feat: moderator-scoped admin access + fix push notifications not displaying (v0.66.0)

Moderator role existed in the schema and was already respected by
comment deletion, but every admin page/route treated moderator
identically to a regular user (403/redirect). Wires it up narrowly:
admin/layout.tsx now lets admin+moderator through and filters the
nav by role, while every admin-only page (users, tiers, settings,
webhooks, insights, etc.) explicitly redirects moderators away via a
new requireFullAdminPage() helper -- the nav filter is UX, this is
the actual gate. Moderators land on Reports and Recipes: reports
GET/PATCH now accept requireAdmin({allowModerator: true}), and a new
PATCH /api/v1/admin/recipes/[id] lets admin+moderator unpublish a
public recipe (flip to private) as a takedown action, audit-logged.

Also found and fixed a real bug while auditing the PWA push pipeline
for a "push click-through" gap: public/sw.js had no `push` event
listener at all, so incoming push messages never displayed anything
-- push was silently non-functional end-to-end despite the
subscribe/send plumbing all working. Added the push listener
(showNotification) and a notificationclick listener that focuses an
existing tab or opens one at the payload's url.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to Epicure are documented here. This file is mirrored in-app at `/changelog` (and in the admin dashboard) via `apps/web/lib/changelog.ts` — update both together.
 
+## 0.66.0 — 2026-07-21 09:00
+
+### Added
+- Moderator role is now wired up: moderators get access to Admin → Reports (view/resolve) and Admin → Recipes (view + unpublish a public recipe as a takedown action). Every other admin section stays admin-only, enforced server-side on each page, not just hidden from the nav.
+- Push notifications now actually display. The service worker had no `push` event listener at all, so incoming push messages never showed anything — fixed, plus a `notificationclick` handler that focuses an existing tab or opens one at the notification's target URL.
+
 ## 0.65.3 — 2026-07-21 01:20
 
 ### Fixed

FEATURE_AUDIT.md

@@ -88,10 +88,10 @@ Status legend: **Exists** (fully working) · **Partial** (works but with a real
 | Trending feed / explore | Exists | Favorite-count driven, no editorial curation, **no separate "featured" surface** | `apps/web/app/api/v1/feed/trending` |
 | Notification categories | Exists | 8 categories, independent push + email toggle each, plus email-only weekly digest | `packages/db/src/schema/users.ts` (`userNotificationPrefs`) |
 | Push notifications | Exists | Web Push + VAPID, end-to-end, real trigger call sites (not just plumbing) | `apps/web/lib/push.ts` |
-| Push click-through handling | **Missing** | No `notificationclick` listener in the service worker — the `url` field encoded in push payloads isn't consumed client-side | `apps/web/public/sw.js` |
+| Push display + click-through | Exists | `sw.js` previously had no `push` listener at all — push messages never displayed. Now has both `push` (calls `showNotification`) and `notificationclick` (focuses an existing tab on the payload's `url`, or opens one) | `apps/web/public/sw.js` |
 | Email notifications + weekly digest cron | Exists | | `apps/web/lib/notifications.ts`, `apps/web/app/api/internal/cron/weekly-digest` |
 | Reports/moderation | Exists | Report → admin webhook → admin queue → resolve (reviewed/dismissed) + audit log | `apps/web/app/api/v1/reports`, `apps/web/app/api/v1/admin/reports` |
-| Moderator role | Partial | Enum value exists (`user`/`moderator`/`admin`) but no moderator-scoped route was found — report review currently requires full admin | `packages/db/src/schema/users.ts` |
+| Moderator role | Exists | Moderators get `/admin/reports` (view/resolve) and `/admin/recipes` (view + unpublish takedown); every other `/admin/*` page redirects them out via `requireFullAdminPage()`. Comment deletion already allowed moderator before this. | `apps/web/lib/require-admin-page.ts`, `apps/web/app/admin/layout.tsx`, `apps/web/app/api/v1/admin/recipes/[id]/route.ts` |
 
 ---
 
@@ -145,11 +145,11 @@ Ranked roughly by likely value:
 3. **Nutrition trend/history view** — diary is single-day only, no multi-day chart.
 4. **USDA/nutrition-database lookup** — all nutrition numbers are AI-estimated; barcode scan only gets product name, not nutrition facts.
 5. **OS Share Target** — can't share a recipe link into Epicure from another app's share sheet.
-6. **Push click-through handling** in the service worker — payload carries a `url`, nothing consumes it.
+6. ~~Push click-through handling~~ — closed 2026-07-21 (`push`/`notificationclick` listeners added to `sw.js`).
 7. **Anonymous public link for meal plans** — shopping lists have this, meal plans don't.
 8. **Grocery delivery/live pricing** beyond the Instacart stub (which needs a partnership agreement to go live).
 9. **Offline coverage for shopping lists / meal plan** — currently recipe-viewing + mark-cooked only.
-10. **Moderator-scoped admin routes** — role exists in the schema, not wired to any route.
+10. ~~Moderator-scoped admin routes~~ — closed 2026-07-21 (reports + recipe-unpublish).
 
 ## Deliberate design choices (not gaps)
 - Direct messaging is 1:1 only — enforced at the schema level, not a missing feature.

apps/web/app/admin/ai-config/page.tsx

@@ -3,6 +3,7 @@ import { Badge } from "@/components/ui/badge";
 import { getAllSiteSettings } from "@/lib/site-settings";
 import { AdminSettingsForm } from "@/components/admin/admin-settings-form";
 import { AdminDefaultModelForm } from "@/components/admin/admin-default-model-form";
+import { requireFullAdminPage } from "@/lib/require-admin-page";
 
 export const metadata: Metadata = {};
 
@@ -21,6 +22,7 @@ function resolveProvider(settings: Record<string, { value: string | null }>) {
 }
 
 export default async function AdminAiConfigPage() {
+  await requireFullAdminPage();
   const settings = await getAllSiteSettings();
   const active = resolveProvider(settings);
 

apps/web/app/admin/audit-logs/page.tsx

@@ -1,5 +1,6 @@
 import type { Metadata } from "next";
 import { db, auditLogs, users, eq, desc } from "@epicure/db";
+import { requireFullAdminPage } from "@/lib/require-admin-page";
 
 export const metadata: Metadata = {};
 
@@ -10,6 +11,7 @@ interface PageProps {
 }
 
 export default async function AdminAuditLogsPage({ searchParams }: PageProps) {
+  await requireFullAdminPage();
   const { page: pageParam } = await searchParams;
   const page = Math.max(1, parseInt(pageParam ?? "1", 10));
   const offset = (page - 1) * PAGE_SIZE;

apps/web/app/admin/changelog/page.tsx

@@ -1,10 +1,12 @@
 import type { Metadata } from "next";
 import { ChangelogList } from "@/components/shared/changelog-list";
 import { APP_VERSION } from "@/lib/changelog";
+import { requireFullAdminPage } from "@/lib/require-admin-page";
 
 export const metadata: Metadata = {};
 
-export default function AdminChangelogPage() {
+export default async function AdminChangelogPage() {
+  await requireFullAdminPage();
   return (
     <div className="space-y-6">
       <div>

apps/web/app/admin/insights/page.tsx

@@ -3,6 +3,7 @@ import { db, users, recipes, userUsage, supportTickets, gte, sql } from "@epicur
 import { Card, CardContent, CardHeader, CardTitle, CardDescription } from "@/components/ui/card";
 import { BarChart } from "@/components/admin/charts/bar-chart";
 import { TimeSeriesChart } from "@/components/admin/charts/time-series-chart";
+import { requireFullAdminPage } from "@/lib/require-admin-page";
 
 export const metadata: Metadata = {};
 
@@ -35,6 +36,7 @@ function lastNMonths(n: number): string[] {
 }
 
 export default async function AdminInsightsPage() {
+  await requireFullAdminPage();
   const since = new Date();
   since.setDate(since.getDate() - DAYS);
 

apps/web/app/admin/invites/page.tsx

@@ -1,10 +1,12 @@
 import type { Metadata } from "next";
 import { listInvites } from "@/lib/invites";
 import { InvitesManager } from "@/components/admin/invites-manager";
+import { requireFullAdminPage } from "@/lib/require-admin-page";
 
 export const metadata: Metadata = {};
 
 export default async function AdminInvitesPage() {
+  await requireFullAdminPage();
   const invites = await listInvites();
   const appUrl = process.env["BETTER_AUTH_URL"] ?? "http://localhost:3000";
 

apps/web/app/admin/layout.tsx

@@ -1,34 +1,34 @@
-import { redirect } from "next/navigation";
-import { headers } from "next/headers";
-import { auth } from "@/lib/auth/server";
-import { db, users, eq } from "@epicure/db";
 import Link from "next/link";
 import { Shield, Users, BookOpen, Settings, BarChart3, ClipboardList, HardDrive, Bot, ArrowLeft, Gauge, Mail, Flag, History, LifeBuoy, TrendingUp, Webhook } from "lucide-react";
 import { cn } from "@/lib/utils";
+import { getStaffRole } from "@/lib/require-admin-page";
+import { redirect } from "next/navigation";
 
+// adminOnly items are hidden from moderators (and, redundantly but safely,
+// each of those pages also redirects moderators away server-side via
+// requireFullAdminPage — the nav filter here is UX, not the real gate).
 const adminNav = [
-  { href: "/admin", label: "Overview", icon: BarChart3 },
-  { href: "/admin/insights", label: "Insights", icon: TrendingUp },
-  { href: "/admin/users", label: "Users", icon: Users },
-  { href: "/admin/invites", label: "Invites", icon: Mail },
-  { href: "/admin/recipes", label: "Recipes", icon: BookOpen },
-  { href: "/admin/reports", label: "Reports", icon: Flag },
-  { href: "/admin/support", label: "Support", icon: LifeBuoy },
-  { href: "/admin/tiers", label: "Tier Limits", icon: Gauge },
-  { href: "/admin/webhooks", label: "Webhooks", icon: Webhook },
-  { href: "/admin/audit-logs", label: "Audit Logs", icon: ClipboardList },
-  { href: "/admin/storage", label: "Storage", icon: HardDrive },
-  { href: "/admin/ai-config", label: "AI Config", icon: Bot },
-  { href: "/admin/settings", label: "Settings", icon: Settings },
-  { href: "/admin/changelog", label: "Changelog", icon: History },
+  { href: "/admin", label: "Overview", icon: BarChart3, adminOnly: true },
+  { href: "/admin/insights", label: "Insights", icon: TrendingUp, adminOnly: true },
+  { href: "/admin/users", label: "Users", icon: Users, adminOnly: true },
+  { href: "/admin/invites", label: "Invites", icon: Mail, adminOnly: true },
+  { href: "/admin/recipes", label: "Recipes", icon: BookOpen, adminOnly: false },
+  { href: "/admin/reports", label: "Reports", icon: Flag, adminOnly: false },
+  { href: "/admin/support", label: "Support", icon: LifeBuoy, adminOnly: true },
+  { href: "/admin/tiers", label: "Tier Limits", icon: Gauge, adminOnly: true },
+  { href: "/admin/webhooks", label: "Webhooks", icon: Webhook, adminOnly: true },
+  { href: "/admin/audit-logs", label: "Audit Logs", icon: ClipboardList, adminOnly: true },
+  { href: "/admin/storage", label: "Storage", icon: HardDrive, adminOnly: true },
+  { href: "/admin/ai-config", label: "AI Config", icon: Bot, adminOnly: true },
+  { href: "/admin/settings", label: "Settings", icon: Settings, adminOnly: true },
+  { href: "/admin/changelog", label: "Changelog", icon: History, adminOnly: true },
 ];
 
 export default async function AdminLayout({ children }: { children: React.ReactNode }) {
-  const session = await auth.api.getSession({ headers: await headers() });
-  if (!session) redirect("/login");
+  const role = await getStaffRole();
+  if (!role) redirect("/recipes");
 
-  const [dbUser] = await db.select({ role: users.role }).from(users).where(eq(users.id, session.user.id));
-  if (dbUser?.role !== "admin") redirect("/recipes");
+  const visibleNav = role === "admin" ? adminNav : adminNav.filter((item) => !item.adminOnly);
 
   return (
     <div className="flex flex-col md:flex-row min-h-screen">
@@ -36,7 +36,7 @@ export default async function AdminLayout({ children }: { children: React.ReactN
         <div className="flex items-center justify-between gap-2 p-4 border-b font-semibold">
           <span className="flex items-center gap-2">
             <Shield className="h-4 w-4 text-destructive" />
-            Admin
+            {role === "admin" ? "Admin" : "Moderator"}
           </span>
           <Link
             href="/recipes"
@@ -47,7 +47,7 @@ export default async function AdminLayout({ children }: { children: React.ReactN
           </Link>
         </div>
         <nav className="flex overflow-x-auto gap-1 p-2 md:flex-col md:overflow-visible md:flex-1 [scrollbar-width:none] [&::-webkit-scrollbar]:hidden">
-          {adminNav.map(({ href, label, icon: Icon }) => (
+          {visibleNav.map(({ href, label, icon: Icon }) => (
             <Link
               key={href}
               href={href}

apps/web/app/admin/page.tsx

@@ -6,10 +6,12 @@ import { count, eq, gte, sql } from "@epicure/db";
 import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
 import { Users, BookOpen, Sparkles, Image, History, UserPlus, ChefHat, Flag, HardDrive, Webhook, KeyRound } from "lucide-react";
 import { APP_VERSION, CHANGELOG } from "@/lib/changelog";
+import { requireFullAdminPage } from "@/lib/require-admin-page";
 
 export const metadata: Metadata = {};
 
 export default async function AdminPage() {
+  await requireFullAdminPage();
   const currentMonth = new Date().toISOString().slice(0, 7);
   const sevenDaysAgo = new Date(Date.now() - 7 * 24 * 60 * 60 * 1000);
 

apps/web/app/admin/recipes/page.tsx

@@ -2,6 +2,7 @@ import type { Metadata } from "next";
 import { db, recipes, users, eq, desc, count } from "@epicure/db";
 import { Badge } from "@/components/ui/badge";
 import Link from "next/link";
+import { UnpublishRecipeButton } from "@/components/admin/unpublish-recipe-button";
 
 export const metadata: Metadata = {};
 
@@ -61,12 +62,13 @@ export default async function AdminRecipesPage({ searchParams }: PageProps) {
               <th className="px-4 py-3 text-left font-medium">Visibility</th>
               <th className="px-4 py-3 text-left font-medium">Created</th>
               <th className="px-4 py-3 text-left font-medium">Link</th>
+              <th className="px-4 py-3 text-left font-medium">Action</th>
             </tr>
           </thead>
           <tbody>
             {publicRecipes.length === 0 ? (
               <tr>
-                <td colSpan={5} className="px-4 py-8 text-center text-muted-foreground">
+                <td colSpan={6} className="px-4 py-8 text-center text-muted-foreground">
                   No public recipes yet.
                 </td>
               </tr>
@@ -104,6 +106,9 @@ export default async function AdminRecipesPage({ searchParams }: PageProps) {
                       View
                     </Link>
                   </td>
+                  <td className="px-4 py-3">
+                    <UnpublishRecipeButton recipeId={recipe.id} />
+                  </td>
                 </tr>
               ))
             )}

apps/web/app/admin/settings/page.tsx

@@ -2,6 +2,7 @@ import type { Metadata } from "next";
 import { getAllSiteSettings, isSignupsDisabled } from "@/lib/site-settings";
 import { AdminSettingsForm } from "@/components/admin/admin-settings-form";
 import { SignupsToggle } from "@/components/admin/signups-toggle";
+import { requireFullAdminPage } from "@/lib/require-admin-page";
 
 export const metadata: Metadata = {};
 
@@ -25,6 +26,7 @@ const SETTING_GROUPS = [
 ];
 
 export default async function AdminSettingsPage() {
+  await requireFullAdminPage();
   const settings = await getAllSiteSettings();
   const signupsDisabled = await isSignupsDisabled();
 

apps/web/app/admin/storage/page.tsx

@@ -3,10 +3,12 @@ import { db, users, recipePhotos, recipes, eq, desc, sql, count } from "@epicure
 import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
 import { Badge } from "@/components/ui/badge";
 import { HardDrive } from "lucide-react";
+import { requireFullAdminPage } from "@/lib/require-admin-page";
 
 export const metadata: Metadata = {};
 
 export default async function AdminStoragePage() {
+  await requireFullAdminPage();
   const [totalPhotos, recipesWithPhotos, photosByTier, topUsers] = await Promise.all([
     db.select({ count: count() }).from(recipePhotos).then((r) => r[0]),
     db

apps/web/app/admin/support/page.tsx

@@ -2,10 +2,12 @@ import type { Metadata } from "next";
 import { db, supportTickets, desc } from "@epicure/db";
 import { AdminSupportManager } from "@/components/admin/admin-support-manager";
 import { getPublicUrl } from "@/lib/storage";
+import { requireFullAdminPage } from "@/lib/require-admin-page";
 
 export const metadata: Metadata = {};
 
 export default async function AdminSupportPage() {
+  await requireFullAdminPage();
   const rows = await db.query.supportTickets.findMany({
     orderBy: desc(supportTickets.createdAt),
     with: {

apps/web/app/admin/tiers/page.tsx

@@ -3,10 +3,12 @@ import { db, tierDefinitions } from "@epicure/db";
 import { TierLimitsForm } from "@/components/admin/tier-limits-form";
 import { FeatureFlagsForm } from "@/components/admin/feature-flags-form";
 import { getFeatureFlagMatrix, FEATURE_DEFINITIONS } from "@/lib/feature-flags";
+import { requireFullAdminPage } from "@/lib/require-admin-page";
 
 export const metadata: Metadata = {};
 
 export default async function AdminTiersPage() {
+  await requireFullAdminPage();
   const [tiers, featureFlagMatrix] = await Promise.all([
     db.select().from(tierDefinitions),
     getFeatureFlagMatrix(),

apps/web/app/admin/users/[id]/page.tsx

@@ -10,6 +10,7 @@ import { UserEditor } from "@/components/admin/user-editor";
 import { ResetUsageButton } from "@/components/admin/reset-usage-button";
 import Link from "next/link";
 import { ArrowLeft } from "lucide-react";
+import { requireFullAdminPage } from "@/lib/require-admin-page";
 
 export const metadata: Metadata = {};
 
@@ -30,6 +31,7 @@ const TIER_COLORS = {
 } as const;
 
 export default async function AdminUserDetailPage({ params }: PageProps) {
+  await requireFullAdminPage();
   const { id } = await params;
 
   const [user] = await db.select().from(users).where(eq(users.id, id)).limit(1);

apps/web/app/admin/users/page.tsx

@@ -6,6 +6,7 @@ import { Badge } from "@/components/ui/badge";
 import { Avatar, AvatarFallback, AvatarImage } from "@/components/ui/avatar";
 import { CreateUserDialog } from "@/components/admin/create-user-dialog";
 import Link from "next/link";
+import { requireFullAdminPage } from "@/lib/require-admin-page";
 
 export const metadata: Metadata = {};
 
@@ -28,6 +29,7 @@ const TIER_COLORS = {
 } as const;
 
 export default async function AdminUsersPage({ searchParams }: PageProps) {
+  await requireFullAdminPage();
   const { page: pageParam } = await searchParams;
   const page = Math.max(1, parseInt(pageParam ?? "1", 10) || 1);
   const offset = (page - 1) * PAGE_SIZE;

apps/web/app/admin/webhooks/page.tsx

@@ -1,10 +1,12 @@
 import type { Metadata } from "next";
 import { db, adminWebhooks } from "@epicure/db";
 import { AdminWebhooksManager } from "@/components/admin/admin-webhooks-manager";
+import { requireFullAdminPage } from "@/lib/require-admin-page";
 
 export const metadata: Metadata = {};
 
 export default async function AdminWebhooksPage() {
+  await requireFullAdminPage();
   const rows = await db
     .select({
       id: adminWebhooks.id,

apps/web/app/api/v1/admin/recipes/[id]/route.ts

@@ -0,0 +1,43 @@
+import { NextRequest, NextResponse } from "next/server";
+import { randomUUID } from "crypto";
+import { z } from "zod";
+import { requireAdmin } from "@/lib/api-auth";
+import { db, recipes, auditLogs, eq } from "@epicure/db";
+
+const PatchSchema = z.object({
+  action: z.literal("unpublish"),
+});
+
+/** Admin/moderator takedown action — flips a public recipe to private.
+ * Deliberately narrow (just this one transition) rather than exposing full
+ * visibility management here, since that's the recipe owner's call. */
+export async function PATCH(req: NextRequest, { params }: { params: Promise<{ id: string }> }) {
+  const { session, response } = await requireAdmin({ allowModerator: true });
+  if (response) return response;
+
+  const { id } = await params;
+  const parsed = PatchSchema.safeParse(await req.json());
+  if (!parsed.success) {
+    return NextResponse.json({ error: "Validation error", issues: parsed.error.issues }, { status: 400 });
+  }
+
+  const [updated] = await db
+    .update(recipes)
+    .set({ visibility: "private" })
+    .where(eq(recipes.id, id))
+    .returning({ id: recipes.id });
+
+  if (!updated) return NextResponse.json({ error: "Not found" }, { status: 404 });
+
+  await db.insert(auditLogs).values({
+    id: randomUUID(),
+    userId: session!.user.id,
+    action: "admin.recipe.unpublish",
+    targetType: "recipe",
+    targetId: id,
+    metadata: null,
+    createdAt: new Date(),
+  });
+
+  return NextResponse.json({ ok: true });
+}

apps/web/app/api/v1/admin/reports/[id]/route.ts

@@ -8,7 +8,7 @@ interface RouteContext {
 }
 
 export async function PATCH(req: NextRequest, { params }: RouteContext) {
-  const { session, response } = await requireAdmin();
+  const { session, response } = await requireAdmin({ allowModerator: true });
   if (response) return response;
 
   const { id } = await params;

apps/web/app/api/v1/admin/reports/route.ts

@@ -3,7 +3,7 @@ import { requireAdmin } from "@/lib/api-auth";
 import { db, reports, users, eq, desc } from "@epicure/db";
 
 export async function GET() {
-  const { response } = await requireAdmin();
+  const { response } = await requireAdmin({ allowModerator: true });
   if (response) return response;
 
   const rows = await db

apps/web/components/admin/unpublish-recipe-button.tsx

@@ -0,0 +1,36 @@
+"use client";
+
+import { useState } from "react";
+import { useRouter } from "next/navigation";
+import { toast } from "sonner";
+import { Button } from "@/components/ui/button";
+
+export function UnpublishRecipeButton({ recipeId }: { recipeId: string }) {
+  const router = useRouter();
+  const [busy, setBusy] = useState(false);
+
+  async function unpublish() {
+    if (!confirm("Unpublish this recipe? It becomes private — only the author can see it.")) return;
+    setBusy(true);
+    try {
+      const res = await fetch(`/api/v1/admin/recipes/${recipeId}`, {
+        method: "PATCH",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ action: "unpublish" }),
+      });
+      if (!res.ok) throw new Error();
+      toast.success("Recipe unpublished");
+      router.refresh();
+    } catch {
+      toast.error("Failed to unpublish");
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  return (
+    <Button type="button" variant="outline" size="sm" className="h-6 px-2 text-xs" disabled={busy} onClick={() => { void unpublish(); }}>
+      {busy ? "Unpublishing…" : "Unpublish"}
+    </Button>
+  );
+}

apps/web/lib/api-auth.ts

@@ -19,7 +19,7 @@ export async function getOptionalSession() {
   return auth.api.getSession({ headers: await headers() });
 }
 
-export async function requireAdmin() {
+export async function requireAdmin(opts?: { allowModerator?: boolean }) {
   const { session, response } = await requireSession();
   if (response) return { session: null, response };
 
@@ -32,7 +32,8 @@ export async function requireAdmin() {
     .where(eq(users.id, session!.user.id))
     .limit(1);
 
-  if (dbUser?.role !== "admin") {
+  const allowed = dbUser?.role === "admin" || (opts?.allowModerator && dbUser?.role === "moderator");
+  if (!allowed) {
     return { session: null, response: NextResponse.json({ error: "Forbidden" }, { status: 403 }) };
   }
   return { session, response: null };

apps/web/lib/changelog.ts

@@ -1,5 +1,5 @@
 // Mirrors CHANGELOG.md at the repo root — update both together.
-export const APP_VERSION = "0.65.3";
+export const APP_VERSION = "0.66.0";
 
 export type ChangelogEntry = {
   version: string;
@@ -11,6 +11,14 @@ export type ChangelogEntry = {
 };
 
 export const CHANGELOG: ChangelogEntry[] = [
+  {
+    version: "0.66.0",
+    date: "2026-07-21 09:00",
+    added: [
+      "Moderator role is now wired up: moderators get access to Admin → Reports (view/resolve) and Admin → Recipes (view + unpublish a public recipe as a takedown action). Every other admin section stays admin-only, enforced server-side on each page, not just hidden from the nav.",
+      "Push notifications now actually display. The service worker had no push event listener at all, so incoming push messages never showed anything — fixed, plus a notificationclick handler that focuses an existing tab or opens one at the notification's target URL.",
+    ],
+  },
   {
     version: "0.65.3",
     date: "2026-07-21 01:20",

apps/web/lib/openapi.ts

@@ -888,7 +888,10 @@ export function generateOpenApiSpec(): object {
   registry.registerPath({ method: "post", path: "/api/v1/admin/invites", summary: "Create an invite", description: "Admin only.", security: adminSecurity, request: { body: { content: { "application/json": { schema: CreateInviteRef } }, required: true } }, responses: { 200: { description: "Created", content: { "application/json": { schema: z.object({ invite: InviteRef }) } } }, 400: { description: "Invalid role or tier", content: { "application/json": { schema: ApiErrorRef } } }, 403: { description: "Forbidden", content: { "application/json": { schema: ApiErrorRef } } } } });
   registry.registerPath({ method: "delete", path: "/api/v1/admin/invites/{id}", summary: "Revoke an invite", description: "Admin only.", security: adminSecurity, request: { params: idParam }, responses: { 200: { description: "Revoked", content: { "application/json": { schema: z.object({ ok: z.boolean() }) } } }, 403: { description: "Forbidden", content: { "application/json": { schema: ApiErrorRef } } }, 404: { description: "Invite not found", content: { "application/json": { schema: ApiErrorRef } } } } });
 
-  registry.registerPath({ method: "get", path: "/api/v1/admin/reports", summary: "List pending reports (up to 100, newest first)", description: "Admin only.", security: adminSecurity, responses: { 200: { description: "Reports", content: { "application/json": { schema: z.object({ reports: z.array(AdminReportRef) }) } } }, 403: { description: "Forbidden", content: { "application/json": { schema: ApiErrorRef } } } } });
+  registry.registerPath({ method: "get", path: "/api/v1/admin/reports", summary: "List pending reports (up to 100, newest first)", description: "Admin or moderator.", security: adminSecurity, responses: { 200: { description: "Reports", content: { "application/json": { schema: z.object({ reports: z.array(AdminReportRef) }) } } }, 403: { description: "Forbidden", content: { "application/json": { schema: ApiErrorRef } } } } });
+
+  const UnpublishRecipeRef = registry.register("UnpublishRecipe", z.object({ action: z.literal("unpublish") }));
+  registry.registerPath({ method: "patch", path: "/api/v1/admin/recipes/{id}", summary: "Unpublish a public recipe (moderation takedown)", description: "Admin or moderator. Flips visibility to private — the only transition this endpoint allows.", security: adminSecurity, request: { params: idParam, body: { content: { "application/json": { schema: UnpublishRecipeRef } }, required: true } }, responses: { 200: { description: "Unpublished", content: { "application/json": { schema: z.object({ ok: z.boolean() }) } } }, 400: { description: "Validation error", content: { "application/json": { schema: ApiErrorRef } } }, 403: { description: "Forbidden", content: { "application/json": { schema: ApiErrorRef } } }, 404: { description: "Not found", content: { "application/json": { schema: ApiErrorRef } } } } });
 
   registry.registerPath({ method: "get", path: "/api/v1/admin/support", summary: "List all support tickets, newest first", description: "Admin only.", security: adminSecurity, responses: { 200: { description: "Tickets", content: { "application/json": { schema: z.array(AdminSupportTicketRef) } } }, 401: { description: "Unauthorized", content: { "application/json": { schema: ApiErrorRef } } }, 403: { description: "Forbidden", content: { "application/json": { schema: ApiErrorRef } } } } });
   registry.registerPath({ method: "patch", path: "/api/v1/admin/support/{id}", summary: "Update a support ticket's status, or retry opening its Gitea issue", description: "Admin only. A status change to/from \"closed\" also best-effort closes/reopens the linked Gitea issue.", security: adminSecurity, request: { params: idParam, body: { content: { "application/json": { schema: UpdateAdminSupportTicketRef } }, required: true } }, responses: { 200: { description: "Updated", content: { "application/json": { schema: z.object({ ok: z.boolean() }) } } }, 400: { description: "Validation error", content: { "application/json": { schema: ApiErrorRef } } }, 401: { description: "Unauthorized", content: { "application/json": { schema: ApiErrorRef } } }, 403: { description: "Forbidden", content: { "application/json": { schema: ApiErrorRef } } }, 404: { description: "Not found", content: { "application/json": { schema: ApiErrorRef } } } } });
@@ -901,7 +904,7 @@ export function generateOpenApiSpec(): object {
   registry.registerPath({ method: "delete", path: "/api/v1/admin/webhooks/{id}", summary: "Delete a site-wide ops webhook", description: "Admin only.", security: adminSecurity, request: { params: idParam }, responses: { 204: { description: "Deleted" }, 401: { description: "Unauthorized", content: { "application/json": { schema: ApiErrorRef } } }, 403: { description: "Forbidden", content: { "application/json": { schema: ApiErrorRef } } }, 404: { description: "Not found", content: { "application/json": { schema: ApiErrorRef } } } } });
   registry.registerPath({ method: "get", path: "/api/v1/admin/webhooks/{id}/deliveries", summary: "List recent delivery attempts for a site-wide ops webhook (most recent 20)", description: "Admin only.", security: adminSecurity, request: { params: idParam }, responses: { 200: { description: "Deliveries, newest first", content: { "application/json": { schema: z.array(AdminWebhookDeliveryRef) } } }, 401: { description: "Unauthorized", content: { "application/json": { schema: ApiErrorRef } } }, 403: { description: "Forbidden", content: { "application/json": { schema: ApiErrorRef } } }, 404: { description: "Not found", content: { "application/json": { schema: ApiErrorRef } } } } });
   registry.registerPath({ method: "post", path: "/api/v1/admin/webhooks/{id}/redeliver", summary: "Re-send a past delivery's payload for a site-wide ops webhook", description: "Admin only.", security: adminSecurity, request: { params: idParam, body: { content: { "application/json": { schema: z.object({ deliveryId: z.string().uuid() }) } }, required: true } }, responses: { 200: { description: "Redelivery dispatched", content: { "application/json": { schema: z.object({ ok: z.boolean() }) } } }, 400: { description: "Validation error", content: { "application/json": { schema: ApiErrorRef } } }, 401: { description: "Unauthorized", content: { "application/json": { schema: ApiErrorRef } } }, 403: { description: "Forbidden", content: { "application/json": { schema: ApiErrorRef } } }, 404: { description: "Webhook or delivery not found", content: { "application/json": { schema: ApiErrorRef } } } } });
-  registry.registerPath({ method: "patch", path: "/api/v1/admin/reports/{id}", summary: "Resolve a report (mark reviewed or dismissed)", description: "Admin only.", security: adminSecurity, request: { params: idParam, body: { content: { "application/json": { schema: ResolveReportBodyRef } }, required: true } }, responses: { 200: { description: "Updated", content: { "application/json": { schema: z.object({ report: ResolvedReportRef }) } } }, 400: { description: "Invalid status", content: { "application/json": { schema: ApiErrorRef } } }, 403: { description: "Forbidden", content: { "application/json": { schema: ApiErrorRef } } }, 404: { description: "Not found", content: { "application/json": { schema: ApiErrorRef } } } } });
+  registry.registerPath({ method: "patch", path: "/api/v1/admin/reports/{id}", summary: "Resolve a report (mark reviewed or dismissed)", description: "Admin or moderator.", security: adminSecurity, request: { params: idParam, body: { content: { "application/json": { schema: ResolveReportBodyRef } }, required: true } }, responses: { 200: { description: "Updated", content: { "application/json": { schema: z.object({ report: ResolvedReportRef }) } } }, 400: { description: "Invalid status", content: { "application/json": { schema: ApiErrorRef } } }, 403: { description: "Forbidden", content: { "application/json": { schema: ApiErrorRef } } }, 404: { description: "Not found", content: { "application/json": { schema: ApiErrorRef } } } } });
 
   registry.registerPath({ method: "put", path: "/api/v1/admin/settings", summary: "Update site settings (AI provider keys, VAPID keys, signups toggle)", description: "Admin only. Secret-flagged keys are encrypted at rest and never echoed back by any endpoint; this route only accepts new values, it does not return current ones.", security: adminSecurity, request: { body: { content: { "application/json": { schema: UpdateSiteSettingsRef } }, required: true } }, responses: { 200: { description: "Saved", content: { "application/json": { schema: z.object({ ok: z.boolean() }) } } }, 401: { description: "Unauthorized", content: { "application/json": { schema: ApiErrorRef } } }, 403: { description: "Forbidden", content: { "application/json": { schema: ApiErrorRef } } } } });
 

apps/web/lib/require-admin-page.ts

@@ -0,0 +1,29 @@
+import { redirect } from "next/navigation";
+import { headers } from "next/headers";
+import { auth } from "@/lib/auth/server";
+import { db, users, eq } from "@epicure/db";
+
+export type StaffRole = "admin" | "moderator";
+
+/** Server-component equivalent of requireAdmin/lib/api-auth.ts — used by
+ * admin/layout.tsx to gate entry to the whole /admin tree (admin AND
+ * moderator both pass) and by individual page components that need to
+ * additionally restrict themselves to admin only. Always re-queries the
+ * role fresh, same reasoning as requireAdmin: session.user.role comes from
+ * a 5-minute cookieCache. */
+export async function getStaffRole(): Promise<StaffRole | null> {
+  const session = await auth.api.getSession({ headers: await headers() });
+  if (!session) return null;
+  const [dbUser] = await db.select({ role: users.role }).from(users).where(eq(users.id, session.user.id)).limit(1);
+  if (dbUser?.role === "admin" || dbUser?.role === "moderator") return dbUser.role;
+  return null;
+}
+
+/** Redirects moderators to /admin/reports (their only allowed landing area)
+ * and non-staff to /recipes. Call at the top of any admin page that should
+ * stay admin-only. */
+export async function requireFullAdminPage(): Promise<void> {
+  const role = await getStaffRole();
+  if (role === "moderator") redirect("/admin/reports");
+  if (role !== "admin") redirect("/recipes");
+}

apps/web/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@epicure/web",
-  "version": "0.65.3",
+  "version": "0.66.0",
   "private": true,
   "scripts": {
     "dev": "next dev",

apps/web/public/sw.js

@@ -117,3 +117,38 @@ async function replayPendingActions() {
 self.addEventListener("sync", event => {
   if (event.tag === SYNC_TAG) event.waitUntil(replayPendingActions());
 });
+
+// --- Push: display incoming notifications and handle taps ---
+// lib/push.ts sends {title, body, url} as the payload. Without a "push"
+// listener, a push message reaches the browser but never displays anything
+// — showNotification() must be called explicitly.
+self.addEventListener("push", event => {
+  let data = {};
+  try {
+    data = event.data ? event.data.json() : {};
+  } catch {
+    data = {};
+  }
+  const title = data.title || "Epicure";
+  event.waitUntil(
+    self.registration.showNotification(title, {
+      body: data.body || "",
+      icon: "/icon-192.svg",
+      badge: "/icon-192.svg",
+      data: { url: data.url || "/" },
+    })
+  );
+});
+
+self.addEventListener("notificationclick", event => {
+  event.notification.close();
+  const url = event.notification.data && event.notification.data.url ? event.notification.data.url : "/";
+  event.waitUntil(
+    self.clients.matchAll({ type: "window", includeUncontrolled: true }).then(clientList => {
+      const targetUrl = new URL(url, self.location.origin).href;
+      const existing = clientList.find(c => c.url === targetUrl);
+      if (existing) return existing.focus();
+      return self.clients.openWindow(url);
+    })
+  );
+});

package.json

@@ -1,6 +1,6 @@
 {
   "name": "epicure",
-  "version": "0.65.3",
+  "version": "0.66.0",
   "private": true,
   "scripts": {
     "dev": "pnpm --filter web dev",