feat(admin): real hard-delete user button + auth.db writable handle

The existing "Delete data" button on the admin user-detail page was a
forwarder to an apps/api endpoint that doesn't exist, so clicks did
nothing beyond writing an audit row. Tim repeatedly needs to recycle
the same test phone number during the WhatsApp pool-join debug, which
the soft-delete left blocked because the user + phone_otp + rate_limit
rows all stayed put. Replaces the fake soft-delete with a real
hard-delete that mirrors the SQL Tim was running by hand.

lib/db.ts
  - New authDbWritable() parallel to gameDbWritable(); read handles
    stay readonly so accidental writes through gameDb()/authDb() fail.

lib/live.ts
  - hardDeleteUser(userId): single transaction per DB. Wipes
      auth.session, auth.phone_otp (by phone), auth.rate_limit
      (by phone digits), auth.user, game.brackets,
      game.syndicate_owners_membership.
  - For each *active* membership removed, decrements
    syndicates.member_count atomically inside the same txn (pending /
    denied rows never bumped it, so they don't decrement here).
  - Returns counts + per-syndicate decrement record for the audit log.

app/api/users/[id]/data/route.ts
  - Replaces the apps/api forwarder with a direct call to
    hardDeleteUser. Still gated to super-admin only; writes a
    user.hard_delete audit entry capturing deletion counts +
    member_count decrements.

app/(authed)/users/[id]/Customer360Tabs.tsx
  - Renames button "Delete data" → "Delete user", confirm-dialog body
    rewritten to spell out the full wipe scope and that it cannot be
    undone. Existing confirm phrase (type the user id verbatim) is
    kept as the friction step. On success, bounces to /users (the
    detail page would 404 on the now-gone id).

Signed-off-by: Tim Thomas <0800tim@gmail.com>

Author: 0800tim

apps/admin/app/(authed)/users/[id]/Customer360Tabs.tsx

@@ -80,7 +80,7 @@ export function Customer360Tabs({ userId, data, role, profileSlot }: Customer360
               className="text-xs px-2 py-1 rounded bg-danger-600 hover:bg-danger-500 text-ink-50"
               data-testid="delete-data-btn"
             >
-              Delete data
+              Delete user
             </button>
           )}
         </div>
@@ -128,10 +128,10 @@ export function Customer360Tabs({ userId, data, role, profileSlot }: Customer360
 
       {confirmDelete && (
         <ConfirmDialog
-          title="Delete user data?"
-          body={`Soft-deletes the user record, predictions, and personal data for ${userId}.\n\nThis is reversible within 30 days via the audit log; after that the row is hard-purged.`}
+          title="Delete user permanently?"
+          body={`HARD deletes ${userId} across auth.db + game.db: the user row, all sessions, OTP + rate-limit state for their phone, every bracket they've saved, and every pool membership (with member_count decremented for any active pools).\n\nThis cannot be undone. Type the user id below to confirm.`}
           confirmPhrase={userId}
-          confirmLabel={busy ? "Deleting..." : "Delete data"}
+          confirmLabel={busy ? "Deleting…" : "Delete user"}
           destructive
           onCancel={() => setConfirmDelete(false)}
           onConfirm={async () => {
@@ -142,10 +142,16 @@ export function Customer360Tabs({ userId, data, role, profileSlot }: Customer360
                 method: "DELETE",
               });
               if (!r.ok) {
-                setError(`Delete failed (${r.status}).`);
+                const body = (await r.json().catch(() => ({}))) as {
+                  error?: string;
+                };
+                setError(`Delete failed (${r.status}${body.error ? `: ${body.error}` : ""}).`);
                 return;
               }
               setConfirmDelete(false);
+              // Bounce to the users list — the detail page would 404
+              // immediately on this id anyway.
+              window.location.href = "/users";
             } finally {
               setBusy(false);
             }

apps/admin/app/api/users/[id]/data/route.ts

@@ -1,17 +1,27 @@
 /**
- * DELETE /api/users/[id]/data — soft-delete a user's data.
+ * DELETE /api/users/[id]/data — HARD delete a user across auth.db +
+ * game.db. Gated to super-admin and audited.
  *
- * Gated to super-admin. The actual delete propagates to apps/api (which is
- * responsible for cascading the soft-delete across game-service, crm-bridge,
- * social-publisher etc. — the dashboard never deletes upstream data
- * directly). The dashboard simply records the request in its audit log and
- * forwards to apps/api `/v1/admin/users/:id/data`.
+ * Previously this was a soft-delete forwarder to apps/api (which is a
+ * stub), so the button on the user-detail page did nothing meaningful.
+ * Tim 2026-06-05: real testing of the WhatsApp pool-join flow requires
+ * being able to repeatedly recycle the same phone number, so we now do
+ * the hard delete locally via `hardDeleteUser` in lib/live.ts. Mirrors
+ * the SQL pattern used by the one-off shell delete that triggered this.
+ *
+ * Wipe scope:
+ *   - auth.db: session, phone_otp (by phone), rate_limit (by phone), user
+ *   - game.db: brackets, syndicate_owners_membership
+ *   - game.db: syndicates.member_count -1 per *active* membership removed
+ *
+ * Irreversible. The confirm modal on the client requires typing the
+ * user_id verbatim before the button fires.
  */
 
 import { NextResponse, type NextRequest } from "next/server";
 import { writeAudit } from "@/lib/audit";
 import { readSession } from "@/lib/auth";
-import { upstreamGet } from "@/lib/upstream-fetch";
+import { hardDeleteUser } from "@/lib/live";
 
 export const runtime = "nodejs";
 export const dynamic = "force-dynamic";
@@ -26,34 +36,25 @@ export async function DELETE(_req: NextRequest, props: { params: Promise<{ id: s
     return NextResponse.json({ error: "forbidden" }, { status: 403 });
   }
 
-  const apiBase = process.env.VTORN_API_BASE ?? "http://localhost:3310";
-  // We use upstreamGet only for its swallowing semantics — but a DELETE needs
-  // an explicit fetch. Inline the same swallow-on-error pattern.
-  let upstreamOk = true;
-  try {
-    const r = await fetch(
-      `${apiBase}/v1/admin/users/${encodeURIComponent(params.id)}/data`,
-      { method: "DELETE", cache: "no-store" },
-    );
-    upstreamOk = r.ok;
-  } catch {
-    upstreamOk = false;
+  const userId = (params.id ?? "").trim();
+  if (!userId) {
+    return NextResponse.json({ error: "bad_request" }, { status: 400 });
   }
-  // Reference upstreamGet so the import isn't dead while we keep its
-  // signature available for future GET-based health checks.
-  void upstreamGet;
+
+  const outcome = hardDeleteUser(userId);
 
   await writeAudit(session, {
-    action: "user.data.delete",
-    target: params.id,
-    after: { soft_deleted: true, upstream_ok: upstreamOk },
+    action: "user.hard_delete",
+    target: userId,
+    after: {
+      status: outcome.status,
+      deleted: outcome.deleted,
+      member_count_decrements: outcome.member_count_decrements,
+    },
   });
 
-  if (!upstreamOk) {
-    return NextResponse.json(
-      { ok: false, error: "upstream_unavailable", queued: true },
-      { status: 202 },
-    );
-  }
-  return NextResponse.json({ ok: true });
+  return NextResponse.json({
+    ok: outcome.status === "deleted",
+    ...outcome,
+  });
 }

apps/admin/lib/db.ts

@@ -29,6 +29,7 @@ function resolveDbPath(envKey: string, fallback: string): string {
 }
 
 let _authDb: DB | null = null;
+let _authDbRw: DB | null = null;
 let _gameDb: DB | null = null;
 let _gameDbRw: DB | null = null;
 let _oddsDb: DB | null = null;
@@ -84,6 +85,25 @@ export function gameDbWritable(): DB | null {
   return _gameDbRw;
 }
 
+/**
+ * Writable auth.db connection. Mirrors {@link gameDbWritable}'s
+ * rationale: kept separate from the readonly handle so accidental
+ * writes through the read path still fail fast. Used by admin actions
+ * that delete user records (see hardDeleteUser in lib/live.ts).
+ */
+export function authDbWritable(): DB | null {
+  if (_authDbRw) return _authDbRw;
+  const p = resolveDbPath("ADMIN_AUTH_DB_PATH", "apps/auth-sms/data/auth.db");
+  if (!existsSync(p)) {
+    // eslint-disable-next-line no-console
+    console.warn(`[admin/db] auth.db not found at ${p}; admin writes disabled`);
+    return null;
+  }
+  _authDbRw = new Database(p, { readonly: false, fileMustExist: true });
+  _authDbRw.pragma("journal_mode = WAL");
+  return _authDbRw;
+}
+
 export function oddsDb(): DB | null {
   if (_oddsDb) return _oddsDb;
   const p = resolveDbPath(

apps/admin/lib/live.ts

@@ -18,6 +18,7 @@
 
 import {
   authDb,
+  authDbWritable,
   gameDb,
   gameDbWritable,
   oddsDb,
@@ -655,6 +656,155 @@ export function removeMemberFromSyndicate(
   };
 }
 
+// ---------------- user hard-delete ------------------------------------
+
+export interface DeletedCounts {
+  user: number;
+  sessions: number;
+  phone_otp: number;
+  rate_limit: number;
+  brackets: number;
+  pool_memberships: number;
+}
+
+export interface DeleteUserOutcome {
+  status: "deleted" | "not_found";
+  user_id: string;
+  phone: string | null;
+  deleted: DeletedCounts;
+  /** Pools whose cached member_count was decremented because the user
+   *  had an *active* membership row in them. Pending / denied rows
+   *  don't bump the counter on insert so they don't decrement here. */
+  member_count_decrements: Array<{ slug: string; new_count: number }>;
+}
+
+/**
+ * Hard-delete a user across auth.db + game.db. The button in the admin
+ * user-detail page calls this through `/api/users/[id]/data`. Use with
+ * care — irreversible. The flow Tim's testing repeatedly during the
+ * pool-join debug needed this because phone numbers are unique-per-user
+ * and the old soft-delete left rows that blocked re-test.
+ *
+ * Cleanup matrix (in transaction per DB):
+ *   auth.session                   → DELETE WHERE user_id
+ *   auth.phone_otp                 → DELETE WHERE phone
+ *   auth.rate_limit                → DELETE WHERE key LIKE phone digits
+ *   auth.user                      → DELETE WHERE id
+ *   game.brackets                  → DELETE WHERE user_id
+ *   game.syndicate_owners_membership → DELETE WHERE user_id
+ *   game.syndicates.member_count   → -1 per active membership row deleted
+ *
+ * Tables we deliberately DON'T touch:
+ *   - game.users (legacy view) — unused write path
+ *   - game.bracket_import_audit / user_api_keys — not joined by user_id
+ *     on the deletion contract; safe to keep as historical record
+ *   - auth.email_otp — phone-keyed flow only for now
+ */
+export function hardDeleteUser(userId: string): DeleteUserOutcome {
+  const adb = authDbWritable();
+  const gdb = gameDbWritable();
+  const counts: DeletedCounts = {
+    user: 0,
+    sessions: 0,
+    phone_otp: 0,
+    rate_limit: 0,
+    brackets: 0,
+    pool_memberships: 0,
+  };
+  const decrements: Array<{ slug: string; new_count: number }> = [];
+
+  // Resolve phone first; we need it for phone-keyed cleanups even after
+  // the `user` row is gone.
+  let phone: string | null = null;
+  if (adb) {
+    const row = adb
+      .prepare(`SELECT phone FROM user WHERE id = ?`)
+      .get(userId) as { phone: string | null } | undefined;
+    phone = row?.phone?.trim() || null;
+  }
+
+  // game.db cleanup runs first so we can capture which pools owe a
+  // member_count decrement. Pending / denied rows don't count.
+  if (gdb) {
+    const txn = gdb.transaction(() => {
+      // Find active memberships before deleting them so we know which
+      // syndicate counters to decrement.
+      const activeMemberships = gdb
+        .prepare(
+          `SELECT s.id AS syndicate_id, s.slug
+             FROM syndicate_owners_membership m
+             JOIN syndicates s ON s.id = m.syndicate_id
+            WHERE m.user_id = ?
+              AND (m.status IS NULL OR m.status = 'active')`,
+        )
+        .all(userId) as Array<{ syndicate_id: string; slug: string }>;
+
+      counts.brackets = gdb
+        .prepare(`DELETE FROM brackets WHERE user_id = ?`)
+        .run(userId).changes ?? 0;
+
+      counts.pool_memberships = gdb
+        .prepare(`DELETE FROM syndicate_owners_membership WHERE user_id = ?`)
+        .run(userId).changes ?? 0;
+
+      // Decrement member_count for each active membership we just removed.
+      const decStmt = gdb.prepare(
+        `UPDATE syndicates
+            SET member_count = MAX(0, member_count - 1)
+          WHERE id = ?
+        RETURNING slug, member_count`,
+      );
+      for (const m of activeMemberships) {
+        const r = decStmt.get(m.syndicate_id) as
+          | { slug: string; member_count: number }
+          | undefined;
+        if (r) decrements.push({ slug: r.slug, new_count: r.member_count });
+      }
+    });
+    txn();
+  }
+
+  // auth.db cleanup. Phone-keyed rows clear regardless of user-row hit
+  // so we don't leak OTP / rate-limit state on a no-op delete.
+  if (adb) {
+    const txn = adb.transaction(() => {
+      counts.sessions = adb
+        .prepare(`DELETE FROM session WHERE user_id = ?`)
+        .run(userId).changes ?? 0;
+      if (phone) {
+        counts.phone_otp = adb
+          .prepare(`DELETE FROM phone_otp WHERE phone = ?`)
+          .run(phone).changes ?? 0;
+        // rate_limit.key is shaped like 'phone:642...:otp-issued'; LIKE
+        // matches without anchoring the wrapping prefix/suffix.
+        const phoneDigits = phone.replace(/^\+/, "");
+        counts.rate_limit = adb
+          .prepare(`DELETE FROM rate_limit WHERE key LIKE ?`)
+          .run(`%${phoneDigits}%`).changes ?? 0;
+      }
+      counts.user = adb
+        .prepare(`DELETE FROM user WHERE id = ?`)
+        .run(userId).changes ?? 0;
+    });
+    txn();
+  }
+
+  const hit =
+    counts.user +
+      counts.brackets +
+      counts.pool_memberships +
+      counts.sessions >
+    0;
+
+  return {
+    status: hit ? "deleted" : "not_found",
+    user_id: userId,
+    phone,
+    deleted: counts,
+    member_count_decrements: decrements,
+  };
+}
+
 // ---------------- API keys ---------------------------------------------
 
 interface ApiKeyDbRow {