feat(web): admin moderation UI — lock, hide, ban actions in topic view (ATB-24) (#48)

apps/appview/src/routes/__tests__/admin.test.ts

···
 
 vi.mock("../../middleware/auth.js", () => ({
   requireAuth: vi.fn(() => async (c: any, next: any) => {
+    if (!mockUser) {
+      return c.json({ error: "Unauthorized" }, 401);
+    }
     c.set("user", mockUser);
     await next();
   }),
···
       });
     });
   });
+  describe.sequential("GET /api/admin/members/me", () => {
+    beforeEach(async () => {
+      // Clean database to ensure no data pollution from other tests
+      await ctx.cleanDatabase();
+
+      // Re-insert forum (deleted by cleanDatabase)
+      await ctx.db.insert(forums).values({
+        did: ctx.config.forumDid,
+        rkey: "self",
+        cid: "bafytest",
+        name: "Test Forum",
+        description: "A test forum",
+        indexedAt: new Date(),
+      });
+
+      // Set mock user
+      mockUser = { did: "did:plc:test-me" };
+    });
+
+    it("returns 401 when not authenticated", async () => {
+      mockUser = null; // signals the requireAuth mock to return 401
+      const res = await app.request("/api/admin/members/me");
+      expect(res.status).toBe(401);
+    });
+
+    it("returns 404 when authenticated user has no membership record", async () => {
+      // mockUser is set to did:plc:test-me but no membership record exists
+      const res = await app.request("/api/admin/members/me");
+
+      expect(res.status).toBe(404);
+      const data = await res.json();
+      expect(data.error).toBe("Membership not found");
+    });
+
+    it("returns 200 with membership, role, and permissions for a user with a linked role", async () => {
+      // Insert role
+      await ctx.db.insert(roles).values({
+        did: ctx.config.forumDid,
+        rkey: "moderator",
+        cid: "bafymoderator",
+        name: "Moderator",
+        description: "Moderator role",
+        permissions: ["space.atbb.permission.createPosts", "space.atbb.permission.editPosts"],
+        priority: 20,
+        createdAt: new Date(),
+        indexedAt: new Date(),
+      });
+
+      // Insert user
+      await ctx.db.insert(users).values({
+        did: "did:plc:test-me",
+        handle: "me.test",
+        indexedAt: new Date(),
+      }).onConflictDoNothing();
+
+      // Insert membership linked to role
+      await ctx.db.insert(memberships).values({
+        did: "did:plc:test-me",
+        rkey: "self",
+        cid: "bafymembership",
+        forumUri: `at://${ctx.config.forumDid}/space.atbb.forum.forum/self`,
+        roleUri: `at://${ctx.config.forumDid}/space.atbb.forum.role/moderator`,
+        joinedAt: new Date("2026-01-15T00:00:00.000Z"),
+        createdAt: new Date(),
+        indexedAt: new Date(),
+      }).onConflictDoNothing();
+
+      const res = await app.request("/api/admin/members/me");
+
+      expect(res.status).toBe(200);
+      const data = await res.json();
+      expect(data).toMatchObject({
+        did: "did:plc:test-me",
+        handle: "me.test",
+        role: "Moderator",
+        roleUri: `at://${ctx.config.forumDid}/space.atbb.forum.role/moderator`,
+        permissions: ["space.atbb.permission.createPosts", "space.atbb.permission.editPosts"],
+      });
+    });
+
+    it("returns 200 with empty permissions array when membership exists but role has no permissions", async () => {
+      // Insert role with empty permissions
+      await ctx.db.insert(roles).values({
+        did: ctx.config.forumDid,
+        rkey: "guest-role",
+        cid: "bafyguestrole",
+        name: "Guest Role",
+        description: "Role with no permissions",
+        permissions: [],
+        priority: 100,
+        createdAt: new Date(),
+        indexedAt: new Date(),
+      });
+
+      // Insert user
+      await ctx.db.insert(users).values({
+        did: "did:plc:test-me",
+        handle: "me.test",
+        indexedAt: new Date(),
+      }).onConflictDoNothing();
+
+      // Insert membership linked to role
+      await ctx.db.insert(memberships).values({
+        did: "did:plc:test-me",
+        rkey: "self",
+        cid: "bafymembership",
+        forumUri: `at://${ctx.config.forumDid}/space.atbb.forum.forum/self`,
+        roleUri: `at://${ctx.config.forumDid}/space.atbb.forum.role/guest-role`,
+        joinedAt: new Date(),
+        createdAt: new Date(),
+        indexedAt: new Date(),
+      }).onConflictDoNothing();
+
+      const res = await app.request("/api/admin/members/me");
+
+      expect(res.status).toBe(200);
+      const data = await res.json();
+      expect(data.permissions).toEqual([]);
+      expect(data.role).toBe("Guest Role");
+    });
+
+    it("only returns the current user's membership, not other users'", async () => {
+      // Insert role
+      await ctx.db.insert(roles).values({
+        did: ctx.config.forumDid,
+        rkey: "admin",
+        cid: "bafyadmin",
+        name: "Admin",
+        description: "Admin role",
+        permissions: ["*"],
+        priority: 10,
+        createdAt: new Date(),
+        indexedAt: new Date(),
+      });
+
+      // Insert current user with membership
+      await ctx.db.insert(users).values({
+        did: "did:plc:test-me",
+        handle: "me.test",
+        indexedAt: new Date(),
+      }).onConflictDoNothing();
+
+      await ctx.db.insert(memberships).values({
+        did: "did:plc:test-me",
+        rkey: "self",
+        cid: "bafymymembership",
+        forumUri: `at://${ctx.config.forumDid}/space.atbb.forum.forum/self`,
+        roleUri: `at://${ctx.config.forumDid}/space.atbb.forum.role/admin`,
+        joinedAt: new Date(),
+        createdAt: new Date(),
+        indexedAt: new Date(),
+      }).onConflictDoNothing();
+
+      // Insert another user with a different role
+      await ctx.db.insert(users).values({
+        did: "did:plc:test-other",
+        handle: "other.test",
+        indexedAt: new Date(),
+      }).onConflictDoNothing();
+
+      await ctx.db.insert(memberships).values({
+        did: "did:plc:test-other",
+        rkey: "self",
+        cid: "bafyothermembership",
+        forumUri: `at://${ctx.config.forumDid}/space.atbb.forum.forum/self`,
+        roleUri: null,
+        joinedAt: new Date(),
+        createdAt: new Date(),
+        indexedAt: new Date(),
+      }).onConflictDoNothing();
+
+      const res = await app.request("/api/admin/members/me");
+
+      expect(res.status).toBe(200);
+      const data = await res.json();
+      // Should return only our user's data
+      expect(data.did).toBe("did:plc:test-me");
+      expect(data.handle).toBe("me.test");
+      expect(data.role).toBe("Admin");
+    });
+
+    it("returns 'Guest' as role when membership has no roleUri", async () => {
+      const forumUri = `at://${ctx.config.forumDid}/space.atbb.forum.forum/self`;
+      await ctx.db.insert(users).values({
+        did: "did:plc:test-guest",
+        handle: "guest.bsky.social",
+        indexedAt: new Date(),
+      });
+      await ctx.db.insert(memberships).values({
+        did: "did:plc:test-guest",
+        rkey: "guestrkey",
+        cid: "bafymembership-guest",
+        forumUri,
+        roleUri: null,
+        joinedAt: new Date(),
+        createdAt: new Date(),
+        indexedAt: new Date(),
+      });
+
+      mockUser = { did: "did:plc:test-guest" };
+      const res = await app.request("/api/admin/members/me");
+      expect(res.status).toBe(200);
+      const data = await res.json();
+      expect(data.did).toBe("did:plc:test-guest");
+      expect(data.role).toBe("Guest");
+      expect(data.roleUri).toBeNull();
+      expect(data.permissions).toEqual([]);
+    });
+  });
+
 });
+

apps/appview/src/routes/admin.ts

···
 import { requirePermission, getUserRole } from "../middleware/permissions.js";
 import { memberships, roles, users, forums } from "@atbb/db";
 import { eq, and, sql, asc } from "drizzle-orm";
-import { isNetworkError } from "../lib/errors.js";
+import { isNetworkError, isProgrammingError } from "../lib/errors.js";
 
 export function createAdminRoutes(ctx: AppContext) {
   const app = new Hono<{ Variables: Variables }>();
···
         return c.json({ error: "Invalid roleUri format" }, 400);
       }
 
-      // Validate role exists
-      const [role] = await ctx.db
-        .select()
-        .from(roles)
-        .where(
-          and(
-            eq(roles.did, ctx.config.forumDid),
-            eq(roles.rkey, roleRkey)
+      try {
+        // Validate role exists
+        const [role] = await ctx.db
+          .select()
+          .from(roles)
+          .where(
+            and(
+              eq(roles.did, ctx.config.forumDid),
+              eq(roles.rkey, roleRkey)
+            )
           )
-        )
-        .limit(1);
+          .limit(1);
 
-      if (!role) {
-        return c.json({ error: "Role not found" }, 404);
-      }
+        if (!role) {
+          return c.json({ error: "Role not found" }, 404);
+        }
 
-      // Priority check: Can't assign role with equal or higher authority
-      const assignerRole = await getUserRole(ctx, user.did);
-      if (!assignerRole) {
-        return c.json({ error: "You do not have a role assigned" }, 403);
-      }
+        // Priority check: Can't assign role with equal or higher authority
+        const assignerRole = await getUserRole(ctx, user.did);
+        if (!assignerRole) {
+          return c.json({ error: "You do not have a role assigned" }, 403);
+        }
 
-      if (role.priority <= assignerRole.priority) {
-        return c.json({
-          error: "Cannot assign role with equal or higher authority",
-          yourPriority: assignerRole.priority,
-          targetRolePriority: role.priority
-        }, 403);
-      }
+        if (role.priority <= assignerRole.priority) {
+          return c.json({
+            error: "Cannot assign role with equal or higher authority",
+            yourPriority: assignerRole.priority,
+            targetRolePriority: role.priority
+          }, 403);
+        }
 
-      // Get target user's membership
-      const [membership] = await ctx.db
-        .select()
-        .from(memberships)
-        .where(eq(memberships.did, targetDid))
-        .limit(1);
+        // Get target user's membership
+        const [membership] = await ctx.db
+          .select()
+          .from(memberships)
+          .where(eq(memberships.did, targetDid))
+          .limit(1);
 
-      if (!membership) {
-        return c.json({ error: "User is not a member of this forum" }, 404);
-      }
+        if (!membership) {
+          return c.json({ error: "User is not a member of this forum" }, 404);
+        }
 
-      // Fetch forum CID for membership record
-      const [forum] = await ctx.db
-        .select({ cid: forums.cid })
-        .from(forums)
-        .where(eq(forums.did, ctx.config.forumDid))
-        .limit(1);
+        // Fetch forum CID for membership record
+        const [forum] = await ctx.db
+          .select({ cid: forums.cid })
+          .from(forums)
+          .where(eq(forums.did, ctx.config.forumDid))
+          .limit(1);
 
-      if (!forum) {
-        return c.json({ error: "Forum record not found in database" }, 500);
-      }
+        if (!forum) {
+          return c.json({ error: "Forum record not found in database" }, 500);
+        }
 
-      // Get ForumAgent for PDS write operations
-      if (!ctx.forumAgent) {
-        return c.json({
-          error: "Forum agent not available. Server configuration issue.",
-        }, 500);
-      }
+        // Get ForumAgent for PDS write operations
+        if (!ctx.forumAgent) {
+          return c.json({
+            error: "Forum agent not available. Server configuration issue.",
+          }, 500);
+        }
 
-      const agent = ctx.forumAgent.getAgent();
-      if (!agent) {
-        return c.json({
-          error: "Forum agent not authenticated. Please try again later.",
-        }, 503);
-      }
+        const agent = ctx.forumAgent.getAgent();
+        if (!agent) {
+          return c.json({
+            error: "Forum agent not authenticated. Please try again later.",
+          }, 503);
+        }
 
-      try {
-        // Update membership record on user's PDS using ForumAgent
-        await agent.com.atproto.repo.putRecord({
-          repo: targetDid,
-          collection: "space.atbb.membership",
-          rkey: membership.rkey,
-          record: {
-            $type: "space.atbb.membership",
-            forum: { forum: { uri: membership.forumUri, cid: forum.cid } },
-            role: { role: { uri: roleUri, cid: role.cid } },
-            joinedAt: membership.joinedAt?.toISOString(),
-            createdAt: membership.createdAt.toISOString(),
-          },
-        });
+        try {
+          // Update membership record on user's PDS using ForumAgent
+          await agent.com.atproto.repo.putRecord({
+            repo: targetDid,
+            collection: "space.atbb.membership",
+            rkey: membership.rkey,
+            record: {
+              $type: "space.atbb.membership",
+              forum: { forum: { uri: membership.forumUri, cid: forum.cid } },
+              role: { role: { uri: roleUri, cid: role.cid } },
+              joinedAt: membership.joinedAt?.toISOString(),
+              createdAt: membership.createdAt.toISOString(),
+            },
+          });
 
-        return c.json({
-          success: true,
-          roleAssigned: role.name,
-          targetDid,
-        });
+          return c.json({
+            success: true,
+            roleAssigned: role.name,
+            targetDid,
+          });
+        } catch (error) {
+          if (isProgrammingError(error)) throw error;
+          console.error("Failed to assign role", {
+            operation: "POST /api/admin/members/:did/role",
+            targetDid,
+            roleUri,
+            error: error instanceof Error ? error.message : String(error),
+          });
+
+          // Classify error: network errors (503) vs server errors (500)
+          if (error instanceof Error && isNetworkError(error)) {
+            return c.json({
+              error: "Unable to reach user's PDS to update role. Please try again later.",
+            }, 503);
+          }
+
+          return c.json({
+            error: "Failed to assign role due to server error. Please contact support.",
+          }, 500);
+        }
       } catch (error) {
-        console.error("Failed to assign role", {
+        if (isProgrammingError(error)) throw error;
+        console.error("Database error during role assignment", {
           operation: "POST /api/admin/members/:did/role",
           targetDid,
           roleUri,
           error: error instanceof Error ? error.message : String(error),
         });
-
-        // Classify error: network errors (503) vs server errors (500)
-        if (error instanceof Error && isNetworkError(error)) {
-          return c.json({
-            error: "Unable to reach user's PDS to update role. Please try again later.",
-          }, 503);
-        }
-
-        return c.json({
-          error: "Failed to assign role due to server error. Please contact support.",
-        }, 500);
+        return c.json({ error: "Server error. Please try again later." }, 500);
       }
     }
   );
···
       }
     }
   );
+
+
+  /**
+   * GET /api/admin/members/me
+   *
+   * Returns the calling user's own membership, role name, and permissions.
+   * Any authenticated user may call this — no special permission required.
+   * Returns 404 if the user has no membership record for this forum.
+   */
+  app.get("/members/me", requireAuth(ctx), async (c) => {
+    const user = c.get("user")!;
+
+    try {
+      const forumUri = `at://${ctx.config.forumDid}/space.atbb.forum.forum/self`;
+      const [member] = await ctx.db
+        .select({
+          did: memberships.did,
+          handle: users.handle,
+          roleUri: memberships.roleUri,
+          roleName: roles.name,
+          permissions: roles.permissions,
+        })
+        .from(memberships)
+        .leftJoin(users, eq(memberships.did, users.did))
+        .leftJoin(
+          roles,
+          sql`${memberships.roleUri} LIKE 'at://' || ${roles.did} || '/space.atbb.forum.role/' || ${roles.rkey}`
+        )
+        .where(
+          and(
+            eq(memberships.did, user.did),
+            eq(memberships.forumUri, forumUri)
+          )
+        )
+        .limit(1);
+
+      if (!member) {
+        return c.json({ error: "Membership not found" }, 404);
+      }
+
+      return c.json({
+        did: member.did,
+        handle: member.handle || user.did,
+        role: member.roleName || "Guest",
+        roleUri: member.roleUri,
+        permissions: member.permissions || [],
+      });
+    } catch (error) {
+      if (isProgrammingError(error)) throw error;
+      console.error("Failed to get current user membership", {
+        operation: "GET /api/admin/members/me",
+        did: user.did,
+        error: error instanceof Error ? error.message : String(error),
+      });
+      return c.json(
+        { error: "Failed to retrieve your membership. Please try again later." },
+        500
+      );
+    }
+  });
 
   return app;
 }

apps/web/public/static/css/theme.css

···
   color: var(--color-text-muted);
   font-size: var(--font-size-sm);
 }
+
+/* ─── Moderation UI ──────────────────────────────────────────────────────── */
+
+.post-card__mod-actions {
+  display: flex;
+  gap: var(--space-2);
+  margin-top: var(--space-2);
+  padding-top: var(--space-2);
+  border-top: 1px solid var(--color-border);
+}
+
+.mod-btn {
+  font-size: 0.75rem;
+  padding: 0.25rem 0.6rem;
+  border: 2px solid currentColor;
+  border-radius: 0;
+  cursor: pointer;
+  background: transparent;
+  font-family: inherit;
+  font-weight: 700;
+  text-transform: uppercase;
+  letter-spacing: 0.05em;
+}
+
+.mod-btn--hide,
+.mod-btn--lock {
+  color: var(--color-danger, #d00);
+}
+
+.mod-btn--hide:hover,
+.mod-btn--lock:hover {
+  background: var(--color-danger, #d00);
+  color: #fff;
+}
+
+.mod-btn--unhide,
+.mod-btn--unlock,
+.mod-btn--ban {
+  color: var(--color-text-muted, #666);
+}
+
+.mod-btn--unhide:hover,
+.mod-btn--unlock:hover,
+.mod-btn--ban:hover {
+  background: var(--color-text-muted, #666);
+  color: #fff;
+}
+
+.topic-mod-controls {
+  margin-bottom: var(--space-4);
+}
+
+.mod-dialog {
+  border: 3px solid var(--color-border);
+  border-radius: 0;
+  padding: var(--space-6);
+  max-width: 480px;
+  width: 90vw;
+  box-shadow: 6px 6px 0 var(--color-shadow);
+  background: var(--color-bg);
+}
+
+.mod-dialog::backdrop {
+  background: rgba(0, 0, 0, 0.5);
+}
+
+.mod-dialog__title {
+  margin-top: 0;
+  margin-bottom: var(--space-4);
+  font-size: 1.25rem;
+}

apps/web/src/lib/__tests__/session.test.ts

···
 import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
-import { getSession } from "../session.js";
+import { getSession, getSessionWithPermissions, canLockTopics, canModeratePosts, canBanUsers } from "../session.js";
 
 const mockFetch = vi.fn();
 
···
     expect(result).toEqual({ authenticated: false });
   });
 });
+
+describe("getSessionWithPermissions", () => {
+  beforeEach(() => {
+    vi.stubGlobal("fetch", mockFetch);
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    mockFetch.mockReset();
+  });
+
+  it("returns unauthenticated with empty permissions when no cookie", async () => {
+    const result = await getSessionWithPermissions("http://localhost:3000");
+    expect(result).toMatchObject({ authenticated: false });
+    expect(result.permissions.size).toBe(0);
+  });
+
+  it("returns authenticated with empty permissions when members/me returns 404", async () => {
+    mockFetch.mockResolvedValueOnce({
+      ok: true,
+      json: () => Promise.resolve({ authenticated: true, did: "did:plc:abc", handle: "alice.bsky.social" }),
+    });
+    mockFetch.mockResolvedValueOnce({ ok: false, status: 404 });
+
+    const result = await getSessionWithPermissions("http://localhost:3000", "atbb_session=token");
+    expect(result).toMatchObject({ authenticated: true, did: "did:plc:abc" });
+    expect(result.permissions.size).toBe(0);
+  });
+
+  it("returns permissions as Set when members/me succeeds", async () => {
+    mockFetch.mockResolvedValueOnce({
+      ok: true,
+      json: () => Promise.resolve({ authenticated: true, did: "did:plc:mod", handle: "mod.bsky.social" }),
+    });
+    mockFetch.mockResolvedValueOnce({
+      ok: true,
+      json: () => Promise.resolve({
+        did: "did:plc:mod",
+        handle: "mod.bsky.social",
+        role: "Moderator",
+        roleUri: "at://...",
+        permissions: [
+          "space.atbb.permission.moderatePosts",
+          "space.atbb.permission.lockTopics",
+          "space.atbb.permission.banUsers",
+        ],
+      }),
+    });
+
+    const result = await getSessionWithPermissions("http://localhost:3000", "atbb_session=token");
+    expect(result.authenticated).toBe(true);
+    expect(result.permissions.has("space.atbb.permission.moderatePosts")).toBe(true);
+    expect(result.permissions.has("space.atbb.permission.lockTopics")).toBe(true);
+    expect(result.permissions.has("space.atbb.permission.banUsers")).toBe(true);
+    expect(result.permissions.has("space.atbb.permission.manageCategories")).toBe(false);
+  });
+
+  it("returns empty permissions without crashing when members/me call throws", async () => {
+    const consoleSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+    mockFetch.mockResolvedValueOnce({
+      ok: true,
+      json: () => Promise.resolve({ authenticated: true, did: "did:plc:abc", handle: "alice.bsky.social" }),
+    });
+    mockFetch.mockRejectedValueOnce(new Error("fetch failed: ECONNREFUSED"));
+
+    const result = await getSessionWithPermissions("http://localhost:3000", "atbb_session=token");
+    expect(result.authenticated).toBe(true);
+    expect(result.permissions.size).toBe(0);
+    expect(consoleSpy).toHaveBeenCalledWith(
+      expect.stringContaining("failed to fetch permissions"),
+      expect.any(Object)
+    );
+    consoleSpy.mockRestore();
+  });
+
+  it("does not log error when members/me returns 404 (expected for guests)", async () => {
+    const consoleSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+    mockFetch.mockResolvedValueOnce({
+      ok: true,
+      json: () => Promise.resolve({ authenticated: true, did: "did:plc:abc", handle: "alice.bsky.social" }),
+    });
+    mockFetch.mockResolvedValueOnce({ ok: false, status: 404 });
+
+    await getSessionWithPermissions("http://localhost:3000", "atbb_session=token");
+    expect(consoleSpy).not.toHaveBeenCalled();
+    consoleSpy.mockRestore();
+  });
+
+  it("forwards cookie header to members/me call", async () => {
+    mockFetch.mockResolvedValueOnce({
+      ok: true,
+      json: () => Promise.resolve({ authenticated: true, did: "did:plc:abc", handle: "alice.bsky.social" }),
+    });
+    mockFetch.mockResolvedValueOnce({ ok: false, status: 404 });
+
+    await getSessionWithPermissions("http://localhost:3000", "atbb_session=mytoken");
+
+    expect(mockFetch).toHaveBeenCalledTimes(2);
+    const [url, init] = mockFetch.mock.calls[1] as [string, RequestInit];
+    expect(url).toBe("http://localhost:3000/api/admin/members/me");
+    expect((init.headers as Record<string, string>)["Cookie"]).toBe("atbb_session=mytoken");
+  });
+});
+
+describe("permission helpers", () => {
+  const modSession = {
+    authenticated: true as const,
+    did: "did:plc:mod",
+    handle: "mod.bsky.social",
+    permissions: new Set([
+      "space.atbb.permission.lockTopics",
+      "space.atbb.permission.moderatePosts",
+      "space.atbb.permission.banUsers",
+    ]),
+  };
+
+  const memberSession = {
+    authenticated: true as const,
+    did: "did:plc:member",
+    handle: "member.bsky.social",
+    permissions: new Set<string>(),
+  };
+
+  const unauthSession = { authenticated: false as const, permissions: new Set<string>() };
+
+  it("canLockTopics returns true for mod", () => expect(canLockTopics(modSession)).toBe(true));
+  it("canLockTopics returns false for member", () => expect(canLockTopics(memberSession)).toBe(false));
+  it("canLockTopics returns false for unauthenticated", () => expect(canLockTopics(unauthSession)).toBe(false));
+
+  it("canModeratePosts returns true for mod", () => expect(canModeratePosts(modSession)).toBe(true));
+  it("canModeratePosts returns false for member", () => expect(canModeratePosts(memberSession)).toBe(false));
+
+  it("canBanUsers returns true for mod", () => expect(canBanUsers(modSession)).toBe(true));
+  it("canBanUsers returns false for member", () => expect(canBanUsers(memberSession)).toBe(false));
+
+  // Wildcard "*" permission — Owner role grants all permissions via the catch-all
+  const ownerSession = {
+    authenticated: true as const,
+    did: "did:plc:owner",
+    handle: "owner.bsky.social",
+    permissions: new Set(["*"]),
+  };
+
+  it("canLockTopics returns true for owner with wildcard permission", () =>
+    expect(canLockTopics(ownerSession)).toBe(true));
+  it("canModeratePosts returns true for owner with wildcard permission", () =>
+    expect(canModeratePosts(ownerSession)).toBe(true));
+  it("canBanUsers returns true for owner with wildcard permission", () =>
+    expect(canBanUsers(ownerSession)).toBe(true));
+});

apps/web/src/lib/session.ts

···
     return { authenticated: false };
   }
 }
+
+/**
+ * Extended session type that includes the user's role permissions.
+ * Used on pages that need to conditionally render moderation UI.
+ */
+export type WebSessionWithPermissions =
+  | { authenticated: false; permissions: Set<string> }
+  | { authenticated: true; did: string; handle: string; permissions: Set<string> };
+
+/**
+ * Like getSession(), but also fetches the user's role permissions from
+ * GET /api/admin/members/me. Use on pages that need to render mod buttons.
+ *
+ * Returns empty permissions on network errors or when user has no membership.
+ * Never throws — always returns a usable session.
+ */
+export async function getSessionWithPermissions(
+  appviewUrl: string,
+  cookieHeader?: string
+): Promise<WebSessionWithPermissions> {
+  const session = await getSession(appviewUrl, cookieHeader);
+
+  if (!session.authenticated) {
+    return { authenticated: false, permissions: new Set() };
+  }
+
+  let permissions = new Set<string>();
+  try {
+    const res = await fetch(`${appviewUrl}/api/admin/members/me`, {
+      headers: { Cookie: cookieHeader! },
+    });
+
+    if (res.ok) {
+      const data = (await res.json()) as Record<string, unknown>;
+      if (Array.isArray(data.permissions)) {
+        permissions = new Set(data.permissions as string[]);
+      }
+    } else if (res.status !== 404) {
+      // 404 = no membership = expected for guests, no log needed
+      console.error(
+        "getSessionWithPermissions: unexpected status from members/me",
+        {
+          operation: "GET /api/admin/members/me",
+          did: session.did,
+          status: res.status,
+        }
+      );
+    }
+  } catch (error) {
+    console.error(
+      "getSessionWithPermissions: failed to fetch permissions — continuing with empty permissions",
+      {
+        operation: "GET /api/admin/members/me",
+        did: session.did,
+        error: error instanceof Error ? error.message : String(error),
+      }
+    );
+  }
+
+  return { ...session, permissions };
+}
+
+/** Returns true if the session grants permission to lock/unlock topics. */
+export function canLockTopics(auth: WebSessionWithPermissions): boolean {
+  return (
+    auth.authenticated &&
+    (auth.permissions.has("space.atbb.permission.lockTopics") ||
+      auth.permissions.has("*"))
+  );
+}
+
+/** Returns true if the session grants permission to hide/unhide posts. */
+export function canModeratePosts(auth: WebSessionWithPermissions): boolean {
+  return (
+    auth.authenticated &&
+    (auth.permissions.has("space.atbb.permission.moderatePosts") ||
+      auth.permissions.has("*"))
+  );
+}
+
+/** Returns true if the session grants permission to ban/unban users. */
+export function canBanUsers(auth: WebSessionWithPermissions): boolean {
+  return (
+    auth.authenticated &&
+    (auth.permissions.has("space.atbb.permission.banUsers") ||
+      auth.permissions.has("*"))
+  );
+}

apps/web/src/routes/__tests__/mod.test.ts

···
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+
+const mockFetch = vi.fn();
+
+describe("createModActionRoute", () => {
+  beforeEach(() => {
+    vi.stubGlobal("fetch", mockFetch);
+    vi.stubEnv("APPVIEW_URL", "http://localhost:3000");
+    vi.resetModules();
+    // Default: AppView returns error
+    mockFetch.mockResolvedValue({ ok: false, status: 500, statusText: "Server Error" });
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    vi.unstubAllEnvs();
+    mockFetch.mockReset();
+  });
+
+  function appviewSuccess() {
+    return {
+      ok: true,
+      status: 200,
+      json: () => Promise.resolve({ success: true }),
+    };
+  }
+
+  async function loadModRoutes() {
+    const { createModActionRoute } = await import("../mod.js");
+    return createModActionRoute("http://localhost:3000");
+  }
+
+  function modFormBody(fields: Record<string, string>) {
+    return {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        cookie: "atbb_session=token",
+      },
+      body: new URLSearchParams(fields).toString(),
+    };
+  }
+
+  // ─── Input validation ────────────────────────────────────────────────────
+
+  it("returns 400 error fragment when action is missing", async () => {
+    const routes = await loadModRoutes();
+    const res = await routes.request(
+      "/mod/action",
+      modFormBody({ id: "1", reason: "test" })
+    );
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    expect(html).toContain("form-error");
+    expect(html).toContain("Unknown action");
+    expect(mockFetch).not.toHaveBeenCalled();
+  });
+
+  it("returns 400 error fragment when reason is empty", async () => {
+    const routes = await loadModRoutes();
+    const res = await routes.request(
+      "/mod/action",
+      modFormBody({ action: "lock", id: "1", reason: "" })
+    );
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    expect(html).toContain("form-error");
+    expect(html).toContain("required");
+    expect(mockFetch).not.toHaveBeenCalled();
+  });
+
+  it("returns 400 error fragment when id is missing for lock action", async () => {
+    const routes = await loadModRoutes();
+    const res = await routes.request(
+      "/mod/action",
+      modFormBody({ action: "lock", reason: "test" })
+    );
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    expect(html).toContain("form-error");
+    expect(html).toContain("required");
+    expect(mockFetch).not.toHaveBeenCalled();
+  });
+
+  // ─── Lock action ─────────────────────────────────────────────────────────
+
+  it("posts to /api/mod/lock with topicId and reason for lock action", async () => {
+    mockFetch.mockResolvedValueOnce(appviewSuccess());
+    const routes = await loadModRoutes();
+    const res = await routes.request(
+      "/mod/action",
+      modFormBody({ action: "lock", id: "42", reason: "Off-topic thread" })
+    );
+    expect(res.status).toBe(200);
+    expect(res.headers.get("HX-Refresh")).toBe("true");
+
+    const [url, init] = mockFetch.mock.calls[0] as [string, RequestInit];
+    expect(url).toBe("http://localhost:3000/api/mod/lock");
+    expect(init.method).toBe("POST");
+    const body = JSON.parse(init.body as string);
+    expect(body.topicId).toBe("42");
+    expect(body.reason).toBe("Off-topic thread");
+    expect((init.headers as Record<string, string>)["Cookie"]).toContain("atbb_session=token");
+  });
+
+  it("sends DELETE to /api/mod/lock/:id for unlock action", async () => {
+    mockFetch.mockResolvedValueOnce(appviewSuccess());
+    const routes = await loadModRoutes();
+    const res = await routes.request(
+      "/mod/action",
+      modFormBody({ action: "unlock", id: "42", reason: "Thread reopened" })
+    );
+    expect(res.status).toBe(200);
+    expect(res.headers.get("HX-Refresh")).toBe("true");
+
+    const [url, init] = mockFetch.mock.calls[0] as [string, RequestInit];
+    expect(url).toBe("http://localhost:3000/api/mod/lock/42");
+    expect(init.method).toBe("DELETE");
+  });
+
+  // ─── Hide action ─────────────────────────────────────────────────────────
+
+  it("posts to /api/mod/hide with postId and reason for hide action", async () => {
+    mockFetch.mockResolvedValueOnce(appviewSuccess());
+    const routes = await loadModRoutes();
+    const res = await routes.request(
+      "/mod/action",
+      modFormBody({ action: "hide", id: "99", reason: "Spam" })
+    );
+    expect(res.status).toBe(200);
+    expect(res.headers.get("HX-Refresh")).toBe("true");
+
+    const [url, init] = mockFetch.mock.calls[0] as [string, RequestInit];
+    expect(url).toBe("http://localhost:3000/api/mod/hide");
+    const body = JSON.parse(init.body as string);
+    expect(body.postId).toBe("99");
+  });
+
+  it("sends DELETE to /api/mod/hide/:id for unhide action", async () => {
+    mockFetch.mockResolvedValueOnce(appviewSuccess());
+    const routes = await loadModRoutes();
+    await routes.request(
+      "/mod/action",
+      modFormBody({ action: "unhide", id: "99", reason: "Reinstated" })
+    );
+    const [url, init] = mockFetch.mock.calls[0] as [string, RequestInit];
+    expect(url).toBe("http://localhost:3000/api/mod/hide/99");
+    expect(init.method).toBe("DELETE");
+  });
+
+  // ─── Ban action ──────────────────────────────────────────────────────────
+
+  it("posts to /api/mod/ban with targetDid and reason for ban action", async () => {
+    mockFetch.mockResolvedValueOnce(appviewSuccess());
+    const routes = await loadModRoutes();
+    const res = await routes.request(
+      "/mod/action",
+      modFormBody({ action: "ban", id: "did:plc:badactor", reason: "Harassment" })
+    );
+    expect(res.status).toBe(200);
+    expect(res.headers.get("HX-Refresh")).toBe("true");
+
+    const [url, init] = mockFetch.mock.calls[0] as [string, RequestInit];
+    expect(url).toBe("http://localhost:3000/api/mod/ban");
+    const body = JSON.parse(init.body as string);
+    expect(body.targetDid).toBe("did:plc:badactor");
+  });
+
+  it("sends DELETE to /api/mod/ban/:id for unban action", async () => {
+    mockFetch.mockResolvedValueOnce(appviewSuccess());
+    const routes = await loadModRoutes();
+    await routes.request(
+      "/mod/action",
+      modFormBody({ action: "unban", id: "did:plc:unbanned", reason: "Appeal accepted" })
+    );
+    const [url, init] = mockFetch.mock.calls[0] as [string, RequestInit];
+    expect(url).toBe("http://localhost:3000/api/mod/ban/did:plc:unbanned");
+    expect(init.method).toBe("DELETE");
+  });
+
+  // ─── Auth and conflict handling ──────────────────────────────────────────
+
+  it("returns error fragment when AppView returns 401 (session expired)", async () => {
+    mockFetch.mockResolvedValueOnce({
+      ok: false,
+      status: 401,
+      json: () => Promise.resolve({ error: "Unauthorized" }),
+    });
+    const routes = await loadModRoutes();
+    const res = await routes.request(
+      "/mod/action",
+      modFormBody({ action: "lock", id: "1", reason: "test" })
+    );
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    expect(html).toContain("form-error");
+    expect(html).toContain("logged in");
+    expect(res.headers.get("HX-Refresh")).toBeNull();
+  });
+
+  it("returns error fragment when AppView returns 409 (action already active)", async () => {
+    mockFetch.mockResolvedValueOnce({
+      ok: false,
+      status: 409,
+      json: () => Promise.resolve({ error: "Already locked" }),
+    });
+    const routes = await loadModRoutes();
+    const res = await routes.request(
+      "/mod/action",
+      modFormBody({ action: "lock", id: "1", reason: "test" })
+    );
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    expect(html).toContain("form-error");
+    expect(html).toContain("already active");
+    expect(res.headers.get("HX-Refresh")).toBeNull();
+  });
+
+  // ─── Error handling ──────────────────────────────────────────────────────
+
+  it("returns error fragment when AppView returns 403", async () => {
+    mockFetch.mockResolvedValueOnce({
+      ok: false,
+      status: 403,
+      json: () => Promise.resolve({ error: "Insufficient permissions" }),
+    });
+    const routes = await loadModRoutes();
+    const res = await routes.request(
+      "/mod/action",
+      modFormBody({ action: "lock", id: "1", reason: "test" })
+    );
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    expect(html).toContain("form-error");
+    expect(html).toContain("permission");
+    expect(res.headers.get("HX-Refresh")).toBeNull();
+  });
+
+  it("returns error fragment when AppView returns 503 (network error)", async () => {
+    mockFetch.mockRejectedValueOnce(new Error("fetch failed: ECONNREFUSED"));
+    const routes = await loadModRoutes();
+    const res = await routes.request(
+      "/mod/action",
+      modFormBody({ action: "hide", id: "1", reason: "test" })
+    );
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    expect(html).toContain("form-error");
+    expect(html).toContain("unavailable");
+  });
+
+  it("returns error fragment when AppView returns 500", async () => {
+    mockFetch.mockResolvedValueOnce({ ok: false, status: 500, statusText: "Internal Server Error" });
+    const routes = await loadModRoutes();
+    const res = await routes.request(
+      "/mod/action",
+      modFormBody({ action: "ban", id: "did:plc:x", reason: "test" })
+    );
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    expect(html).toContain("form-error");
+    expect(html).toContain("went wrong");
+  });
+});

apps/web/src/routes/__tests__/topics.test.tsx

···
     mockFetch.mockResolvedValueOnce(makeCategoryResponse());
   }
 
+  function membersMeNotFound() {
+    return { ok: false, status: 404 };
+  }
+
+  function membersMeMod(
+    permissions = [
+      "space.atbb.permission.moderatePosts",
+      "space.atbb.permission.lockTopics",
+      "space.atbb.permission.banUsers",
+    ]
+  ) {
+    return {
+      ok: true,
+      json: () =>
+        Promise.resolve({
+          did: "did:plc:mod",
+          handle: "mod.bsky.social",
+          role: "Moderator",
+          roleUri: "at://...",
+          permissions,
+        }),
+    };
+  }
+
   async function loadTopicsRoutes() {
     const { createTopicsRoutes } = await import("../topics.js");
     return createTopicsRoutes("http://localhost:3000");
···
       json: () =>
         Promise.resolve({ authenticated: true, did: "did:plc:user", handle: "user.bsky.social" }),
     });
+    mockFetch.mockResolvedValueOnce(membersMeNotFound());
     setupSuccessfulFetch({ locked: true });
     const routes = await loadTopicsRoutes();
     const res = await routes.request("/topics/1", {
···
           handle: "user.bsky.social",
         }),
     });
+    mockFetch.mockResolvedValueOnce(membersMeNotFound());
     setupSuccessfulFetch();
     const routes = await loadTopicsRoutes();
     const res = await routes.request("/topics/1", {
···
 
   it("shows reply form with textarea when authenticated", async () => {
     mockFetch.mockResolvedValueOnce(authSession);
+    mockFetch.mockResolvedValueOnce(membersMeNotFound());
     mockFetch.mockResolvedValueOnce(makeTopicResponse());
     const routes = await loadTopicsRoutes();
     const res = await routes.request("/topics/1", {
···
 
   it("uses hx-post for reply form submission", async () => {
     mockFetch.mockResolvedValueOnce(authSession);
+    mockFetch.mockResolvedValueOnce(membersMeNotFound());
     mockFetch.mockResolvedValueOnce(makeTopicResponse());
     const routes = await loadTopicsRoutes();
     const res = await routes.request("/topics/1", {
···
     });
     const [, fetchOptions] = mockFetch.mock.calls[0];
     expect(fetchOptions.headers["Cookie"]).toContain("atbb_session=token");
+  });
+
+  // ─── Mod actions (permission-based rendering) ────────────────────────────────
+
+  it("shows lock button for user with lockTopics permission", async () => {
+    mockFetch.mockResolvedValueOnce(authSession);
+    mockFetch.mockResolvedValueOnce(membersMeMod(["space.atbb.permission.lockTopics"]));
+    setupSuccessfulFetch();
+    const routes = await loadTopicsRoutes();
+    const res = await routes.request("/topics/1", {
+      headers: { cookie: "atbb_session=token" },
+    });
+    const html = await res.text();
+    expect(html).toContain("Lock Topic");
+    expect(html).toContain("openModDialog");
+  });
+
+  it("does not show lock button for user without lockTopics permission", async () => {
+    mockFetch.mockResolvedValueOnce(authSession);
+    mockFetch.mockResolvedValueOnce(membersMeNotFound());
+    setupSuccessfulFetch();
+    const routes = await loadTopicsRoutes();
+    const res = await routes.request("/topics/1", {
+      headers: { cookie: "atbb_session=token" },
+    });
+    const html = await res.text();
+    expect(html).not.toContain("Lock Topic");
+  });
+
+  it("shows Unlock Topic button when topic is locked and user has lockTopics permission", async () => {
+    mockFetch.mockResolvedValueOnce(authSession);
+    mockFetch.mockResolvedValueOnce(membersMeMod(["space.atbb.permission.lockTopics"]));
+    setupSuccessfulFetch({ locked: true });
+    const routes = await loadTopicsRoutes();
+    const res = await routes.request("/topics/1", {
+      headers: { cookie: "atbb_session=token" },
+    });
+    const html = await res.text();
+    expect(html).toContain("Unlock Topic");
+  });
+
+  it("shows hide button on each post for user with moderatePosts permission", async () => {
+    mockFetch.mockResolvedValueOnce(authSession);
+    mockFetch.mockResolvedValueOnce(membersMeMod(["space.atbb.permission.moderatePosts"]));
+    const reply = makeReply({ id: "2", text: "A reply" });
+    setupSuccessfulFetch({ replies: [reply] });
+    const routes = await loadTopicsRoutes();
+    const res = await routes.request("/topics/1", {
+      headers: { cookie: "atbb_session=token" },
+    });
+    const html = await res.text();
+    expect(html).toContain("Hide");
+    expect(html).toContain("openModDialog");
+  });
+
+  it("shows ban button on posts for user with banUsers permission", async () => {
+    mockFetch.mockResolvedValueOnce(authSession);
+    mockFetch.mockResolvedValueOnce(membersMeMod(["space.atbb.permission.banUsers"]));
+    setupSuccessfulFetch();
+    const routes = await loadTopicsRoutes();
+    const res = await routes.request("/topics/1", {
+      headers: { cookie: "atbb_session=token" },
+    });
+    const html = await res.text();
+    expect(html).toContain("Ban user");
+  });
+
+  it("shows mod dialog in page for users with any mod permission", async () => {
+    mockFetch.mockResolvedValueOnce(authSession);
+    mockFetch.mockResolvedValueOnce(membersMeMod());
+    setupSuccessfulFetch();
+    const routes = await loadTopicsRoutes();
+    const res = await routes.request("/topics/1", {
+      headers: { cookie: "atbb_session=token" },
+    });
+    const html = await res.text();
+    expect(html).toContain("mod-dialog");
+    expect(html).toContain("<dialog");
+  });
+
+  it("does not show any mod buttons for unauthenticated users", async () => {
+    setupSuccessfulFetch();
+    const routes = await loadTopicsRoutes();
+    const res = await routes.request("/topics/1");
+    const html = await res.text();
+    expect(html).not.toContain("Lock Topic");
+    expect(html).not.toContain("Hide");
+    expect(html).not.toContain("Ban user");
+    expect(html).not.toContain("mod-dialog");
+  });
+
+  it("ban button not rendered when post has no author", async () => {
+    // Both OP and reply have null authors — ban button requires post.author?.did
+    mockFetch.mockResolvedValueOnce(authSession);
+    mockFetch.mockResolvedValueOnce(membersMeMod(["space.atbb.permission.banUsers"]));
+    mockFetch.mockResolvedValueOnce({
+      ok: true,
+      json: () =>
+        Promise.resolve({
+          topicId: "1",
+          locked: false,
+          pinned: false,
+          post: {
+            id: "1",
+            did: "did:plc:author",
+            rkey: "tid123",
+            text: "OP text",
+            forumUri: null,
+            boardUri: null,
+            boardId: "42",
+            parentPostId: null,
+            createdAt: "2025-01-01T00:00:00.000Z",
+            author: null,
+          },
+          replies: [makeReply({ author: null })],
+        }),
+    });
+    mockFetch.mockResolvedValueOnce(makeBoardResponse());
+    mockFetch.mockResolvedValueOnce(makeCategoryResponse());
+    const routes = await loadTopicsRoutes();
+    const res = await routes.request("/topics/1", {
+      headers: { cookie: "atbb_session=token" },
+    });
+    const html = await res.text();
+    // No ban buttons when all posts have null authors
+    expect(html).not.toContain("Ban user");
+  });
+
+  it("HTMX partial renders mod buttons for authenticated moderator", async () => {
+    const allReplies = [makeReply({ id: "27", text: "HTMX partial reply" })];
+    // getSessionWithPermissions makes 2 fetches (session + members/me), then 1 for topic
+    mockFetch.mockResolvedValueOnce(authSession);
+    mockFetch.mockResolvedValueOnce(membersMeMod(["space.atbb.permission.moderatePosts"]));
+    mockFetch.mockResolvedValueOnce(makeTopicResponse({ replies: allReplies }));
+    const routes = await loadTopicsRoutes();
+    const res = await routes.request("/topics/1?offset=0", {
+      headers: { "HX-Request": "true", cookie: "atbb_session=token" },
+    });
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    expect(html).toContain("HTMX partial reply");
+    expect(html).toContain("Hide"); // mod button present in paginated partial
   });
 });

apps/web/src/routes/index.ts

···
 import { createLoginRoutes } from "./login.js";
 import { createNewTopicRoutes } from "./new-topic.js";
 import { createAuthRoutes } from "./auth.js";
+import { createModActionRoute } from "./mod.js";
 
 const config = loadConfig();
 
···
   .route("/", createTopicsRoutes(config.appviewUrl))
   .route("/", createLoginRoutes(config.appviewUrl))
   .route("/", createNewTopicRoutes(config.appviewUrl))
-  .route("/", createAuthRoutes(config.appviewUrl));
+  .route("/", createAuthRoutes(config.appviewUrl))
+  .route("/", createModActionRoute(config.appviewUrl));

apps/web/src/routes/mod.ts

···
+import { Hono } from "hono";
+import { isProgrammingError } from "../lib/errors.js";
+
+/**
+ * Single proxy endpoint for all moderation actions.
+ *
+ * Reads `action`, `id`, and `reason` from the form body and dispatches
+ * to the correct AppView mod endpoint. Returns HX-Refresh on success
+ * so HTMX reloads the current page to show updated state.
+ *
+ * Action dispatch table:
+ *   lock     → POST   /api/mod/lock            body: { topicId, reason }
+ *   unlock   → DELETE /api/mod/lock/:id        body: { reason }
+ *   hide     → POST   /api/mod/hide            body: { postId, reason }
+ *   unhide   → DELETE /api/mod/hide/:id        body: { reason }
+ *   ban      → POST   /api/mod/ban             body: { targetDid, reason }
+ *   unban    → DELETE /api/mod/ban/:id         body: { reason }
+ */
+export function createModActionRoute(appviewUrl: string) {
+  return new Hono().post("/mod/action", async (c) => {
+    let body: Record<string, string | File>;
+    try {
+      body = await c.req.parseBody();
+    } catch {
+      return c.html(`<p class="form-error">Invalid form submission.</p>`);
+    }
+
+    const action = typeof body.action === "string" ? body.action.trim() : "";
+    const id = typeof body.id === "string" ? body.id.trim() : "";
+    const reason = typeof body.reason === "string" ? body.reason.trim() : "";
+    const cookieHeader = c.req.header("cookie") ?? "";
+
+    // Validate action
+    const validActions = ["lock", "unlock", "hide", "unhide", "ban", "unban"];
+    if (!validActions.includes(action)) {
+      return c.html(`<p class="form-error">Unknown action.</p>`);
+    }
+
+    // Validate reason
+    if (!reason) {
+      return c.html(`<p class="form-error">Reason is required.</p>`);
+    }
+    if (reason.length > 3000) {
+      return c.html(`<p class="form-error">Reason must not exceed 3000 characters.</p>`);
+    }
+
+    // Validate id
+    if (!id) {
+      return c.html(`<p class="form-error">Target ID is required.</p>`);
+    }
+
+    // Build AppView request
+    let appviewEndpoint: string;
+    let method: "POST" | "DELETE";
+    let appviewBody: Record<string, string>;
+
+    switch (action) {
+      case "lock":
+        appviewEndpoint = `${appviewUrl}/api/mod/lock`;
+        method = "POST";
+        appviewBody = { topicId: id, reason };
+        break;
+      case "unlock":
+        appviewEndpoint = `${appviewUrl}/api/mod/lock/${id}`;
+        method = "DELETE";
+        appviewBody = { reason };
+        break;
+      case "hide":
+        appviewEndpoint = `${appviewUrl}/api/mod/hide`;
+        method = "POST";
+        appviewBody = { postId: id, reason };
+        break;
+      case "unhide":
+        appviewEndpoint = `${appviewUrl}/api/mod/hide/${id}`;
+        method = "DELETE";
+        appviewBody = { reason };
+        break;
+      case "ban":
+        appviewEndpoint = `${appviewUrl}/api/mod/ban`;
+        method = "POST";
+        appviewBody = { targetDid: id, reason };
+        break;
+      case "unban":
+        appviewEndpoint = `${appviewUrl}/api/mod/ban/${id}`;
+        method = "DELETE";
+        appviewBody = { reason };
+        break;
+      default:
+        return c.html(`<p class="form-error">Unknown action.</p>`);
+    }
+
+    // Forward to AppView
+    let appviewRes: Response;
+    try {
+      appviewRes = await fetch(appviewEndpoint, {
+        method,
+        headers: {
+          "Content-Type": "application/json",
+          Cookie: cookieHeader,
+        },
+        body: JSON.stringify(appviewBody),
+      });
+    } catch (error) {
+      if (isProgrammingError(error)) throw error;
+      console.error("Failed to proxy mod action to AppView", {
+        operation: `${method} ${appviewEndpoint}`,
+        action,
+        error: error instanceof Error ? error.message : String(error),
+      });
+      return c.html(
+        `<p class="form-error">Forum temporarily unavailable. Please try again.</p>`
+      );
+    }
+
+    if (appviewRes.ok) {
+      return new Response(null, {
+        status: 200,
+        headers: { "HX-Refresh": "true" },
+      });
+    }
+
+    // Handle error responses
+    let errorMessage = "Something went wrong. Please try again.";
+
+    if (appviewRes.status === 401) {
+      console.error("AppView returned 401 for mod action — session may have expired", {
+        operation: `${method} ${appviewEndpoint}`,
+        action,
+      });
+      errorMessage = "You must be logged in to perform this action.";
+    } else if (appviewRes.status === 403) {
+      console.error("AppView returned 403 for mod action — permission mismatch", {
+        operation: `${method} ${appviewEndpoint}`,
+        action,
+      });
+      errorMessage = "You don't have permission for this action.";
+    } else if (appviewRes.status === 404) {
+      errorMessage = "Target not found.";
+    } else if (appviewRes.status === 409) {
+      // 409 = already active (e.g. locking an already-locked topic)
+      errorMessage = "This action is already active.";
+    } else if (appviewRes.status >= 500) {
+      console.error("AppView returned server error for mod action", {
+        operation: `${method} ${appviewEndpoint}`,
+        action,
+        status: appviewRes.status,
+      });
+    }
+
+    return c.html(`<p class="form-error">${errorMessage}</p>`);
+  });
+}

apps/web/src/routes/topics.tsx

···
 import { BaseLayout } from "../layouts/base.js";
 import { PageHeader, EmptyState, ErrorDisplay } from "../components/index.js";
 import { fetchApi } from "../lib/api.js";
-import { getSession } from "../lib/session.js";
+import {
+  getSessionWithPermissions,
+  canLockTopics,
+  canModeratePosts,
+  canBanUsers,
+} from "../lib/session.js";
 import {
   isProgrammingError,
   isNetworkError,
···
   }
 `;
 
+const MOD_DIALOG_SCRIPT = `
+  var MOD_TITLES = {
+    lock: 'Lock Topic', unlock: 'Unlock Topic',
+    hide: 'Hide Post', unhide: 'Unhide Post',
+    ban: 'Ban User', unban: 'Unban User'
+  };
+  function openModDialog(action, id) {
+    document.getElementById('mod-dialog-action').value = action;
+    document.getElementById('mod-dialog-id').value = id;
+    document.getElementById('mod-dialog-title').textContent = MOD_TITLES[action] || 'Confirm';
+    document.getElementById('mod-dialog-error').innerHTML = '';
+    document.getElementById('mod-reason').value = '';
+    document.getElementById('mod-dialog').showModal();
+  }
+`;
+
 // ─── Inline components ────────────────────────────────────────────────────────
 
 function PostCard({
   post,
   postNumber,
   isOP = false,
+  modPerms = { canHide: false, canBan: false },
 }: {
   post: PostResponse;
   postNumber: number;
   isOP?: boolean;
+  modPerms?: { canHide: boolean; canBan: boolean };
 }) {
   const handle = post.author?.handle ?? post.author?.did ?? post.did;
   const date = post.createdAt ? timeAgo(new Date(post.createdAt)) : "unknown";
···
       <div class="post-card__body" style="white-space: pre-wrap">
         {post.text}
       </div>
+      {(modPerms.canHide || modPerms.canBan) && (
+        <div class="post-card__mod-actions">
+          {modPerms.canHide && (
+            <button
+              class="mod-btn mod-btn--hide"
+              type="button"
+              onclick={`openModDialog('hide','${post.id}')`}
+            >
+              Hide
+            </button>
+          )}
+          {modPerms.canBan && post.author?.did && (
+            <button
+              class="mod-btn mod-btn--ban"
+              type="button"
+              onclick={`openModDialog('ban','${post.author.did}')`}
+            >
+              Ban user
+            </button>
+          )}
+        </div>
+      )}
     </div>
   );
 }
 
+function ModDialog() {
+  return (
+    <dialog id="mod-dialog" class="mod-dialog">
+      <h2 id="mod-dialog-title" class="mod-dialog__title">Confirm Action</h2>
+      <form
+        hx-post="/mod/action"
+        hx-target="#mod-dialog-error"
+        hx-swap="innerHTML"
+        hx-disabled-elt="[type=submit]"
+      >
+        <input type="hidden" id="mod-dialog-action" name="action" value="" />
+        <input type="hidden" id="mod-dialog-id" name="id" value="" />
+        <div class="form-group">
+          <label for="mod-reason">Reason</label>
+          <textarea
+            id="mod-reason"
+            name="reason"
+            rows={3}
+            placeholder="Reason for this action…"
+          />
+        </div>
+        <div id="mod-dialog-error" />
+        <div class="form-actions">
+          <button type="submit" class="btn btn-danger">
+            Confirm
+          </button>
+          <button
+            type="button"
+            class="btn btn-secondary"
+            onclick="document.getElementById('mod-dialog').close()"
+          >
+            Cancel
+          </button>
+        </div>
+      </form>
+    </dialog>
+  );
+}
+
 function LoadMoreButton({
   topicId,
   nextOffset,
···
   replies,
   total,
   offset,
+  modPerms = { canHide: false, canBan: false },
 }: {
   topicId: string;
   replies: PostResponse[];
   total: number;
   offset: number;
+  modPerms?: { canHide: boolean; canBan: boolean };
 }) {
   const nextOffset = offset + replies.length;
   const hasMore = nextOffset < total;
   return (
     <>
       {replies.map((reply, i) => (
-        <PostCard key={reply.id} post={reply} postNumber={offset + i + 2} />
+        <PostCard key={reply.id} post={reply} postNumber={offset + i + 2} modPerms={modPerms} />
       ))}
       {hasMore && <LoadMoreButton topicId={topicId} nextOffset={nextOffset} />}
     </>
···
 
     // ── HTMX partial mode ────────────────────────────────────────────────────
     if (c.req.header("HX-Request")) {
+      const partialAuth = await getSessionWithPermissions(appviewUrl, c.req.header("cookie"));
+      const partialModPerms = {
+        canHide: canModeratePosts(partialAuth),
+        canBan: canBanUsers(partialAuth),
+        canLock: canLockTopics(partialAuth),
+      };
       try {
         const data = await fetchApi<TopicDetailResponse>(`/topics/${topicId}`);
         // TODO(ATB-33): switch to server-side offset/limit pagination like boards.tsx
···
             replies={pageReplies}
             total={data.replies.length}
             offset={offset}
+            modPerms={partialModPerms}
           />,
           200
         );
···
     }
 
     // ── Full page mode ────────────────────────────────────────────────────────
-    const auth = await getSession(appviewUrl, c.req.header("cookie"));
+    const auth = await getSessionWithPermissions(appviewUrl, c.req.header("cookie"));
+    const modPerms = {
+      canHide: canModeratePosts(auth),
+      canBan: canBanUsers(auth),
+      canLock: canLockTopics(auth),
+    };
+    const hasAnyModPerm = modPerms.canHide || modPerms.canBan || modPerms.canLock;
 
     // Stage 1: fetch topic (fatal on failure)
     let topicData: TopicDetailResponse;
···
 
         <PageHeader title={topicTitle} />
 
+        {modPerms.canLock && (
+          <div class="topic-mod-controls">
+            <button
+              class={`mod-btn ${topicData.locked ? "mod-btn--unlock" : "mod-btn--lock"}`}
+              type="button"
+              onclick={`openModDialog('${topicData.locked ? "unlock" : "lock"}','${topicId}')`}
+            >
+              {topicData.locked ? "Unlock Topic" : "Lock Topic"}
+            </button>
+          </div>
+        )}
+
         {topicData.locked && (
           <div class="topic-locked-banner">
             <span class="topic-locked-banner__badge">Locked</span>
···
           </div>
         )}
 
-        <PostCard post={topicData.post} postNumber={1} isOP={true} />
+        <PostCard post={topicData.post} postNumber={1} isOP={true} modPerms={modPerms} />
 
         <div id="reply-list">
           {allReplies.length === 0 ? (
···
               replies={initialReplies}
               total={total}
               offset={0}
+              modPerms={modPerms}
             />
           )}
         </div>
···
             </p>
           )}
         </div>
+
+        {hasAnyModPerm && (
+          <>
+            <ModDialog />
+            <script dangerouslySetInnerHTML={{ __html: MOD_DIALOG_SCRIPT }} />
+          </>
+        )}
       </BaseLayout>
     );
   })

docs/atproto-forum-plan.md

···
   - 421 tests total (added 78 new tests) — comprehensive coverage including auth, validation, business logic, infrastructure errors
   - Files: `apps/appview/src/routes/mod.ts` (~700 lines), `apps/appview/src/routes/__tests__/mod.test.ts` (~3414 lines), `apps/appview/src/lib/errors.ts` (error classification helpers)
   - Bruno API collection: `bruno/AppView API/Moderation/` (6 .bru files documenting all endpoints)
-- [ ] Admin UI: ban user, lock topic, hide post (ATB-24)
+- [x] **ATB-24: Admin moderation UI in web app** — **Complete:** 2026-02-19
+  - `GET /api/admin/members/me` AppView endpoint returns current user's role + permissions
+  - `getSessionWithPermissions()` + `canLockTopics()` / `canModeratePosts()` / `canBanUsers()` helpers in web session lib
+  - `POST /mod/action` web proxy route dispatches lock/unlock/hide/unhide/ban/unban to AppView
+  - Topic page renders lock button, per-post hide/ban buttons, and shared `<dialog>` confirmation modal — all gated on permissions
+  - 507 tests total across appview + web (added ~35 new tests)
 - [x] **ATB-20: Enforce mod actions in read/write-path API responses** — **Complete:** 2026-02-16
   - All API read endpoints filter soft-deleted posts (`deleted = false` in all queries)
   - All API write endpoints (topic/post create) block banned users at request time

docs/plans/2026-02-19-admin-moderation-ui-design.md

···
+# Admin Moderation UI Design (ATB-24)
+
+**Date:** 2026-02-19
+**Issue:** [ATB-24](https://linear.app/atbb/issue/ATB-24/admin-moderation-ui-in-web-app)
+**Status:** Approved
+
+## Summary
+
+Add in-context moderation action buttons to the topic view: lock/unlock a topic, hide/unhide individual posts, and ban/unban post authors. Mod buttons appear only for users with appropriate permissions. Each destructive action requires confirmation via a `<dialog>` modal with a reason field. All mod actions proxy through the web server to the AppView's existing mod API.
+
+## Scope
+
+**In scope:**
+- `GET /api/admin/members/me` endpoint on AppView (permission data for the current user)
+- Extended `WebSession` type on the web server (adds `permissions: Set<string>`)
+- Lock/unlock button on topic page header (for users with `lockTopics`)
+- Hide/unhide button on each post card (for users with `moderatePosts`)
+- Ban/unban button on each post card (for users with `banUsers`)
+- `<dialog>` confirmation modal with reason textarea, shared across all hide and ban actions
+- Web proxy routes in `apps/web/src/routes/mod.ts`
+- Visual indicators: locked topic banner (already exists), hidden post placeholder
+
+**Out of scope:**
+- Admin panel page (`/admin`)
+- Member list or role assignment UI
+- Mod action audit log
+
+## Architecture
+
+The web server acts as proxy for all mod actions, matching the established pattern from `topics.tsx` and `new-topic.tsx`. The browser communicates only with the web server (port 3001). The web server forwards requests to AppView (port 3000) with the session cookie.
+
+```
+Browser
+  → POST /mod/lock       (web server, port 3001)
+  → POST /api/mod/lock   (AppView, port 3000)
+  → Forum PDS (modAction record)
+```
+
+## Components
+
+### 1. AppView: `GET /api/admin/members/me`
+
+**File:** `apps/appview/src/routes/admin.ts`
+
+- Requires `requireAuth(ctx)` only — any authenticated member may call it
+- Returns the caller's own membership record joined with role + permissions
+- Returns 404 if no membership record exists (guest)
+
+**Response shape:**
+```json
+{
+  "did": "did:plc:abc123",
+  "handle": "alice.bsky.social",
+  "role": "Moderator",
+  "roleUri": "at://did:plc:.../space.atbb.forum.role/abc",
+  "permissions": [
+    "space.atbb.permission.moderatePosts",
+    "space.atbb.permission.lockTopics",
+    "space.atbb.permission.banUsers"
+  ]
+}
+```
+
+### 2. Web Server: Extended `WebSession`
+
+**File:** `apps/web/src/lib/session.ts`
+
+`getSession()` gains a second stage: when the user is authenticated, call `GET /api/admin/members/me` (forwarding the session cookie). On 404 or network error, treat permissions as empty.
+
+```typescript
+type WebSession =
+  | { authenticated: false }
+  | {
+      authenticated: true;
+      did: string;
+      handle: string;
+      permissions: Set<string>;
+    };
+```
+
+Helper predicates for readability:
+```typescript
+function canLockTopics(auth: WebSession): boolean
+function canModeratePosts(auth: WebSession): boolean
+function canBanUsers(auth: WebSession): boolean
+```
+
+### 3. Web Server: Mod Proxy Routes
+
+**New file:** `apps/web/src/routes/mod.ts`
+
+| Web Route | Proxies To | AppView Method |
+|-----------|-----------|----------------|
+| `POST /mod/lock` | `/api/mod/lock` | POST |
+| `POST /mod/unlock/:topicId` | `/api/mod/lock/:topicId` | DELETE |
+| `POST /mod/hide` | `/api/mod/hide` | POST |
+| `POST /mod/unhide/:postId` | `/api/mod/hide/:postId` | DELETE |
+| `POST /mod/ban` | `/api/mod/ban` | POST |
+| `POST /mod/unban/:did` | `/api/mod/ban/:did` | DELETE |
+
+All routes use `POST` from the browser (HTMX forms do not support `DELETE`). The web server translates to the correct HTTP method when calling AppView.
+
+Each route:
+1. Parses form body with `c.req.parseBody()`
+2. Validates required fields (ID + reason)
+3. Forwards to AppView with `Cookie` header
+4. Returns an HTMX fragment on success (updated button/post area)
+5. Returns `<p class="form-error">` on failure (same pattern as reply form)
+
+### 4. Topic Page Changes
+
+**File:** `apps/web/src/routes/topics.tsx`
+
+**Lock/unlock button:** Added below `PageHeader`. Visible when `canLockTopics(auth)` is true. Submits to `POST /mod/lock` or `POST /mod/unlock/:topicId`. On success, HTMX swaps the locked banner + button area.
+
+**PostCard component:** Gains a `modPerms` prop. Renders a "Mod actions" row below post content when the user has any relevant permission.
+
+```tsx
+{modPerms.canHide && (
+  <button
+    class="mod-btn mod-btn--hide"
+    onclick={`openModDialog('hide', '${post.id}')`}
+  >
+    Hide
+  </button>
+)}
+{modPerms.canBan && (
+  <button
+    class="mod-btn mod-btn--ban"
+    onclick={`openModDialog('ban', '${post.author?.did}')`}
+  >
+    Ban user
+  </button>
+)}
+```
+
+**Shared `<dialog>` element:** One dialog instance at the bottom of the page. A small inline script (`openModDialog(action, targetId)`) sets hidden `<input>` values and calls `dialog.showModal()`. On HTMX success, the dialog closes and the target element swaps in the updated fragment.
+
+### 5. Hidden Post Indicator
+
+Posts where `post.hidden === true` (once ATB-20 surfaces this flag in the API) render as:
+
+```tsx
+<div class="post-card post-card--hidden">
+  <em>[This post was hidden by a moderator.]</em>
+  {modPerms.canHide && <button ...>Unhide</button>}
+</div>
+```
+
+Note: ATB-20 already excludes hidden posts from the replies array for non-mods. For mods, the API may need a `?includeModerationData=true` flag in a future ticket — for now, unhide buttons appear on visible posts only (the hidden post is already excluded from the response for the current user).
+
+## Error Handling
+
+| Scenario | Web Server Response |
+|----------|-------------------|
+| AppView 401 | `<p class="form-error">You must be logged in.</p>` |
+| AppView 403 | `<p class="form-error">You don't have permission for this action.</p>` |
+| AppView 404 | `<p class="form-error">Target not found.</p>` |
+| AppView 503 (network) | `<p class="form-error">Forum temporarily unavailable. Please try again.</p>` |
+| AppView 500 | `<p class="form-error">Something went wrong. Please try again.</p>` |
+| Missing/invalid form fields | `<p class="form-error">[specific validation message]</p>` |
+
+## Testing
+
+### AppView (`GET /api/admin/members/me`)
+- Authenticated member with role → 200 with permissions array
+- Authenticated member with no role assigned → 200 with empty permissions
+- Authenticated user with no membership → 404
+- Unauthenticated request → 401
+
+### Web Server (`session.ts`)
+- Authenticated user with mod permissions → `permissions` Set populated
+- Authenticated user with no membership (AppView 404) → `permissions` empty Set
+- AppView unreachable for member check → `permissions` empty Set (non-fatal)
+
+### Web Server (`mod.ts`)
+- Valid lock request → 200, AppView called with correct JSON body and cookie
+- Valid hide request → 200, correct HTMX fragment returned
+- AppView returns 403 → error fragment, no crash
+- AppView returns 503 → error fragment with "try again" message
+- Missing reason field → 400, error fragment before AppView call
+- Invalid topicId → 400, error fragment before AppView call
+
+### Web Server (`topics.test.tsx`)
+- Topic rendered for user with `lockTopics` permission → lock button present
+- Topic rendered for user without mod permissions → no mod buttons
+- Locked topic → locked banner present, reply form absent
+
+## Key Files
+
+**New files:**
+- `apps/web/src/routes/mod.ts` — web proxy routes
+- `apps/web/src/routes/__tests__/mod.test.ts` — proxy route tests
+
+**Modified files:**
+- `apps/appview/src/routes/admin.ts` — add `GET /api/admin/members/me`
+- `apps/appview/src/routes/__tests__/admin.test.ts` — add tests for new endpoint
+- `apps/web/src/lib/session.ts` — extend `WebSession` with permissions
+- `apps/web/src/lib/__tests__/session.test.ts` — add permission fetch tests
+- `apps/web/src/routes/topics.tsx` — add mod buttons, dialog, lock button
+- `apps/web/src/routes/__tests__/topics.test.tsx` — add mod button tests
+- `apps/web/src/routes/index.ts` — register mod routes
+- `apps/web/src/styles/` — mod button and dialog CSS

docs/plans/2026-02-19-admin-moderation-ui.md

···
+# Admin Moderation UI Implementation Plan (ATB-24)
+
+> **For Claude:** REQUIRED SUB-SKILL: Use superpowers:executing-plans to implement this plan task-by-task.
+
+**Goal:** Add lock/unlock, hide/unhide, and ban/unban mod action buttons to the topic view, visible only to users with appropriate permissions.
+
+**Architecture:** The web server proxies all mod actions to the AppView's existing mod API (`POST/DELETE /api/mod/*`) via a single `POST /mod/action` endpoint. A new AppView endpoint (`GET /api/admin/members/me`) returns the current user's permissions. `topics.tsx` uses a new `getSessionWithPermissions()` to decide which buttons to render. Confirmation uses a shared `<dialog>` populated by a small inline script.
+
+**Tech Stack:** Hono, JSX, HTMX 2.x, Vitest, Drizzle ORM, PostgreSQL
+
+---
+
+## Task 1: AppView — `GET /api/admin/members/me`
+
+Returns the calling user's own membership + permissions. No special permission required — any authenticated user may check their own role.
+
+**Files:**
+- Modify: `apps/appview/src/routes/admin.ts`
+- Modify: `apps/appview/src/routes/__tests__/admin.test.ts`
+
+### Step 1: Write the failing test
+
+In `apps/appview/src/routes/__tests__/admin.test.ts`, add a new `describe` block after the existing ones:
+
+```typescript
+describe("GET /api/admin/members/me", () => {
+  it("returns 401 when not authenticated", async () => {
+    // The requireAuth mock auto-passes, so temporarily bypass it:
+    // We test 401 by checking the middleware is there (integration test in a separate file if needed)
+    // For now, test the success cases through the mocked middleware
+    expect(true).toBe(true); // placeholder — real auth tested at middleware level
+  });
+
+  it("returns 404 when user has no membership", async () => {
+    mockUser = { did: "did:plc:no-membership" };
+    const res = await app.request("/api/admin/members/me");
+    expect(res.status).toBe(404);
+    const data = await res.json();
+    expect(data.error).toBeDefined();
+  });
+
+  it("returns membership with role and permissions for member with role", async () => {
+    // Insert forum, user, membership, and role records
+    const forumUri = `at://${ctx.config.forumDid}/space.atbb.forum.forum/self`;
+    await ctx.db.insert(forums).values({
+      did: ctx.config.forumDid,
+      rkey: "self",
+      cid: "bafyforum",
+      name: "Test Forum",
+      description: null,
+      createdAt: new Date(),
+      indexedAt: new Date(),
+    });
+
+    await ctx.db.insert(users).values({
+      did: "did:plc:me",
+      handle: "me.bsky.social",
+      indexedAt: new Date(),
+    });
+
+    const roleRkey = "moderatorrkey";
+    await ctx.db.insert(roles).values({
+      did: ctx.config.forumDid,
+      rkey: roleRkey,
+      cid: "bafyrole",
+      name: "Moderator",
+      description: null,
+      permissions: ["space.atbb.permission.moderatePosts", "space.atbb.permission.lockTopics"],
+      priority: 20,
+      createdAt: new Date(),
+      indexedAt: new Date(),
+    });
+
+    const roleUri = `at://${ctx.config.forumDid}/space.atbb.forum.role/${roleRkey}`;
+    await ctx.db.insert(memberships).values({
+      did: "did:plc:me",
+      rkey: "membershiprkey",
+      cid: "bafymembership",
+      forumUri,
+      roleUri,
+      joinedAt: new Date(),
+      indexedAt: new Date(),
+    });
+
+    mockUser = { did: "did:plc:me" };
+    const res = await app.request("/api/admin/members/me");
+    expect(res.status).toBe(200);
+    const data = await res.json();
+    expect(data.did).toBe("did:plc:me");
+    expect(data.handle).toBe("me.bsky.social");
+    expect(data.role).toBe("Moderator");
+    expect(data.roleUri).toBe(roleUri);
+    expect(data.permissions).toContain("space.atbb.permission.moderatePosts");
+    expect(data.permissions).toContain("space.atbb.permission.lockTopics");
+  });
+
+  it("returns membership with empty permissions when role has no permissions", async () => {
+    const forumUri = `at://${ctx.config.forumDid}/space.atbb.forum.forum/self`;
+    await ctx.db.insert(forums).values({
+      did: ctx.config.forumDid,
+      rkey: "self",
+      cid: "bafyforum2",
+      name: "Test Forum",
+      description: null,
+      createdAt: new Date(),
+      indexedAt: new Date(),
+    });
+    await ctx.db.insert(users).values({
+      did: "did:plc:member",
+      handle: "member.bsky.social",
+      indexedAt: new Date(),
+    });
+    const roleRkey = "memberrkey";
+    await ctx.db.insert(roles).values({
+      did: ctx.config.forumDid,
+      rkey: roleRkey,
+      cid: "bafyrole2",
+      name: "Member",
+      description: null,
+      permissions: [],
+      priority: 30,
+      createdAt: new Date(),
+      indexedAt: new Date(),
+    });
+    const roleUri = `at://${ctx.config.forumDid}/space.atbb.forum.role/${roleRkey}`;
+    await ctx.db.insert(memberships).values({
+      did: "did:plc:member",
+      rkey: "membershiprkey2",
+      cid: "bafymembership2",
+      forumUri,
+      roleUri,
+      joinedAt: new Date(),
+      indexedAt: new Date(),
+    });
+
+    mockUser = { did: "did:plc:member" };
+    const res = await app.request("/api/admin/members/me");
+    expect(res.status).toBe(200);
+    const data = await res.json();
+    expect(data.permissions).toEqual([]);
+  });
+});
+```
+
+Also add missing imports at the top of the test file (after existing imports):
+```typescript
+import { forums } from "@atbb/db";
+```
+
+### Step 2: Run test to verify it fails
+
+```bash
+PATH=/path/to/.devenv/profile/bin:/bin:/usr/bin:$PATH \
+  pnpm --filter @atbb/appview test src/routes/__tests__/admin.test.ts
+```
+Expected: FAIL — `GET /api/admin/members/me` route doesn't exist yet.
+
+### Step 3: Implement the endpoint
+
+In `apps/appview/src/routes/admin.ts`, add the following import at the top if `forums` isn't already imported:
+
+```typescript
+import { memberships, roles, users, forums } from "@atbb/db";
+```
+
+Then add this endpoint before `return app;` at the bottom:
+
+```typescript
+/**
+ * GET /api/admin/members/me
+ *
+ * Returns the calling user's own membership, role, and permissions.
+ * Any authenticated user may call this — no special permission required.
+ * Returns 404 if the user has no membership record.
+ */
+app.get("/members/me", requireAuth(ctx), async (c) => {
+  const user = c.get("user")!;
+
+  try {
+    const forumUri = `at://${ctx.config.forumDid}/space.atbb.forum.forum/self`;
+    const [member] = await ctx.db
+      .select({
+        did: memberships.did,
+        handle: users.handle,
+        roleUri: memberships.roleUri,
+        roleName: roles.name,
+        permissions: roles.permissions,
+      })
+      .from(memberships)
+      .leftJoin(users, eq(memberships.did, users.did))
+      .leftJoin(
+        roles,
+        sql`${memberships.roleUri} LIKE 'at://' || ${roles.did} || '/space.atbb.forum.role/' || ${roles.rkey}`
+      )
+      .where(
+        and(
+          eq(memberships.did, user.did),
+          eq(memberships.forumUri, forumUri)
+        )
+      )
+      .limit(1);
+
+    if (!member) {
+      return c.json({ error: "Membership not found" }, 404);
+    }
+
+    return c.json({
+      did: member.did,
+      handle: member.handle || user.did,
+      role: member.roleName || "Member",
+      roleUri: member.roleUri,
+      permissions: member.permissions || [],
+    });
+  } catch (error) {
+    console.error("Failed to get current user membership", {
+      operation: "GET /api/admin/members/me",
+      did: user.did,
+      error: error instanceof Error ? error.message : String(error),
+    });
+    return c.json(
+      { error: "Failed to retrieve your membership. Please try again later." },
+      500
+    );
+  }
+});
+```
+
+You'll need these imports at the top of `admin.ts` if not already present: `and`, `eq`, `sql` from `drizzle-orm`.
+
+Check existing imports at the top of the file and add any missing ones:
+```typescript
+import { eq, asc, and, sql } from "drizzle-orm";
+```
+
+### Step 4: Run tests to verify they pass
+
+```bash
+PATH=/path/to/.devenv/profile/bin:/bin:/usr/bin:$PATH \
+  pnpm --filter @atbb/appview test src/routes/__tests__/admin.test.ts
+```
+Expected: all tests PASS
+
+### Step 5: Commit
+
+```bash
+git add apps/appview/src/routes/admin.ts apps/appview/src/routes/__tests__/admin.test.ts
+git commit -m "feat(appview): add GET /api/admin/members/me endpoint (ATB-24)"
+```
+
+---
+
+## Task 2: Web Server — `getSessionWithPermissions()` and permission helpers
+
+Add a new function to `session.ts` that extends authentication with permission data. Keeps the existing `getSession()` unchanged so other pages are unaffected.
+
+**Files:**
+- Modify: `apps/web/src/lib/session.ts`
+- Modify: `apps/web/src/lib/__tests__/session.test.ts`
+
+### Step 1: Write the failing tests
+
+Add to `apps/web/src/lib/__tests__/session.test.ts` (after the existing `describe("getSession", ...)` block):
+
+```typescript
+import { getSession, getSessionWithPermissions, canLockTopics, canModeratePosts, canBanUsers } from "../session.js";
+
+describe("getSessionWithPermissions", () => {
+  beforeEach(() => {
+    vi.stubGlobal("fetch", mockFetch);
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    mockFetch.mockReset();
+  });
+
+  it("returns unauthenticated with empty permissions when no cookie", async () => {
+    const result = await getSessionWithPermissions("http://localhost:3000");
+    expect(result).toMatchObject({ authenticated: false });
+    expect(result.permissions.size).toBe(0);
+  });
+
+  it("returns authenticated with empty permissions when members/me returns 404", async () => {
+    mockFetch.mockResolvedValueOnce({
+      ok: true,
+      json: () => Promise.resolve({ authenticated: true, did: "did:plc:abc", handle: "alice.bsky.social" }),
+    });
+    mockFetch.mockResolvedValueOnce({ ok: false, status: 404 });
+
+    const result = await getSessionWithPermissions("http://localhost:3000", "atbb_session=token");
+    expect(result).toMatchObject({ authenticated: true, did: "did:plc:abc" });
+    expect(result.permissions.size).toBe(0);
+  });
+
+  it("returns permissions as Set when members/me succeeds", async () => {
+    mockFetch.mockResolvedValueOnce({
+      ok: true,
+      json: () => Promise.resolve({ authenticated: true, did: "did:plc:mod", handle: "mod.bsky.social" }),
+    });
+    mockFetch.mockResolvedValueOnce({
+      ok: true,
+      json: () => Promise.resolve({
+        did: "did:plc:mod",
+        handle: "mod.bsky.social",
+        role: "Moderator",
+        roleUri: "at://...",
+        permissions: [
+          "space.atbb.permission.moderatePosts",
+          "space.atbb.permission.lockTopics",
+          "space.atbb.permission.banUsers",
+        ],
+      }),
+    });
+
+    const result = await getSessionWithPermissions("http://localhost:3000", "atbb_session=token");
+    expect(result.authenticated).toBe(true);
+    expect(result.permissions.has("space.atbb.permission.moderatePosts")).toBe(true);
+    expect(result.permissions.has("space.atbb.permission.lockTopics")).toBe(true);
+    expect(result.permissions.has("space.atbb.permission.banUsers")).toBe(true);
+    expect(result.permissions.has("space.atbb.permission.manageCategories")).toBe(false);
+  });
+
+  it("returns empty permissions without crashing when members/me call throws", async () => {
+    const consoleSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+    mockFetch.mockResolvedValueOnce({
+      ok: true,
+      json: () => Promise.resolve({ authenticated: true, did: "did:plc:abc", handle: "alice.bsky.social" }),
+    });
+    mockFetch.mockRejectedValueOnce(new Error("fetch failed: ECONNREFUSED"));
+
+    const result = await getSessionWithPermissions("http://localhost:3000", "atbb_session=token");
+    expect(result.authenticated).toBe(true);
+    expect(result.permissions.size).toBe(0);
+    expect(consoleSpy).toHaveBeenCalledWith(
+      expect.stringContaining("failed to fetch permissions"),
+      expect.any(Object)
+    );
+    consoleSpy.mockRestore();
+  });
+
+  it("does not log error when members/me returns 404 (expected for guests)", async () => {
+    const consoleSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+    mockFetch.mockResolvedValueOnce({
+      ok: true,
+      json: () => Promise.resolve({ authenticated: true, did: "did:plc:abc", handle: "alice.bsky.social" }),
+    });
+    mockFetch.mockResolvedValueOnce({ ok: false, status: 404 });
+
+    await getSessionWithPermissions("http://localhost:3000", "atbb_session=token");
+    expect(consoleSpy).not.toHaveBeenCalled();
+    consoleSpy.mockRestore();
+  });
+
+  it("forwards cookie header to members/me call", async () => {
+    mockFetch.mockResolvedValueOnce({
+      ok: true,
+      json: () => Promise.resolve({ authenticated: true, did: "did:plc:abc", handle: "alice.bsky.social" }),
+    });
+    mockFetch.mockResolvedValueOnce({ ok: false, status: 404 });
+
+    await getSessionWithPermissions("http://localhost:3000", "atbb_session=mytoken");
+
+    expect(mockFetch).toHaveBeenCalledTimes(2);
+    const [url, init] = mockFetch.mock.calls[1] as [string, RequestInit];
+    expect(url).toBe("http://localhost:3000/api/admin/members/me");
+    expect((init.headers as Record<string, string>)["Cookie"]).toBe("atbb_session=mytoken");
+  });
+});
+
+describe("permission helpers", () => {
+  const modSession = {
+    authenticated: true as const,
+    did: "did:plc:mod",
+    handle: "mod.bsky.social",
+    permissions: new Set([
+      "space.atbb.permission.lockTopics",
+      "space.atbb.permission.moderatePosts",
+      "space.atbb.permission.banUsers",
+    ]),
+  };
+
+  const memberSession = {
+    authenticated: true as const,
+    did: "did:plc:member",
+    handle: "member.bsky.social",
+    permissions: new Set<string>(),
+  };
+
+  const unauthSession = { authenticated: false as const, permissions: new Set<string>() };
+
+  it("canLockTopics returns true for mod", () => expect(canLockTopics(modSession)).toBe(true));
+  it("canLockTopics returns false for member", () => expect(canLockTopics(memberSession)).toBe(false));
+  it("canLockTopics returns false for unauthenticated", () => expect(canLockTopics(unauthSession)).toBe(false));
+
+  it("canModeratePosts returns true for mod", () => expect(canModeratePosts(modSession)).toBe(true));
+  it("canModeratePosts returns false for member", () => expect(canModeratePosts(memberSession)).toBe(false));
+
+  it("canBanUsers returns true for mod", () => expect(canBanUsers(modSession)).toBe(true));
+  it("canBanUsers returns false for member", () => expect(canBanUsers(memberSession)).toBe(false));
+});
+```
+
+Also update the import at the top of `session.test.ts` to include the new exports (they don't exist yet, so this will cause the test to fail):
+```typescript
+import { getSession, getSessionWithPermissions, canLockTopics, canModeratePosts, canBanUsers } from "../session.js";
+```
+
+### Step 2: Run tests to verify they fail
+
+```bash
+PATH=/path/to/.devenv/profile/bin:/bin:/usr/bin:$PATH \
+  pnpm --filter @atbb/web test src/lib/__tests__/session.test.ts
+```
+Expected: FAIL — `getSessionWithPermissions` not found.
+
+### Step 3: Implement the new functions
+
+In `apps/web/src/lib/session.ts`, add after the existing `WebSession` type and `getSession` function:
+
+```typescript
+/**
+ * Extended session type that includes the user's role permissions.
+ * Used on pages that need to conditionally render moderation UI.
+ */
+export type WebSessionWithPermissions =
+  | { authenticated: false; permissions: Set<string> }
+  | { authenticated: true; did: string; handle: string; permissions: Set<string> };
+
+/**
+ * Like getSession(), but also fetches the user's role permissions from
+ * GET /api/admin/members/me. Use on pages that need to render mod buttons.
+ *
+ * Returns empty permissions on network errors or when user has no membership.
+ * Never throws — always returns a usable session.
+ */
+export async function getSessionWithPermissions(
+  appviewUrl: string,
+  cookieHeader?: string
+): Promise<WebSessionWithPermissions> {
+  const session = await getSession(appviewUrl, cookieHeader);
+
+  if (!session.authenticated) {
+    return { authenticated: false, permissions: new Set() };
+  }
+
+  let permissions = new Set<string>();
+  try {
+    const res = await fetch(`${appviewUrl}/api/admin/members/me`, {
+      headers: { Cookie: cookieHeader! },
+    });
+
+    if (res.ok) {
+      const data = (await res.json()) as Record<string, unknown>;
+      if (Array.isArray(data.permissions)) {
+        permissions = new Set(data.permissions as string[]);
+      }
+    } else if (res.status !== 404) {
+      // 404 = no membership = expected for guests, no log
+      console.error("getSessionWithPermissions: unexpected status from members/me", {
+        operation: "GET /api/admin/members/me",
+        status: res.status,
+      });
+    }
+  } catch (error) {
+    console.error(
+      "getSessionWithPermissions: failed to fetch permissions — continuing with empty permissions",
+      {
+        operation: "GET /api/admin/members/me",
+        did: session.did,
+        error: error instanceof Error ? error.message : String(error),
+      }
+    );
+  }
+
+  return { ...session, permissions };
+}
+
+/** Returns true if the session grants permission to lock/unlock topics. */
+export function canLockTopics(auth: WebSessionWithPermissions): boolean {
+  return auth.authenticated && auth.permissions.has("space.atbb.permission.lockTopics");
+}
+
+/** Returns true if the session grants permission to hide/unhide posts. */
+export function canModeratePosts(auth: WebSessionWithPermissions): boolean {
+  return auth.authenticated && auth.permissions.has("space.atbb.permission.moderatePosts");
+}
+
+/** Returns true if the session grants permission to ban/unban users. */
+export function canBanUsers(auth: WebSessionWithPermissions): boolean {
+  return auth.authenticated && auth.permissions.has("space.atbb.permission.banUsers");
+}
+```
+
+### Step 4: Run tests to verify they pass
+
+```bash
+PATH=/path/to/.devenv/profile/bin:/bin:/usr/bin:$PATH \
+  pnpm --filter @atbb/web test src/lib/__tests__/session.test.ts
+```
+Expected: all tests PASS
+
+### Step 5: Commit
+
+```bash
+git add apps/web/src/lib/session.ts apps/web/src/lib/__tests__/session.test.ts
+git commit -m "feat(web): add getSessionWithPermissions and canXxx helpers (ATB-24)"
+```
+
+---
+
+## Task 3: Web Server — `POST /mod/action` proxy route
+
+A single web endpoint handles all six mod actions (lock, unlock, hide, unhide, ban, unban). It reads an `action` field from the form body and dispatches to the correct AppView mod endpoint.
+
+**Files:**
+- Create: `apps/web/src/routes/mod.ts`
+- Create: `apps/web/src/routes/__tests__/mod.test.ts`
+- Modify: `apps/web/src/routes/index.ts`
+
+### Step 1: Write the failing tests
+
+Create `apps/web/src/routes/__tests__/mod.test.ts`:
+
+```typescript
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+
+const mockFetch = vi.fn();
+
+describe("createModActionRoute", () => {
+  beforeEach(() => {
+    vi.stubGlobal("fetch", mockFetch);
+    vi.stubEnv("APPVIEW_URL", "http://localhost:3000");
+    vi.resetModules();
+    // Default: AppView returns error
+    mockFetch.mockResolvedValue({ ok: false, status: 500, statusText: "Server Error" });
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    vi.unstubAllEnvs();
+    mockFetch.mockReset();
+  });
+
+  function appviewSuccess() {
+    return {
+      ok: true,
+      status: 200,
+      json: () => Promise.resolve({ success: true }),
+    };
+  }
+
+  async function loadModRoutes() {
+    const { createModActionRoute } = await import("../mod.js");
+    return createModActionRoute("http://localhost:3000");
+  }
+
+  function modFormBody(fields: Record<string, string>) {
+    return {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        cookie: "atbb_session=token",
+      },
+      body: new URLSearchParams(fields).toString(),
+    };
+  }
+
+  // ─── Input validation ────────────────────────────────────────────────────
+
+  it("returns 400 error fragment when action is missing", async () => {
+    const routes = await loadModRoutes();
+    const res = await routes.request(
+      "/mod/action",
+      modFormBody({ id: "1", reason: "test" })
+    );
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    expect(html).toContain("form-error");
+    expect(html).toContain("Unknown action");
+    expect(mockFetch).not.toHaveBeenCalled();
+  });
+
+  it("returns 400 error fragment when reason is empty", async () => {
+    const routes = await loadModRoutes();
+    const res = await routes.request(
+      "/mod/action",
+      modFormBody({ action: "lock", id: "1", reason: "" })
+    );
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    expect(html).toContain("form-error");
+    expect(mockFetch).not.toHaveBeenCalled();
+  });
+
+  it("returns 400 error fragment when id is missing for lock action", async () => {
+    const routes = await loadModRoutes();
+    const res = await routes.request(
+      "/mod/action",
+      modFormBody({ action: "lock", reason: "test" })
+    );
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    expect(html).toContain("form-error");
+    expect(mockFetch).not.toHaveBeenCalled();
+  });
+
+  // ─── Lock action ─────────────────────────────────────────────────────────
+
+  it("posts to /api/mod/lock with topicId and reason for lock action", async () => {
+    mockFetch.mockResolvedValueOnce(appviewSuccess());
+    const routes = await loadModRoutes();
+    const res = await routes.request(
+      "/mod/action",
+      modFormBody({ action: "lock", id: "42", reason: "Off-topic thread" })
+    );
+    expect(res.status).toBe(200);
+    expect(res.headers.get("HX-Refresh")).toBe("true");
+
+    const [url, init] = mockFetch.mock.calls[0] as [string, RequestInit];
+    expect(url).toBe("http://localhost:3000/api/mod/lock");
+    expect(init.method).toBe("POST");
+    const body = JSON.parse(init.body as string);
+    expect(body.topicId).toBe("42");
+    expect(body.reason).toBe("Off-topic thread");
+    expect((init.headers as Record<string, string>)["Cookie"]).toContain("atbb_session=token");
+  });
+
+  it("sends DELETE to /api/mod/lock/:id for unlock action", async () => {
+    mockFetch.mockResolvedValueOnce(appviewSuccess());
+    const routes = await loadModRoutes();
+    const res = await routes.request(
+      "/mod/action",
+      modFormBody({ action: "unlock", id: "42", reason: "Thread reopened" })
+    );
+    expect(res.status).toBe(200);
+    expect(res.headers.get("HX-Refresh")).toBe("true");
+
+    const [url, init] = mockFetch.mock.calls[0] as [string, RequestInit];
+    expect(url).toBe("http://localhost:3000/api/mod/lock/42");
+    expect(init.method).toBe("DELETE");
+  });
+
+  // ─── Hide action ─────────────────────────────────────────────────────────
+
+  it("posts to /api/mod/hide with postId and reason for hide action", async () => {
+    mockFetch.mockResolvedValueOnce(appviewSuccess());
+    const routes = await loadModRoutes();
+    const res = await routes.request(
+      "/mod/action",
+      modFormBody({ action: "hide", id: "99", reason: "Spam" })
+    );
+    expect(res.status).toBe(200);
+    expect(res.headers.get("HX-Refresh")).toBe("true");
+
+    const [url, init] = mockFetch.mock.calls[0] as [string, RequestInit];
+    expect(url).toBe("http://localhost:3000/api/mod/hide");
+    const body = JSON.parse(init.body as string);
+    expect(body.postId).toBe("99");
+  });
+
+  it("sends DELETE to /api/mod/hide/:id for unhide action", async () => {
+    mockFetch.mockResolvedValueOnce(appviewSuccess());
+    const routes = await loadModRoutes();
+    await routes.request(
+      "/mod/action",
+      modFormBody({ action: "unhide", id: "99", reason: "Reinstated" })
+    );
+    const [url, init] = mockFetch.mock.calls[0] as [string, RequestInit];
+    expect(url).toBe("http://localhost:3000/api/mod/hide/99");
+    expect(init.method).toBe("DELETE");
+  });
+
+  // ─── Ban action ──────────────────────────────────────────────────────────
+
+  it("posts to /api/mod/ban with targetDid and reason for ban action", async () => {
+    mockFetch.mockResolvedValueOnce(appviewSuccess());
+    const routes = await loadModRoutes();
+    const res = await routes.request(
+      "/mod/action",
+      modFormBody({ action: "ban", id: "did:plc:badactor", reason: "Harassment" })
+    );
+    expect(res.status).toBe(200);
+    expect(res.headers.get("HX-Refresh")).toBe("true");
+
+    const [url, init] = mockFetch.mock.calls[0] as [string, RequestInit];
+    expect(url).toBe("http://localhost:3000/api/mod/ban");
+    const body = JSON.parse(init.body as string);
+    expect(body.targetDid).toBe("did:plc:badactor");
+  });
+
+  it("sends DELETE to /api/mod/ban/:id for unban action", async () => {
+    mockFetch.mockResolvedValueOnce(appviewSuccess());
+    const routes = await loadModRoutes();
+    await routes.request(
+      "/mod/action",
+      modFormBody({ action: "unban", id: "did:plc:unbanned", reason: "Appeal accepted" })
+    );
+    const [url, init] = mockFetch.mock.calls[0] as [string, RequestInit];
+    expect(url).toBe("http://localhost:3000/api/mod/ban/did:plc:unbanned");
+    expect(init.method).toBe("DELETE");
+  });
+
+  // ─── Error handling ──────────────────────────────────────────────────────
+
+  it("returns error fragment when AppView returns 403", async () => {
+    mockFetch.mockResolvedValueOnce({
+      ok: false,
+      status: 403,
+      json: () => Promise.resolve({ error: "Insufficient permissions" }),
+    });
+    const routes = await loadModRoutes();
+    const res = await routes.request(
+      "/mod/action",
+      modFormBody({ action: "lock", id: "1", reason: "test" })
+    );
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    expect(html).toContain("form-error");
+    expect(html).toContain("permission");
+    expect(res.headers.get("HX-Refresh")).toBeNull();
+  });
+
+  it("returns error fragment when AppView returns 503 (network error)", async () => {
+    mockFetch.mockRejectedValueOnce(new Error("fetch failed: ECONNREFUSED"));
+    const routes = await loadModRoutes();
+    const res = await routes.request(
+      "/mod/action",
+      modFormBody({ action: "hide", id: "1", reason: "test" })
+    );
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    expect(html).toContain("form-error");
+    expect(html).toContain("unavailable");
+  });
+
+  it("returns error fragment when AppView returns 500", async () => {
+    mockFetch.mockResolvedValueOnce({ ok: false, status: 500, statusText: "Internal Server Error" });
+    const routes = await loadModRoutes();
+    const res = await routes.request(
+      "/mod/action",
+      modFormBody({ action: "ban", id: "did:plc:x", reason: "test" })
+    );
+    expect(res.status).toBe(200);
+    const html = await res.text();
+    expect(html).toContain("form-error");
+    expect(html).toContain("went wrong");
+  });
+});
+```
+
+### Step 2: Run test to verify it fails
+
+```bash
+PATH=/path/to/.devenv/profile/bin:/bin:/usr/bin:$PATH \
+  pnpm --filter @atbb/web test src/routes/__tests__/mod.test.ts
+```
+Expected: FAIL — module not found.
+
+### Step 3: Implement `mod.ts`
+
+Create `apps/web/src/routes/mod.ts`:
+
+```typescript
+import { Hono } from "hono";
+import { isProgrammingError } from "../lib/errors.js";
+
+/**
+ * Single proxy endpoint for all moderation actions.
+ *
+ * Reads `action`, `id`, and `reason` from the form body and dispatches
+ * to the correct AppView mod endpoint. Returns HX-Refresh on success
+ * so HTMX reloads the current page to show updated state.
+ *
+ * Action dispatch table:
+ *   lock     → POST   /api/mod/lock            body: { topicId, reason }
+ *   unlock   → DELETE /api/mod/lock/:id        body: { reason }
+ *   hide     → POST   /api/mod/hide            body: { postId, reason }
+ *   unhide   → DELETE /api/mod/hide/:id        body: { reason }
+ *   ban      → POST   /api/mod/ban             body: { targetDid, reason }
+ *   unban    → DELETE /api/mod/ban/:id         body: { reason }
+ */
+export function createModActionRoute(appviewUrl: string) {
+  return new Hono().post("/mod/action", async (c) => {
+    let body: Record<string, string | File>;
+    try {
+      body = await c.req.parseBody();
+    } catch {
+      return c.html(`<p class="form-error">Invalid form submission.</p>`);
+    }
+
+    const action = typeof body.action === "string" ? body.action.trim() : "";
+    const id = typeof body.id === "string" ? body.id.trim() : "";
+    const reason = typeof body.reason === "string" ? body.reason.trim() : "";
+    const cookieHeader = c.req.header("cookie") ?? "";
+
+    // Validate action
+    const validActions = ["lock", "unlock", "hide", "unhide", "ban", "unban"];
+    if (!validActions.includes(action)) {
+      return c.html(`<p class="form-error">Unknown action.</p>`);
+    }
+
+    // Validate reason
+    if (!reason) {
+      return c.html(`<p class="form-error">Reason is required.</p>`);
+    }
+    if (reason.length > 3000) {
+      return c.html(`<p class="form-error">Reason must not exceed 3000 characters.</p>`);
+    }
+
+    // Validate id
+    if (!id) {
+      return c.html(`<p class="form-error">Target ID is required.</p>`);
+    }
+
+    // Build AppView request
+    let appviewUrl_: string;
+    let method: "POST" | "DELETE";
+    let appviewBody: Record<string, string>;
+
+    switch (action) {
+      case "lock":
+        appviewUrl_ = `${appviewUrl}/api/mod/lock`;
+        method = "POST";
+        appviewBody = { topicId: id, reason };
+        break;
+      case "unlock":
+        appviewUrl_ = `${appviewUrl}/api/mod/lock/${encodeURIComponent(id)}`;
+        method = "DELETE";
+        appviewBody = { reason };
+        break;
+      case "hide":
+        appviewUrl_ = `${appviewUrl}/api/mod/hide`;
+        method = "POST";
+        appviewBody = { postId: id, reason };
+        break;
+      case "unhide":
+        appviewUrl_ = `${appviewUrl}/api/mod/hide/${encodeURIComponent(id)}`;
+        method = "DELETE";
+        appviewBody = { reason };
+        break;
+      case "ban":
+        appviewUrl_ = `${appviewUrl}/api/mod/ban`;
+        method = "POST";
+        appviewBody = { targetDid: id, reason };
+        break;
+      case "unban":
+        appviewUrl_ = `${appviewUrl}/api/mod/ban/${encodeURIComponent(id)}`;
+        method = "DELETE";
+        appviewBody = { reason };
+        break;
+      default:
+        return c.html(`<p class="form-error">Unknown action.</p>`);
+    }
+
+    // Forward to AppView
+    let appviewRes: Response;
+    try {
+      appviewRes = await fetch(appviewUrl_, {
+        method,
+        headers: {
+          "Content-Type": "application/json",
+          Cookie: cookieHeader,
+        },
+        body: JSON.stringify(appviewBody),
+      });
+    } catch (error) {
+      if (isProgrammingError(error)) throw error;
+      console.error("Failed to proxy mod action to AppView", {
+        operation: `${method} ${appviewUrl_}`,
+        action,
+        error: error instanceof Error ? error.message : String(error),
+      });
+      return c.html(
+        `<p class="form-error">Forum temporarily unavailable. Please try again.</p>`
+      );
+    }
+
+    if (appviewRes.ok) {
+      return new Response(null, {
+        status: 200,
+        headers: { "HX-Refresh": "true" },
+      });
+    }
+
+    // Handle error responses
+    let errorMessage = "Something went wrong. Please try again.";
+
+    if (appviewRes.status === 401) {
+      errorMessage = "You must be logged in to perform this action.";
+    } else if (appviewRes.status === 403) {
+      errorMessage = "You don't have permission for this action.";
+    } else if (appviewRes.status === 404) {
+      errorMessage = "Target not found.";
+    } else if (appviewRes.status === 409) {
+      errorMessage = "This action is already active.";
+    } else if (appviewRes.status >= 500) {
+      console.error("AppView returned server error for mod action", {
+        operation: `${method} ${appviewUrl_}`,
+        action,
+        status: appviewRes.status,
+      });
+    }
+
+    return c.html(`<p class="form-error">${errorMessage}</p>`);
+  });
+}
+```
+
+### Step 4: Register the route in `index.ts`
+
+In `apps/web/src/routes/index.ts`, add the import and route:
+
+```typescript
+import { createModActionRoute } from "./mod.js";
+
+export const webRoutes = new Hono()
+  .route("/", createHomeRoutes(config.appviewUrl))
+  .route("/", createBoardsRoutes(config.appviewUrl))
+  .route("/", createTopicsRoutes(config.appviewUrl))
+  .route("/", createLoginRoutes(config.appviewUrl))
+  .route("/", createNewTopicRoutes(config.appviewUrl))
+  .route("/", createAuthRoutes(config.appviewUrl))
+  .route("/", createModActionRoute(config.appviewUrl));  // add this line
+```
+
+### Step 5: Run tests to verify they pass
+
+```bash
+PATH=/path/to/.devenv/profile/bin:/bin:/usr/bin:$PATH \
+  pnpm --filter @atbb/web test src/routes/__tests__/mod.test.ts
+```
+Expected: all tests PASS
+
+### Step 6: Commit
+
+```bash
+git add apps/web/src/routes/mod.ts \
+        apps/web/src/routes/__tests__/mod.test.ts \
+        apps/web/src/routes/index.ts
+git commit -m "feat(web): add POST /mod/action proxy route (ATB-24)"
+```
+
+---
+
+## Task 4: Topic Page — Mod Buttons, Dialog, and Lock Button
+
+Update `topics.tsx` to use `getSessionWithPermissions`, add lock/unlock button, add hide/unhide and ban/unban buttons on each post, and add the shared confirmation dialog.
+
+**Key change:** existing tests that use an authenticated session with a cookie will now trigger a second fetch call for `GET /api/admin/members/me`. These tests must be updated to add a mock response for that call.
+
+**Files:**
+- Modify: `apps/web/src/routes/topics.tsx`
+- Modify: `apps/web/src/routes/__tests__/topics.test.tsx`
+
+### Step 1: Update existing broken tests first
+
+In `apps/web/src/routes/__tests__/topics.test.tsx`:
+
+**Add a helper function** for the members/me mock (no membership — most tests don't need mod buttons):
+
+```typescript
+function membersMeNotFound() {
+  return { ok: false, status: 404 };
+}
+
+function membersMeMod(
+  permissions = [
+    "space.atbb.permission.moderatePosts",
+    "space.atbb.permission.lockTopics",
+    "space.atbb.permission.banUsers",
+  ]
+) {
+  return {
+    ok: true,
+    json: () =>
+      Promise.resolve({
+        did: "did:plc:mod",
+        handle: "mod.bsky.social",
+        role: "Moderator",
+        roleUri: "at://...",
+        permissions,
+      }),
+  };
+}
+```
+
+**Update all tests that pass a cookie header** to insert `membersMeNotFound()` between the auth session mock and the topic mock. Search for `cookie: "atbb_session=token"` in `topics.test.tsx` and find each test in "full page mode" (not POST /reply tests — those don't call getSession).
+
+The affected tests and their fix:
+
+**Test at ~line 404** ("shows locked message when topic is locked and user is authenticated"):
+```typescript
+// Before:
+mockFetch.mockResolvedValueOnce({ ok: true, json: () => Promise.resolve({ authenticated: true, ... }) });
+setupSuccessfulFetch({ locked: true });
+// After — INSERT membersMeNotFound between auth and topic:
+mockFetch.mockResolvedValueOnce({ ok: true, json: () => Promise.resolve({ authenticated: true, ... }) });
+mockFetch.mockResolvedValueOnce(membersMeNotFound());
+setupSuccessfulFetch({ locked: true });
+```
+
+**Test at ~line 434** ("shows reply form slot for authenticated users"):
+```typescript
+// Add membersMeNotFound after the authSession mock, before setupSuccessfulFetch
+mockFetch.mockResolvedValueOnce({ ok: true, json: () => Promise.resolve({ authenticated: true, ... }) });
+mockFetch.mockResolvedValueOnce(membersMeNotFound());
+setupSuccessfulFetch();
+```
+
+**Test at ~line 597** ("shows reply form with textarea when authenticated"):
+```typescript
+mockFetch.mockResolvedValueOnce(authSession);
+mockFetch.mockResolvedValueOnce(membersMeNotFound());  // ← add this
+mockFetch.mockResolvedValueOnce(makeTopicResponse());
+```
+
+**Test at ~line 630** ("uses hx-post for reply form submission"):
+```typescript
+mockFetch.mockResolvedValueOnce(authSession);
+mockFetch.mockResolvedValueOnce(membersMeNotFound());  // ← add this
+mockFetch.mockResolvedValueOnce(makeTopicResponse());
+```
+
+Search for any other tests in the file that pass `cookie: "atbb_session=token"` AND call GET endpoints (not POST /reply endpoints — those go through a different code path and don't call getSessionWithPermissions).
+
+### Step 2: Add new mod button tests
+
+In `topics.test.tsx`, add a new section:
+
+```typescript
+// ─── Mod actions (permission-based rendering) ────────────────────────────────
+
+it("shows lock button for user with lockTopics permission", async () => {
+  mockFetch.mockResolvedValueOnce(authSession);
+  mockFetch.mockResolvedValueOnce(membersMeMod(["space.atbb.permission.lockTopics"]));
+  setupSuccessfulFetch();
+  const routes = await loadTopicsRoutes();
+  const res = await routes.request("/topics/1", {
+    headers: { cookie: "atbb_session=token" },
+  });
+  const html = await res.text();
+  expect(html).toContain("Lock Topic");
+  expect(html).toContain("openModDialog");
+});
+
+it("does not show lock button for user without lockTopics permission", async () => {
+  mockFetch.mockResolvedValueOnce(authSession);
+  mockFetch.mockResolvedValueOnce(membersMeNotFound());
+  setupSuccessfulFetch();
+  const routes = await loadTopicsRoutes();
+  const res = await routes.request("/topics/1", {
+    headers: { cookie: "atbb_session=token" },
+  });
+  const html = await res.text();
+  expect(html).not.toContain("Lock Topic");
+});
+
+it("shows Unlock Topic button when topic is locked and user has lockTopics permission", async () => {
+  mockFetch.mockResolvedValueOnce(authSession);
+  mockFetch.mockResolvedValueOnce(membersMeMod(["space.atbb.permission.lockTopics"]));
+  setupSuccessfulFetch({ locked: true });
+  const routes = await loadTopicsRoutes();
+  const res = await routes.request("/topics/1", {
+    headers: { cookie: "atbb_session=token" },
+  });
+  const html = await res.text();
+  expect(html).toContain("Unlock Topic");
+});
+
+it("shows hide button on each post for user with moderatePosts permission", async () => {
+  mockFetch.mockResolvedValueOnce(authSession);
+  mockFetch.mockResolvedValueOnce(membersMeMod(["space.atbb.permission.moderatePosts"]));
+  const reply = makeReply({ id: "2", text: "A reply" });
+  setupSuccessfulFetch({ replies: [reply] });
+  const routes = await loadTopicsRoutes();
+  const res = await routes.request("/topics/1", {
+    headers: { cookie: "atbb_session=token" },
+  });
+  const html = await res.text();
+  expect(html).toContain("Hide");
+  expect(html).toContain("openModDialog");
+});
+
+it("shows ban button on posts for user with banUsers permission", async () => {
+  mockFetch.mockResolvedValueOnce(authSession);
+  mockFetch.mockResolvedValueOnce(membersMeMod(["space.atbb.permission.banUsers"]));
+  setupSuccessfulFetch();
+  const routes = await loadTopicsRoutes();
+  const res = await routes.request("/topics/1", {
+    headers: { cookie: "atbb_session=token" },
+  });
+  const html = await res.text();
+  expect(html).toContain("Ban user");
+});
+
+it("shows mod dialog in page for users with any mod permission", async () => {
+  mockFetch.mockResolvedValueOnce(authSession);
+  mockFetch.mockResolvedValueOnce(membersMeMod());
+  setupSuccessfulFetch();
+  const routes = await loadTopicsRoutes();
+  const res = await routes.request("/topics/1", {
+    headers: { cookie: "atbb_session=token" },
+  });
+  const html = await res.text();
+  expect(html).toContain("mod-dialog");
+  expect(html).toContain("<dialog");
+});
+
+it("does not show any mod buttons for unauthenticated users", async () => {
+  setupSuccessfulFetch();
+  const routes = await loadTopicsRoutes();
+  const res = await routes.request("/topics/1");
+  const html = await res.text();
+  expect(html).not.toContain("Lock Topic");
+  expect(html).not.toContain("Hide");
+  expect(html).not.toContain("Ban user");
+  expect(html).not.toContain("mod-dialog");
+});
+```
+
+### Step 3: Run tests to verify the new ones fail (existing ones may also fail)
+
+```bash
+PATH=/path/to/.devenv/profile/bin:/bin:/usr/bin:$PATH \
+  pnpm --filter @atbb/web test src/routes/__tests__/topics.test.tsx
+```
+Expected: new tests FAIL, some existing auth tests may now fail too.
+
+### Step 4: Implement the topics.tsx changes
+
+In `apps/web/src/routes/topics.tsx`, make the following changes:
+
+**1. Update imports** — add the new session functions:
+```typescript
+import {
+  getSessionWithPermissions,
+  canLockTopics,
+  canModeratePosts,
+  canBanUsers,
+} from "../lib/session.js";
+```
+Remove `getSession` from the import if it's no longer used.
+
+**2. Update `PostCard` component** — add `modPerms` prop:
+```typescript
+function PostCard({
+  post,
+  postNumber,
+  isOP = false,
+  modPerms = { canHide: false, canBan: false },
+}: {
+  post: PostResponse;
+  postNumber: number;
+  isOP?: boolean;
+  modPerms?: { canHide: boolean; canBan: boolean };
+}) {
+  const handle = post.author?.handle ?? post.author?.did ?? post.did;
+  const date = post.createdAt ? timeAgo(new Date(post.createdAt)) : "unknown";
+  const cardClass = isOP ? "post-card post-card--op" : "post-card post-card--reply";
+  return (
+    <div class={cardClass} id={`post-${postNumber}`}>
+      <div class="post-card__header">
+        <span class="post-card__number">#{postNumber}</span>
+        <span class="post-card__author">{handle}</span>
+        <span class="post-card__date">{date}</span>
+      </div>
+      <div class="post-card__body" style="white-space: pre-wrap">
+        {post.text}
+      </div>
+      {(modPerms.canHide || modPerms.canBan) && (
+        <div class="post-card__mod-actions">
+          {modPerms.canHide && (
+            <button
+              class="mod-btn mod-btn--hide"
+              type="button"
+              onclick={`openModDialog('hide','${post.id}')`}
+            >
+              Hide
+            </button>
+          )}
+          {modPerms.canBan && post.author?.did && (
+            <button
+              class="mod-btn mod-btn--ban"
+              type="button"
+              onclick={`openModDialog('ban','${post.author.did}')`}
+            >
+              Ban user
+            </button>
+          )}
+        </div>
+      )}
+    </div>
+  );
+}
+```
+
+**3. Add the `MOD_DIALOG_SCRIPT` constant** (after `REPLY_CHAR_COUNTER_SCRIPT`):
+```typescript
+const MOD_DIALOG_SCRIPT = `
+  var MOD_TITLES = {
+    lock: 'Lock Topic', unlock: 'Unlock Topic',
+    hide: 'Hide Post', unhide: 'Unhide Post',
+    ban: 'Ban User', unban: 'Unban User'
+  };
+  function openModDialog(action, id) {
+    document.getElementById('mod-dialog-action').value = action;
+    document.getElementById('mod-dialog-id').value = id;
+    document.getElementById('mod-dialog-title').textContent = MOD_TITLES[action] || 'Confirm';
+    document.getElementById('mod-dialog-error').innerHTML = '';
+    document.getElementById('mod-reason').value = '';
+    document.getElementById('mod-dialog').showModal();
+  }
+`;
+```
+
+**4. Add `ModDialog` component**:
+```typescript
+function ModDialog() {
+  return (
+    <dialog id="mod-dialog" class="mod-dialog">
+      <h2 id="mod-dialog-title" class="mod-dialog__title">Confirm Action</h2>
+      <form
+        hx-post="/mod/action"
+        hx-target="#mod-dialog-error"
+        hx-swap="innerHTML"
+        hx-disabled-elt="[type=submit]"
+      >
+        <input type="hidden" id="mod-dialog-action" name="action" value="" />
+        <input type="hidden" id="mod-dialog-id" name="id" value="" />
+        <div class="form-group">
+          <label for="mod-reason">Reason</label>
+          <textarea
+            id="mod-reason"
+            name="reason"
+            rows={3}
+            placeholder="Reason for this action…"
+          />
+        </div>
+        <div id="mod-dialog-error" />
+        <div class="form-actions">
+          <button type="submit" class="btn btn-danger">
+            Confirm
+          </button>
+          <button
+            type="button"
+            class="btn btn-secondary"
+            onclick="document.getElementById('mod-dialog').close()"
+          >
+            Cancel
+          </button>
+        </div>
+      </form>
+    </dialog>
+  );
+}
+```
+
+**5. Update the full page handler** — change `getSession` to `getSessionWithPermissions`:
+```typescript
+const auth = await getSessionWithPermissions(appviewUrl, c.req.header("cookie"));
+```
+
+**6. Compute mod permission flags** (after fetching `auth`):
+```typescript
+const modPerms = {
+  canHide: canModeratePosts(auth),
+  canBan: canBanUsers(auth),
+  canLock: canLockTopics(auth),
+};
+const hasAnyModPerm = modPerms.canHide || modPerms.canBan || modPerms.canLock;
+```
+
+**7. Add lock button** below the `PageHeader` in the JSX return:
+```tsx
+{modPerms.canLock && (
+  <div class="topic-mod-controls">
+    <button
+      class={`mod-btn ${topicData.locked ? "mod-btn--unlock" : "mod-btn--lock"}`}
+      type="button"
+      onclick={`openModDialog('${topicData.locked ? "unlock" : "lock"}','${topicId}')`}
+    >
+      {topicData.locked ? "Unlock Topic" : "Lock Topic"}
+    </button>
+  </div>
+)}
+```
+
+**8. Update `PostCard` calls** to pass `modPerms`:
+```tsx
+<PostCard post={topicData.post} postNumber={1} isOP={true} modPerms={modPerms} />
+```
+and in `ReplyFragment`:
+```tsx
+{replies.map((reply, i) => (
+  <PostCard key={reply.id} post={reply} postNumber={offset + i + 2} modPerms={modPerms} />
+))}
+```
+`ReplyFragment` needs a new `modPerms` prop too:
+```typescript
+function ReplyFragment({
+  topicId, replies, total, offset, modPerms,
+}: {
+  topicId: string;
+  replies: PostResponse[];
+  total: number;
+  offset: number;
+  modPerms: { canHide: boolean; canBan: boolean };
+}) { ... }
+```
+
+**9. Add `ModDialog` and script** at the bottom of the page's JSX (before `</BaseLayout>`):
+```tsx
+{hasAnyModPerm && (
+  <>
+    <ModDialog />
+    <script dangerouslySetInnerHTML={{ __html: MOD_DIALOG_SCRIPT }} />
+  </>
+)}
+```
+
+**10. Update `BaseLayout` call** — `auth` type is now `WebSessionWithPermissions | undefined`. `BaseLayout` accepts `WebSession | undefined`. Since `WebSessionWithPermissions` is structurally compatible (has `authenticated`, `did`, `handle`), this should work. If TypeScript complains, cast: `auth as WebSession`.
+
+### Step 5: Run tests to verify they pass
+
+```bash
+PATH=/path/to/.devenv/profile/bin:/bin:/usr/bin:$PATH \
+  pnpm --filter @atbb/web test src/routes/__tests__/topics.test.tsx
+```
+Expected: all tests PASS (including both updated existing tests and new mod button tests)
+
+### Step 6: Run the full web test suite to catch any remaining breakage
+
+```bash
+PATH=/path/to/.devenv/profile/bin:/bin:/usr/bin:$PATH \
+  pnpm --filter @atbb/web test
+```
+Expected: all tests PASS
+
+### Step 7: Commit
+
+```bash
+git add apps/web/src/routes/topics.tsx apps/web/src/routes/__tests__/topics.test.tsx
+git commit -m "feat(web): add mod action buttons and dialog to topic view (ATB-24)"
+```
+
+---
+
+## Task 5: CSS for Mod UI Elements
+
+Add styles for the mod dialog, mod buttons, and the mod actions row on post cards.
+
+**Files:**
+- Modify: `apps/web/public/static/css/theme.css`
+
+### Step 1: Add CSS at the end of `theme.css`
+
+```css
+/* ─── Moderation UI ──────────────────────────────────────────────────────── */
+
+.post-card__mod-actions {
+  display: flex;
+  gap: var(--space-2);
+  margin-top: var(--space-2);
+  padding-top: var(--space-2);
+  border-top: 1px solid var(--color-border);
+}
+
+.mod-btn {
+  font-size: 0.75rem;
+  padding: 0.25rem 0.6rem;
+  border: 2px solid currentColor;
+  border-radius: 0;
+  cursor: pointer;
+  background: transparent;
+  font-family: inherit;
+  font-weight: 700;
+  text-transform: uppercase;
+  letter-spacing: 0.05em;
+}
+
+.mod-btn--hide,
+.mod-btn--lock {
+  color: var(--color-danger, #d00);
+}
+
+.mod-btn--hide:hover,
+.mod-btn--lock:hover {
+  background: var(--color-danger, #d00);
+  color: #fff;
+}
+
+.mod-btn--unhide,
+.mod-btn--unlock,
+.mod-btn--ban {
+  color: var(--color-text-muted, #666);
+}
+
+.mod-btn--unhide:hover,
+.mod-btn--unlock:hover,
+.mod-btn--ban:hover {
+  background: var(--color-text-muted, #666);
+  color: #fff;
+}
+
+.topic-mod-controls {
+  margin-bottom: var(--space-4);
+}
+
+.mod-dialog {
+  border: 3px solid var(--color-border);
+  border-radius: 0;
+  padding: var(--space-6);
+  max-width: 480px;
+  width: 90vw;
+  box-shadow: 6px 6px 0 var(--color-shadow);
+  background: var(--color-bg);
+}
+
+.mod-dialog::backdrop {
+  background: rgba(0, 0, 0, 0.5);
+}
+
+.mod-dialog__title {
+  margin-top: 0;
+  margin-bottom: var(--space-4);
+  font-size: 1.25rem;
+}
+```
+
+### Step 2: Visual verification
+
+Run `pnpm dev` and navigate to a topic page while logged in as a mod. Verify:
+- Lock button appears below the page title
+- Post cards show "Hide" and "Ban user" buttons
+- Clicking a button opens the dialog
+- Dialog closes on Cancel
+- CSS looks consistent with the neobrutal theme
+
+### Step 3: Commit
+
+```bash
+git add apps/web/public/static/css/theme.css
+git commit -m "style(web): add CSS for mod dialog and mod action buttons (ATB-24)"
+```
+
+---
+
+## Task 6: Full Test Suite + Final Verification
+
+Run the complete test suite and verify the build succeeds.
+
+### Step 1: Run all tests
+
+```bash
+PATH=/path/to/.devenv/profile/bin:/bin:/usr/bin:$PATH pnpm test
+```
+Expected: all tests PASS across all packages
+
+### Step 2: Run full build
+
+```bash
+PATH=/path/to/.devenv/profile/bin:/bin:/usr/bin:$PATH pnpm build
+```
+Expected: BUILD successful
+
+### Step 3: Update Linear issue
+
+Mark ATB-24 as Done in Linear. Add a comment:
+
+> Implemented mod action buttons (lock/unlock, hide/unhide, ban/unban) on the topic view. New `GET /api/admin/members/me` AppView endpoint surfaces the user's own permissions. Web server `POST /mod/action` proxies all actions with reason confirmation via `<dialog>`. Mod buttons only render for users with matching permissions.
+
+### Step 4: Update plan document
+
+Mark the following in `docs/atproto-forum-plan.md`:
+```
+[x] Admin UI: ban user, lock topic, hide post (Phase 3 carryover)
+[x] Mod action indicators (locked topic banner — already existed; mod buttons via permissions)
+```
+
+### Step 5: Final commit if any docs updated
+
+```bash
+git add docs/atproto-forum-plan.md
+git commit -m "docs: mark ATB-24 admin moderation UI complete"
+```
+
+---
+
+## Notes on the `makeReply` helper
+
+The `topics.test.tsx` file uses a `makeReply` function to create reply objects. If it doesn't exist yet, add it alongside `makeTopicResponse`:
+
+```typescript
+function makeReply(overrides: Record<string, unknown> = {}) {
+  return {
+    id: "2",
+    did: "did:plc:replier",
+    rkey: "replyrkey1",
+    text: "A reply",
+    forumUri: null,
+    boardUri: null,
+    boardId: "42",
+    parentPostId: "1",
+    createdAt: "2025-01-02T00:00:00.000Z",
+    author: { did: "did:plc:replier", handle: "replier.bsky.social" },
+    ...overrides,
+  };
+}
+```
+
+## Devenv PATH reminder
+
+Replace `/path/to/.devenv/profile/bin` with the actual path from memory:
+```
+/Users/jacob.zweifel/workspace/malpercio-dev/atbb-monorepo/.devenv/profile/bin
+```
+
+Full example:
+```bash
+PATH=/Users/jacob.zweifel/workspace/malpercio-dev/atbb-monorepo/.devenv/profile/bin:/bin:/usr/bin:$PATH \
+  pnpm --filter @atbb/web test
+```