Admin Guide

Admin Guide

This is the practical handbook for hailsDotGO staff. The admin panel lives at /admin and is available to moderators and above; what you can see and do inside it depends on your role. The sections below follow the panel's tabs (Settings, Users, Raids, Tags, Tag Requests, Translations, Pages, Donations, Site Stats) and note the minimum role for every action. For what the roles themselves mean, see Accounts and Roles.

Role shorthand used below: Mod+ means moderator, admin, or superadmin; Admin+ means admin or superadmin; Superadmin means only the account named by SUPERADMIN_USER.

Staff protection rules

These are enforced server-side regardless of who clicks the button:

• The superadmin cannot be targeted at all: no password reset, rename, disable, role change, special rank change, or pending-role confirm/reject. The superadmin's API access and translator flags are always on and cannot be toggled.
• Staff (moderators and admins) cannot be raid-banned or hidden from the directory. Demote them first if it ever comes to that.
• You cannot disable your own account.
• Demoting an admin to any other role automatically revokes their api_access flag.

Settings tab (Admin+)

• Registration toggle: opens or closes public registration. Invite links keep working while registration is closed.
• Store toggle: shows or hides the Store page and nav link. Turning it off does not cancel active perks.

Pages tab (Admin+)

Per-page maintenance toggles for: Raids, DPS, PvP, Events, Trainers, Shinies, Shiny Dex, plus two section toggles inside the trainers page (Trainer Directory and Raid Finder). A disabled page renders a maintenance screen with HTTP 503; the Raid Finder toggle also blocks all raid API mutations.

Invites (Admin+)

Generated from the Settings tab:

• Choose the granted role (user, tester, moderator, admin) and max uses (1 to 50).
• Multi-use invites can only grant user; moderator and admin invites must be single-use.
• Tokens expire after 7 days. Active invites are listed with their use counts and can be cancelled at any time.
• Staff roles granted by invite arrive as a pending role; see user management below.

Users tab (Mod+)

Search and manage every account. Required role per action:

Action	Role	Notes
List users (roles, flags, strikes, tags, trust, raid XP)	Mod+
Reset password	Mod+	Minimum 8 characters
Change username	Mod+	Same validation as registration
Disable / re-enable with reason	Mod+	Disabling revokes all sessions; the reason is shown at login
Hide from / unhide in directory	Mod+	Not usable on staff
Raid ban / unban	Mod+	Not usable on staff; banning immediately removes the user from any queue or lobby
Strikes: list, add (reason required), delete	Mod+	Audit trail of warnings
Change role	Admin+	user, tester, moderator, admin
Confirm or reject a pending staff role	Admin+	For invite-granted moderator/admin roles
Set raid XP	Admin+	0 to 9,999,999; changes the rank ladder position
Set rater weight	Admin+	0.1 to 1.5; the user's trust report reliability
Clear legacy ratings	Admin+	Wipes old star-rating rows for the user
Refresh activity	Admin+	Sets last_raid_at to now (rank decay helper)
Set special rank	Admin+	trusted, content_creator, or clear; unlocks custom lobbies
Toggle API access	Superadmin	Only grantable to admin accounts; gates the private API
Toggle translator	Superadmin	Gates the /translate workspace
Assign / remove tags	Mod+	Store-earned custom tags must be managed from Tag Requests instead

Raids tab (Mod+)

Moderation tools for Raid Finder and the Trust and Awards systems.

Lobby moderation

• List live lobbies (Mod+): host, boss, state, member count.
• Force-cancel a lobby (Mod+): uses the same path as a host cancel, so members are returned to the front of the queue with no penalty.

Trust tools

• Event log per user (Mod+): the last 100 trust events with actor, raw delta, weight, applied delta, and note, plus the cached score, effective score, and tier.
• Manual adjust (Admin+): inserts an auditable staff_adjust event (delta between -100 and +100, with a note). It bypasses the per-event clamp so corrections of any size are possible.
• Recompute (Admin+): re-sums the event log into the cached trust_score column if it ever drifts.

Awards management

• List catalog and recent grants (Mod+).
• Create / update / delete awards (Admin+): name, description, icon, color, sort order, active flag.
• Revoke a grant (Mod+).

Tags tab

Colored label pills shown next to usernames.

• List tags and assign or remove them on users: Mod+.
• Create, edit, delete tags in the catalog: Superadmin only.
• Custom tags earned through the store cannot be removed here; handle them through Tag Requests so the request state stays consistent.

Tag Requests tab (Mod+)

Reviews the custom tag requests submitted by Supporter Pack holders (see Store).

• Approve: creates (or recolors) the tag and assigns it. Approval is refused if the user's Supporter Pack has lapsed.
• Reject with a reason: starts the user's 7-day cooldown before they can submit a fresh request. Rejecting an already-approved tag also strips it from the user.
• Request revision with notes: the user can resubmit immediately with a new name or color, without the cooldown.

Translations tab (Admin+)

Reviews edits submitted from the Translator Workspace:

• List pending edits per locale, approve or reject (with a reason) each one.
• Export a locale's approved overrides as JSON.
• Sync to GitHub: pushes approved community translations to the repository.
• Enable or delete locales: translator-created locales stay hidden from the public language switcher until enabled here.

Donations tab (Admin+)

Store item management: list the catalog (name, slug, price, type, sort order) and toggle items active or inactive. Prices and new items are managed in the database; see Store.

Site Stats tab (Mod+)

A live dashboard backed by GET /api/admin/stats (the endpoint itself requires Admin+): process uptime, goroutine count, heap usage, GC runs, database pool stats (open, in use, idle, waits, wait time), a live DB ping latency, and app counts (total users, active raids, tracked shinies, active sessions).

Outside the panel

Two more staff powers apply in the field:

• Staff can cancel any lobby and kick any lobby member directly from the raid finder UI.
• The superadmin can trigger a forced game data refresh (same effect as POST /api/refresh, see Data Sources).