fix(web): address PR review feedback on admin members page (ATB-43)

apps/web/src/lib/session.ts

···
   );
 }
 
-/** Permission strings that constitute "any admin access". */
+/**
+ * Permission strings that constitute "any admin access".
+ * Used to gate the /admin landing page.
+ *
+ * Note: `manageRoles` is intentionally absent. It is always exercised
+ * through the /admin/members page, which requires `manageMembers` to access.
+ * A user with only `manageRoles` would see the landing page but no nav cards,
+ * which is confusing UX. `manageMembers` (already listed) covers that case.
+ */
 const ADMIN_PERMISSIONS = [
   "space.atbb.permission.manageMembers",
   "space.atbb.permission.manageCategories",

apps/web/src/routes/__tests__/admin.test.tsx

···
     const html = await res.text();
     expect(html).toContain("error-display");
   });
+
+  it("redirects to /login when AppView members returns 401 (session expired)", async () => {
+    setupSession(["space.atbb.permission.manageMembers"]);
+    mockFetch.mockResolvedValueOnce(mockResponse({}, false, 401));
+
+    const routes = await loadAdminRoutes();
+    const res = await routes.request("/admin/members", {
+      headers: { cookie: "atbb_session=token" },
+    });
+
+    expect(res.status).toBe(302);
+    expect(res.headers.get("location")).toBe("/login");
+  });
+
+  it("renders page with empty role dropdown when roles fetch fails", async () => {
+    setupSession([
+      "space.atbb.permission.manageMembers",
+      "space.atbb.permission.manageRoles",
+    ]);
+    // members fetch succeeds
+    mockFetch.mockResolvedValueOnce(
+      mockResponse({ members: SAMPLE_MEMBERS, isTruncated: false })
+    );
+    // roles fetch fails
+    mockFetch.mockResolvedValueOnce(mockResponse({}, false, 500));
+
+    const routes = await loadAdminRoutes();
+    const res = await routes.request("/admin/members", {
+      headers: { cookie: "atbb_session=token" },
+    });
+
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    // Page still renders with member data
+    expect(html).toContain("alice.bsky.social");
+    // Assign Role column still present (permission says yes, just no options)
+    expect(html).toContain("hx-post");
+  });
 });
 
 describe("createAdminRoutes — POST /admin/members/:did/role", () => {
···
       expect.stringContaining("/api/admin/members/did:plc:bob/role"),
       expect.anything()
     );
+  });
+
+  it("returns row with session-expired error when AppView returns 401", async () => {
+    setupPostSession();
+    mockFetch.mockResolvedValueOnce(mockResponse({}, false, 401));
+
+    const routes = await loadAdminRoutes();
+    const res = await routes.request("/admin/members/did:plc:bob/role", {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        cookie: "atbb_session=token",
+      },
+      body: makeFormBody(),
+    });
+
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    expect(html).toContain("member-row__error");
+    expect(html).toContain("session has expired");
+  });
+
+  it("returns error row with reload message when rolesJson is malformed", async () => {
+    setupPostSession();
+
+    const routes = await loadAdminRoutes();
+    const res = await routes.request("/admin/members/did:plc:bob/role", {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        cookie: "atbb_session=token",
+      },
+      body: makeFormBody({ rolesJson: "not-valid-json{{" }),
+    });
+
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    expect(html).toContain("member-row__error");
+    expect(html).toContain("reload");
+    // No AppView call should have been made
+    // (setupPostSession consumed 2 calls, then we check no more were made)
+    expect(mockFetch).toHaveBeenCalledTimes(2);
   });
 });

apps/web/src/routes/admin.tsx

···
         <span class="role-badge">{member.role}</span>
       </td>
       <td>{formatJoinedDate(member.joinedAt)}</td>
-      {showRoleControls && (
+      {showRoleControls ? (
         <td>
           <form
             hx-post={`/admin/members/${member.did}/role`}
···
             <input type="hidden" name="joinedAt" value={member.joinedAt ?? ""} />
             <input type="hidden" name="currentRole" value={member.role} />
             <input type="hidden" name="currentRoleUri" value={member.roleUri ?? ""} />
-            <input type="hidden" name="canManageRoles" value="1" />
             <input type="hidden" name="rolesJson" value={JSON.stringify(roles)} />
             <div class="member-row__assign-form">
               <label class="sr-only" for={`role-${member.did}`}>
···
             {errorMsg && <span class="member-row__error">{errorMsg}</span>}
           </form>
         </td>
+      ) : (
+        errorMsg && (
+          <td>
+            <span class="member-row__error">{errorMsg}</span>
+          </td>
+        )
       )}
     </tr>
   );
···
     }
 
     if (!membersRes.ok) {
+      if (membersRes.status === 401) {
+        return c.redirect("/login");
+      }
       logger.error("AppView returned error for members list", {
         operation: "GET /admin/members",
         status: membersRes.status,
···
       members: MemberEntry[];
       isTruncated: boolean;
     };
-    const rolesData = rolesRes?.ok
-      ? ((await rolesRes.json()) as { roles: RoleEntry[] })
-      : null;
+    let rolesData: { roles: RoleEntry[] } | null = null;
+    if (rolesRes?.ok) {
+      try {
+        rolesData = (await rolesRes.json()) as { roles: RoleEntry[] };
+      } catch (error) {
+        if (!(error instanceof SyntaxError)) throw error;
+        logger.error("Malformed JSON from AppView roles response", {
+          operation: "GET /admin/members",
+        });
+      }
+    } else if (rolesRes) {
+      logger.error("AppView returned error for roles list", {
+        operation: "GET /admin/members",
+        status: rolesRes.status,
+      });
+    }
 
     const members = membersData.members;
     const roles = rolesData?.roles ?? [];
···
     let body: Record<string, string | File>;
     try {
       body = await c.req.parseBody();
-    } catch {
+    } catch (error) {
+      if (isProgrammingError(error)) throw error;
+      logger.error("Failed to parse form body", {
+        operation: "POST /admin/members/:did/role",
+        targetDid,
+      });
       return c.html(
         <tr>
           <td colspan={4}>
···
       typeof body.currentRoleUri === "string" && body.currentRoleUri
         ? body.currentRoleUri
         : null;
-    const showRoleControls = body.canManageRoles === "1";
+    const showRoleControls = canManageRoles(auth);
 
     let roles: RoleEntry[] = [];
     try {
       const rolesJson = typeof body.rolesJson === "string" ? body.rolesJson : "[]";
       roles = JSON.parse(rolesJson) as RoleEntry[];
-    } catch {
-      // roles stays empty — row renders without dropdown
+    } catch (error) {
+      if (!(error instanceof SyntaxError)) throw error;
+      logger.warn("Malformed rolesJson in POST body", {
+        operation: "POST /admin/members/:did/role",
+        targetDid,
+      });
+      return c.html(
+        <MemberRow
+          member={{ did: targetDid, handle, role: currentRole, roleUri: currentRoleUri, joinedAt }}
+          roles={[]}
+          showRoleControls={false}
+          errorMsg="Role data was corrupted. Please reload the page."
+        />
+      );
     }
 
     if (!roleUri) {
···
     }
 
     if (appviewRes.ok) {
-      const data = (await appviewRes.json()) as { roleAssigned: string; targetDid: string };
+      let data: { roleAssigned: string; targetDid: string };
+      try {
+        data = (await appviewRes.json()) as { roleAssigned: string; targetDid: string };
+      } catch (error) {
+        if (!(error instanceof SyntaxError)) throw error;
+        logger.error("Malformed JSON from AppView role assignment response", {
+          operation: "POST /admin/members/:did/role",
+          targetDid,
+        });
+        return c.html(
+          <MemberRow
+            member={{ did: targetDid, handle, role: currentRole, roleUri: currentRoleUri, joinedAt }}
+            roles={roles}
+            showRoleControls={showRoleControls}
+            errorMsg="Something went wrong. Please try again."
+          />
+        );
+      }
       const newRoleName = data.roleAssigned || currentRole;
       return c.html(
         <MemberRow