fix(auth): gate admin routes on the decoded path and in the actions themselves

The hooks gate tested the raw `event.url.pathname`, but SvelteKit matches
routes on the decoded path, so a logged-in member could reach /admin (and
reset the admin's password) via /%61dmin. Decode the pathname the same way
before every check, and stop relying on the route gate alone: each admin
load and action now calls requireAdmin, and the mutating actions require a
member target so the admin account can never be renamed, reset, or
deactivated from /admin.

src/hooks.server.ts

@@ -1,4 +1,5 @@
 import { dev } from '$app/environment';
+import { decodePathname } from '$lib/server/auth/decode-path';
 import { SAFE_NEXT } from '$lib/server/auth/safe-next';
 import { SESSION_COOKIE, verifySessionToken } from '$lib/server/auth/session';
 import { getApp } from '$lib/server/app';
@@ -23,7 +24,14 @@ export const handle: Handle = async ({ event, resolve }) => {
 		}
 	}
 
-	const path = event.url.pathname;
+	// SvelteKit matches routes on the decoded pathname, so every check below must use it too:
+	// gating on the raw pathname lets `/%61dmin` slip past the admin check and still hit /admin.
+	let path: string;
+	try {
+		path = decodePathname(event.url.pathname);
+	} catch {
+		error(400, 'Malformed URL');
+	}
 	const user = event.locals.user;
 
 	if (!user) {

src/lib/server/auth/decode-path.ts

@@ -0,0 +1,8 @@
+/**
+ * Decode a URL pathname the way SvelteKit does before matching routes: every
+ * segment between literal `%25` sequences is decoded, so `/%61dmin` becomes
+ * `/admin`. Throws `URIError` on a malformed escape sequence.
+ */
+export function decodePathname(pathname: string): string {
+	return pathname.split('%25').map(decodeURIComponent).join('%25');
+}

src/lib/server/auth/guards.ts

@@ -0,0 +1,17 @@
+import { error } from '@sveltejs/kit';
+import type { User } from '../../domain/types';
+import { UsersRepo, UserValidationError } from '../users/repository';
+
+/** Every admin load/action calls this; the route gate in hooks is defence in depth, not the check. */
+export function requireAdmin(locals: App.Locals): User {
+	const user = locals.user;
+	if (!user || user.role !== 'admin') error(403, 'Admins only');
+	return user;
+}
+
+/** Admin mutations may only target members: the admin's own account is managed via /me. */
+export function requireMemberTarget(users: UsersRepo, id: string): User {
+	const user = users.byId(id);
+	if (!user || user.role !== 'member') throw new UserValidationError('Unknown user', 'id');
+	return user;
+}

src/routes/admin/+page.server.ts

@@ -1,11 +1,13 @@
 import { toPublicUser } from '$lib/domain/types';
+import { requireAdmin, requireMemberTarget } from '$lib/server/auth/guards';
 import { UserValidationError } from '$lib/server/users/repository';
 import { fail } from '@sveltejs/kit';
 import type { Actions, PageServerLoad } from './$types';
 
-export const load: PageServerLoad = ({ locals }) => ({
-	members: locals.app.users.members().map(toPublicUser)
-});
+export const load: PageServerLoad = ({ locals }) => {
+	requireAdmin(locals);
+	return { members: locals.app.users.members().map(toPublicUser) };
+};
 
 function handle<T, E extends Record<string, unknown>>(fn: () => Promise<T>, extra: E) {
 	return fn().catch((e) => {
@@ -17,6 +19,7 @@ function handle<T, E extends Record<string, unknown>>(fn: () => Promise<T>, extr
 
 export const actions: Actions = {
 	create: async ({ request, locals }) => {
+		requireAdmin(locals);
 		const form = await request.formData();
 		const username = String(form.get('username') ?? '');
 		const displayName = String(form.get('displayName') ?? '');
@@ -30,11 +33,13 @@ export const actions: Actions = {
 		);
 	},
 	rename: async ({ request, locals }) => {
+		requireAdmin(locals);
 		const form = await request.formData();
 		const id = String(form.get('id') ?? '');
 		const displayName = String(form.get('displayName') ?? '');
 		return handle(
 			async () => {
+				requireMemberTarget(locals.app.users, id);
 				await locals.app.users.rename(id, displayName);
 				return { renamed: id };
 			},
@@ -42,11 +47,13 @@ export const actions: Actions = {
 		);
 	},
 	resetPassword: async ({ request, locals }) => {
+		requireAdmin(locals);
 		const form = await request.formData();
 		const id = String(form.get('id') ?? '');
 		const password = String(form.get('password') ?? '');
 		return handle(
 			async () => {
+				requireMemberTarget(locals.app.users, id);
 				await locals.app.users.setPassword(id, password, { mustChange: true });
 				return { reset: id };
 			},
@@ -54,11 +61,16 @@ export const actions: Actions = {
 		);
 	},
 	setActive: async ({ request, locals }) => {
+		requireAdmin(locals);
 		const form = await request.formData();
 		const id = String(form.get('id') ?? '');
-		const active = form.get('active') === 'true';
+		const raw = form.get('active');
+		if (raw !== 'true' && raw !== 'false')
+			return fail(400, { action: 'setActive', id, error: 'Invalid request', field: 'active' });
+		const active = raw === 'true';
 		return handle(
 			async () => {
+				requireMemberTarget(locals.app.users, id);
 				await locals.app.users.setActive(id, active);
 				return { toggled: id };
 			},

src/routes/admin/+page.svelte

@@ -6,6 +6,15 @@
 	let { data, form }: PageProps = $props();
 	const errorFor = (action: string, id?: string) =>
 		form?.action === action && (id === undefined || form?.id === id) ? form?.error : undefined;
+	// An error whose id matches no listed member has no inline slot to appear in; show it here
+	// rather than letting the failure pass silently.
+	const orphanError = $derived(
+		form?.error &&
+			form?.action !== 'create' &&
+			!data.members.some((m) => m.id === form?.id)
+			? form.error
+			: undefined
+	);
 </script>
 
 <main class="space-y-6 p-4">
@@ -14,6 +23,8 @@
 		<a href="/admin/storage" class="text-sm text-green-700 underline">Storage</a>
 	</header>
 
+	<FormError message={orphanError} />
+
 	<section class="rounded-xl bg-white p-4 shadow-sm">
 		<h2 class="mb-3 font-semibold">Add user</h2>
 		<form method="POST" action="?/create" use:enhance class="space-y-3">

src/routes/admin/storage/+page.server.ts

@@ -1,7 +1,9 @@
+import { requireAdmin } from '$lib/server/auth/guards';
 import { fail } from '@sveltejs/kit';
 import type { Actions, PageServerLoad } from './$types';
 
 export const load: PageServerLoad = ({ locals }) => {
+	requireAdmin(locals);
 	const { ledger, compaction, config, guard } = locals.app;
 	return {
 		stats: ledger.stats(),
@@ -17,11 +19,13 @@ export const load: PageServerLoad = ({ locals }) => {
 
 export const actions: Actions = {
 	compact: async ({ locals }) => {
+		requireAdmin(locals);
 		try {
 			const result = await locals.app.runCompaction();
 			return { result };
 		} catch (e) {
-			return fail(500, { error: e instanceof Error ? e.message : String(e) });
+			console.error('compaction failed', e);
+			return fail(500, { error: 'Compaction failed; see server logs' });
 		}
 	}
 };

tests/e2e/smoke.spec.ts

@@ -138,6 +138,16 @@ test('settle up records a payment and clears the debt; delete works', async ({ p
 	await login(page, 'bob', 'temppass1');
 	await changePassword(page, 'temppass1', 'bobpass123');
 
+	// A member cannot reach the admin routes, not even through a percent-encoded path that
+	// SvelteKit decodes back to /admin before matching.
+	expect((await page.request.get('/%61dmin')).status()).toBe(403);
+	expect((await page.request.get('/%61dmin/storage')).status()).toBe(403);
+	const stolen = await page.request.post('/%61dmin?/resetPassword', {
+		form: { id: 'u_admin', password: 'ownedadmin1' },
+		headers: { origin: 'http://localhost:4173' }
+	});
+	expect(stolen.status()).toBe(403);
+
 	await page.goto('/balances');
 	await expect(page.getByText('You owe', { exact: true })).toBeVisible();
 	await page.getByRole('link', { name: 'Settle up' }).click();

tests/unit/auth/guards.test.ts

@@ -0,0 +1,75 @@
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { decodePathname } from '../../../src/lib/server/auth/decode-path';
+import { requireAdmin, requireMemberTarget } from '../../../src/lib/server/auth/guards';
+import { LocalFsStore } from '../../../src/lib/server/storage/local-fs-store';
+import { UsersRepo, UserValidationError } from '../../../src/lib/server/users/repository';
+import type { User } from '../../../src/lib/domain/types';
+
+const localsFor = (user: User | null) => ({ user }) as unknown as App.Locals;
+
+describe('requireAdmin', () => {
+	const admin = { id: 'u_admin', role: 'admin' } as User;
+	const member = { id: 'u_bob', role: 'member' } as User;
+
+	it('returns the admin', () => {
+		expect(requireAdmin(localsFor(admin))).toBe(admin);
+	});
+
+	it('rejects members and anonymous requests with 403', () => {
+		for (const user of [member, null]) {
+			expect(() => requireAdmin(localsFor(user))).toThrowError(
+				expect.objectContaining({ status: 403 })
+			);
+		}
+	});
+});
+
+describe('requireMemberTarget', () => {
+	let dir: string;
+	let repo: UsersRepo;
+	let bobId: string;
+	const clock = () => new Date('2026-08-29T12:00:00.000Z');
+
+	beforeEach(async () => {
+		dir = await mkdtemp(join(tmpdir(), 'splitwise-guards-'));
+		repo = await UsersRepo.load(new LocalFsStore(dir), { clock });
+		bobId = (await repo.create({ username: 'bob', displayName: 'Bob', password: 'temppass1' })).id;
+	});
+	afterEach(() => rm(dir, { recursive: true, force: true }));
+
+	it('returns the member', () => {
+		expect(requireMemberTarget(repo, bobId).username).toBe('bob');
+	});
+
+	it('rejects unknown ids and the admin account', () => {
+		for (const id of ['', 'u_nope', 'u_admin']) {
+			expect(() => requireMemberTarget(repo, id)).toThrowError(UserValidationError);
+			try {
+				requireMemberTarget(repo, id);
+			} catch (e) {
+				expect((e as UserValidationError).message).toBe('Unknown user');
+				expect((e as UserValidationError).field).toBe('id');
+			}
+		}
+	});
+});
+
+describe('decodePathname', () => {
+	it('decodes escapes the way SvelteKit matches routes', () => {
+		expect(decodePathname('/%61dmin')).toBe('/admin');
+		expect(decodePathname('/%61dmin/storage')).toBe('/admin/storage');
+		expect(decodePathname('/a%2Fb')).toBe('/a/b');
+		expect(decodePathname('/admin')).toBe('/admin');
+	});
+
+	it('leaves an encoded percent sign intact', () => {
+		expect(decodePathname('/x%25y')).toBe('/x%25y');
+	});
+
+	it('throws on a malformed escape', () => {
+		expect(() => decodePathname('/%zz')).toThrowError(URIError);
+	});
+});