(j.error || 'Could not change the role');
else if (j.email_sent) setNotice(`Role updated. ${u.email} was notified by email.`);
else if (j.email_error) setNotice(`Role updated, but the email to ${u.email} could not be sent (${j.email_error}).`);
} catch (e) {
setError(e && e.name === 'AbortError' ? 'The server did not answer in 20s; the role may not have changed.' : String((e && e.message) || e));
} finally {
clearTimeout(timer);
setBusyId(null);
load(true); // refresh the list but keep any error just shown
}
}
async function sendInvite(e) {
e.preventDefault();
if (!invEmail.trim()) { setError('Enter an email address to invite.'); return; }
setInvBusy(true); setError(null); setNotice(null);
const j = await adminFetchJson('/api/admin/users/invite', {
method: 'POST', headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ email: invEmail, role: invRole }),
});
setInvBusy(false);
if (!j.ok) { setError(j.error || 'Could not send the invitation'); return; }
setInvEmail('');
setNotice(j.data.email_sent
? `Invitation sent to ${j.data.email}. They are on the list as awaiting sign-up.`
: `${j.data.email} was added as awaiting sign-up, but the email could not be sent (${j.data.email_error}). Use Resend to try again.`);
load(true);
}
async function inviteAction(u, kind) {
setBusyId(u.id); setError(null); setNotice(null);
const j = kind === 'resend'
? await adminFetchJson(`/api/admin/users/${u.id}/resend-invite`, { method: 'POST' })
: await adminFetchJson(`/api/admin/users/${u.id}/invite`, { method: 'DELETE' });
setBusyId(null);
if (!j.ok) setError(j.error || 'That did not work');
else if (kind === 'resend') setNotice(j.data.email_sent ? `Invitation sent again to ${u.email}.` : `The email to ${u.email} could not be sent (${j.data.email_error}).`);
else setNotice(`Invitation to ${u.email} withdrawn.`);
load(true);
}
const roleChip = { admin: 'gold', arena: 'info', user: 'bull', pending: 'neutral' };
const roleName = { admin: 'admin', arena: 'arena member', user: 'user', pending: 'pending' };
const cell = adminCell, head = adminHead, fmt = adminFmtTs;
return (
Users
{users ? users.length : '…'}
They get an email with how to sign in, and appear below as awaiting sign-up. When they sign in with that same
address they get the role you chose straight away, with no approval step.