Add owner-only room backup snapshots and audited exports

app/admin/backups/page.tsx

@@ -0,0 +1,47 @@
+'use client';
+
+import { useEffect, useState } from 'react';
+import { AdminBackups } from '@/components/admin-backups';
+import { Button } from '@/components/ui/button';
+import { ClientRequestError, requestJson } from '@/lib/client-request';
+import '../admin.css';
+
+type Account = { id: string; role: 'owner' | 'operator' | 'viewer' };
+const errorMessage = (error: unknown) => error instanceof Error ? error.message : 'Administrator access could not be checked.';
+
+export default function BackupsPage() {
+  const [owner, setOwner] = useState<Account | null>(null);
+  const [loading, setLoading] = useState(true);
+  const [notice, setNotice] = useState('');
+  const [revision, setRevision] = useState(0);
+  useEffect(() => {
+    let canceled = false;
+    requestJson<{ admin: Account }>('/api/admin/session', { cache: 'no-store' })
+      .then(result => {
+        if (canceled) return;
+        if (result.admin?.role !== 'owner' || !result.admin.id) {
+          setOwner(null);
+          setNotice('Room backups are available only to an owner. Sign in with an owner account to continue.');
+        } else { setOwner(result.admin); setNotice(''); }
+      })
+      .catch(error => { if (!canceled) {
+        setOwner(null);
+        setNotice(error instanceof ClientRequestError && error.status === 401
+          ? 'Administrator sign-in required. Sign in to administration with an owner account.' : errorMessage(error));
+      } })
+      .finally(() => { if (!canceled) setLoading(false); });
+    return () => { canceled = true; };
+  }, [revision]);
+
+  return <main className="admin-shell">
+    <header className="admin-header"><div><a className="admin-return" href="/admin">Administration</a><h1>Room backups</h1></div>
+      <Button variant="outline" disabled={loading} onClick={() => { setOwner(null); setLoading(true); setRevision(value => value + 1); }}>Check access again</Button></header>
+    <p>Owner-only snapshots preserve a room without changing live play. Backups cannot be restored from this page.</p>
+    <p role="note" className="admin-notice">Privacy: downloaded snapshots contain private game state and may contain access credentials. Keep files secure; do not share them with players or upload them to public storage. This page shows metadata only, never the snapshot contents.</p>
+    {notice && <p role="alert" className="admin-notice">{notice}</p>}
+    {loading ? <output>Checking owner access…</output> : owner ?
+      <AdminBackups key={owner.id} accountId={owner.id} onDenied={() => {
+        setOwner(null); setNotice('Owner access changed or expired. Sign in again before using room backups.');
+      }} /> : <p><a className="admin-room-link" href="/admin">Sign in to administration</a></p>}
+  </main>;
+}

app/admin/page.tsx

@@ -124,6 +124,7 @@ export default function Administration() {
       <section aria-labelledby="admin-rooms-title">
         <div className="admin-section-heading"><div><h2 id="admin-rooms-title">Rooms</h2><p className="admin-secondary">Public room details. Cards, sealed choices and private discussion stay hidden.</p></div>
           <div className="admin-room-actions">{account.role !== 'viewer' && <Button disabled={controlsBusy} onClick={() => { setSelectedDiscussion(null); setSelectedSeatAi(null); setSelectedRoom(null); setSelectedLobby(null); setSelectedRemoval(null); setSelectedClosure(null); setSelectedArchive(null); setCreatingRoom(true); }}>Create a room</Button>}
+            {account.role === 'owner' && <a className="admin-room-link" href="/admin/backups">Room backups</a>}
             <Button variant="outline" disabled={controlsBusy} onClick={() => void load(applied, directory?.page ?? 1)}><RefreshCw aria-hidden="true" /> Refresh</Button></div></div>
         {creatingRoom && account.role !== 'viewer' && <AdminRoomCreation key={account.id} accountId={account.id}
           onClose={() => setCreatingRoom(false)} onDenied={accessChanged} onBusyChange={setOperationBusy}

app/api/admin/backups/[id]/download/route.ts

@@ -0,0 +1,24 @@
+import { env } from 'cloudflare:workers';
+import { AdminError, requireAdmin } from '@/db/admin-access';
+import { downloadAdminBackup } from '@/db/admin-backups';
+import { adminFailure, adminToken } from '@/lib/admin-http';
+
+export async function GET(request: Request, context: { params: Promise<{ id: string }> }) {
+  try {
+    const identity = await requireAdmin(env.DB, adminToken(request), ['owner']);
+    const expected = request.headers.get('X-Dune-Admin-Id');
+    if (expected !== null && expected !== identity.id)
+      throw new AdminError('The signed-in administrator changed. Reload administration before continuing.', 401);
+    const { id } = await context.params;
+    const { backup, payload } = await downloadAdminBackup(env.DB, identity, id);
+    return new Response(payload, {
+      headers: {
+        'Content-Type': 'application/json; charset=utf-8',
+        'Content-Disposition': `attachment; filename="dune-room-${backup.roomCode}-backup-${backup.id}.json"`,
+        'Cache-Control': 'no-store',
+        'Vary': 'Cookie',
+        'X-Content-Type-Options': 'nosniff',
+      },
+    });
+  } catch (error) { return adminFailure(error); }
+}

app/api/admin/backups/route.ts

@@ -0,0 +1,31 @@
+import { env } from 'cloudflare:workers';
+import { AdminError, requireAdmin } from '@/db/admin-access';
+import { captureAdminBackup, listAdminBackups, validBackupInput } from '@/db/admin-backups';
+import { adminBody, adminFailure, adminResponse, adminToken } from '@/lib/admin-http';
+
+function matchIdentity(request: Request, id: string, mutation: boolean) {
+  const header = request.headers.get('X-Dune-Admin-Id');
+  if ((mutation || header !== null) && header !== id)
+    throw new AdminError('The signed-in administrator changed. Reload administration before continuing.', 401);
+}
+
+export async function GET(request: Request) {
+  try {
+    const identity = await requireAdmin(env.DB, adminToken(request), ['owner']);
+    matchIdentity(request, identity.id, false);
+    const search = new URL(request.url).searchParams;
+    if ([...search.keys()].some(key => key !== 'room') || search.getAll('room').length !== 1)
+      throw new AdminError('Enter exactly one room code.', 400);
+    return adminResponse({ backups: await listAdminBackups(env.DB, identity, search.get('room') ?? '') });
+  } catch (error) { return adminFailure(error); }
+}
+
+export async function POST(request: Request) {
+  try {
+    const input = await adminBody(request, env.DUNE_PUBLIC_ORIGIN);
+    const identity = await requireAdmin(env.DB, adminToken(request), ['owner']);
+    matchIdentity(request, identity.id, true);
+    if (!validBackupInput(input)) throw new AdminError('Provide a room, current version, operation identifier and operational reason.', 400);
+    return adminResponse(await captureAdminBackup(env.DB, identity, input));
+  } catch (error) { return adminFailure(error); }
+}