feat: add admin UI for reviewing copyright flags (#390)

* feat: add admin UI for reviewing copyright flags

adds /admin endpoint to moderation service with:
- simple HTML/JS UI for reviewing flagged tracks
- /admin/flags API to list copyright-violation labels
- /admin/resolve API to create negation labels (false positives)
- auth via existing X-Moderation-Key header

resolves #388

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[e-mail]>

* refactor: modularize moderation service

breaks main.rs into focused modules:
- config.rs: environment config loading
- state.rs: AppState and AppError types
- auth.rs: authentication middleware
- audd.rs: AuDD fingerprinting types and handler
- xrpc.rs: ATProto labeler endpoints
- handlers.rs: health, landing, emit_label

main.rs now only composes routes (~100 lines vs ~700)

also fixes clippy warning in labels.rs (redundant closure)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[e-mail]>

---------

Co-authored-by: Claude <[e-mail]>

moderation/Cargo.lock

···
 ]
 
 [[package]]
+name = "http-range-header"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9171a2ea8a68358193d15dd5d70c1c10a2afc3e7e4c5bc92bc9f025cebd7359c"
+
+[[package]]
 name = "httparse"
 version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
  "tokio",
  "tokio-rustls",
  "tower-service",
- "webpki-roots",
+ "webpki-roots 1.0.4",
 ]
 
 [[package]]
···
 checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
 
 [[package]]
+name = "mime_guess"
+version = "2.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f7c44f8e672c00fe5308fa235f821cb4198414e1c77935c1ab6948d3fd78550e"
+dependencies = [
+ "mime",
+ "unicase",
+]
+
+[[package]]
 name = "mio"
 version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
  "thiserror 2.0.17",
  "tokio",
  "tokio-stream",
+ "tower-http",
  "tracing",
  "tracing-subscriber",
 ]
···
  "wasm-bindgen",
  "wasm-bindgen-futures",
  "web-sys",
- "webpki-roots",
+ "webpki-roots 1.0.4",
 ]
 
 [[package]]
···
  "memchr",
  "once_cell",
  "percent-encoding",
+ "rustls",
  "serde",
  "serde_json",
  "sha2",
···
  "tokio-stream",
  "tracing",
  "url",
+ "webpki-roots 0.26.11",
 ]
 
 [[package]]
···
 dependencies = [
  "bitflags",
  "bytes",
+ "futures-core",
  "futures-util",
  "http",
  "http-body",
+ "http-body-util",
+ "http-range-header",
+ "httpdate",
  "iri-string",
+ "mime",
+ "mime_guess",
+ "percent-encoding",
  "pin-project-lite",
+ "tokio",
+ "tokio-util",
  "tower",
  "tower-layer",
  "tower-service",
+ "tracing",
 ]
 
 [[package]]
···
 version = "1.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "562d481066bde0658276a35467c4af00bdc6ee726305698a55b86e61d7ad82bb"
+
+[[package]]
+name = "unicase"
+version = "2.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75b844d17643ee918803943289730bec8aac480150456169e647ed0b576ba539"
 
 [[package]]
 name = "unicode-bidi"
···
 dependencies = [
  "js-sys",
  "wasm-bindgen",
+]
+
+[[package]]
+name = "webpki-roots"
+version = "0.26.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
+dependencies = [
+ "webpki-roots 1.0.4",
 ]
 
 [[package]]

moderation/Cargo.toml

···
 thiserror = "2.0"
 tokio = { version = "1.40", features = ["rt-multi-thread", "macros", "signal", "sync"] }
 tokio-stream = { version = "0.1", features = ["sync"] }
+tower-http = { version = "0.6", features = ["fs"] }
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter", "fmt"] }
 

moderation/src/admin.rs

···
+//! Admin API for reviewing and resolving copyright flags.
+
+use axum::{extract::State, response::Html, Json};
+use serde::{Deserialize, Serialize};
+
+use crate::state::{AppError, AppState};
+
+/// A flagged track pending review.
+#[derive(Debug, Serialize)]
+pub struct FlaggedTrack {
+    pub seq: i64,
+    pub uri: String,
+    pub val: String,
+    pub created_at: String,
+    /// If there's a negation label for this URI+val, it's been resolved.
+    pub resolved: bool,
+}
+
+/// Response for listing flagged tracks.
+#[derive(Debug, Serialize)]
+pub struct ListFlaggedResponse {
+    pub tracks: Vec<FlaggedTrack>,
+}
+
+/// Request to resolve (negate) a flag.
+#[derive(Debug, Deserialize)]
+pub struct ResolveRequest {
+    pub uri: String,
+    #[serde(default = "default_val")]
+    pub val: String,
+}
+
+fn default_val() -> String {
+    "copyright-violation".to_string()
+}
+
+/// Response after resolving a flag.
+#[derive(Debug, Serialize)]
+pub struct ResolveResponse {
+    pub seq: i64,
+    pub message: String,
+}
+
+/// List all flagged tracks (copyright-violation labels without negations).
+pub async fn list_flagged(
+    State(state): State<AppState>,
+) -> Result<Json<ListFlaggedResponse>, AppError> {
+    let db = state.db.as_ref().ok_or(AppError::LabelerNotConfigured)?;
+
+    let tracks = db.get_pending_flags().await?;
+
+    Ok(Json(ListFlaggedResponse { tracks }))
+}
+
+/// Resolve (negate) a copyright flag, marking it as a false positive.
+pub async fn resolve_flag(
+    State(state): State<AppState>,
+    Json(request): Json<ResolveRequest>,
+) -> Result<Json<ResolveResponse>, AppError> {
+    let db = state.db.as_ref().ok_or(AppError::LabelerNotConfigured)?;
+    let signer = state.signer.as_ref().ok_or(AppError::LabelerNotConfigured)?;
+
+    tracing::info!(uri = %request.uri, val = %request.val, "resolving flag (creating negation)");
+
+    // Create a negation label
+    let label = crate::labels::Label::new(signer.did(), &request.uri, &request.val).negated();
+    let label = signer.sign_label(label)?;
+
+    let seq = db.store_label(&label).await?;
+
+    // Broadcast to subscribers
+    if let Some(tx) = &state.label_tx {
+        let _ = tx.send((seq, label));
+    }
+
+    Ok(Json(ResolveResponse {
+        seq,
+        message: format!("created negation label for {}", request.uri),
+    }))
+}
+
+/// Serve the admin UI HTML.
+pub async fn admin_ui() -> Html<&'static str> {
+    Html(ADMIN_HTML)
+}
+
+const ADMIN_HTML: &str = r##"<!DOCTYPE html>
+<html>
+<head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <title>plyr.fm moderation admin</title>
+    <style>
+        * { box-sizing: border-box; }
+        body {
+            font-family: system-ui, -apple-system, sans-serif;
+            background: #0a0a0a;
+            color: #e5e5e5;
+            max-width: 900px;
+            margin: 0 auto;
+            padding: 20px;
+            line-height: 1.6;
+        }
+        h1 { color: #fff; margin-bottom: 8px; }
+        .subtitle { color: #888; margin-bottom: 24px; }
+        .auth-form {
+            background: #111;
+            border: 1px solid #222;
+            border-radius: 8px;
+            padding: 20px;
+            margin-bottom: 24px;
+        }
+        .auth-form input {
+            background: #1a1a1a;
+            border: 1px solid #333;
+            color: #fff;
+            padding: 8px 12px;
+            border-radius: 4px;
+            width: 300px;
+            margin-right: 8px;
+        }
+        .auth-form button {
+            background: #3b82f6;
+            color: #fff;
+            border: none;
+            padding: 8px 16px;
+            border-radius: 4px;
+            cursor: pointer;
+        }
+        .auth-form button:hover { background: #2563eb; }
+        .status {
+            padding: 8px 12px;
+            border-radius: 4px;
+            margin-bottom: 16px;
+            display: none;
+        }
+        .status.error { display: block; background: rgba(239, 68, 68, 0.2); color: #ef4444; }
+        .status.success { display: block; background: rgba(34, 197, 94, 0.2); color: #22c55e; }
+        table {
+            width: 100%;
+            border-collapse: collapse;
+        }
+        th, td {
+            text-align: left;
+            padding: 12px;
+            border-bottom: 1px solid #222;
+        }
+        th { color: #888; font-weight: 500; }
+        .uri {
+            font-family: monospace;
+            font-size: 0.85em;
+            word-break: break-all;
+        }
+        .badge {
+            display: inline-block;
+            padding: 2px 8px;
+            border-radius: 4px;
+            font-size: 0.8em;
+        }
+        .badge.pending { background: rgba(234, 179, 8, 0.2); color: #eab308; }
+        .badge.resolved { background: rgba(34, 197, 94, 0.2); color: #22c55e; }
+        .resolve-btn {
+            background: #f59e0b;
+            color: #000;
+            border: none;
+            padding: 6px 12px;
+            border-radius: 4px;
+            cursor: pointer;
+            font-size: 0.85em;
+        }
+        .resolve-btn:hover { background: #d97706; }
+        .resolve-btn:disabled { background: #444; color: #888; cursor: not-allowed; }
+        .empty { color: #666; text-align: center; padding: 40px; }
+        .loading { color: #888; }
+        .refresh-btn {
+            background: #333;
+            color: #fff;
+            border: none;
+            padding: 8px 16px;
+            border-radius: 4px;
+            cursor: pointer;
+            margin-left: auto;
+        }
+        .refresh-btn:hover { background: #444; }
+        .header-row {
+            display: flex;
+            align-items: center;
+            margin-bottom: 16px;
+        }
+        .header-row h2 { margin: 0; }
+    </style>
+</head>
+<body>
+    <h1>moderation admin</h1>
+    <p class="subtitle">review and resolve copyright flags</p>
+
+    <div class="auth-form">
+        <input type="password" id="token" placeholder="moderation auth token">
+        <button onclick="authenticate()">authenticate</button>
+    </div>
+
+    <div id="status" class="status"></div>
+
+    <div id="content" style="display: none;">
+        <div class="header-row">
+            <h2>flagged tracks</h2>
+            <button class="refresh-btn" onclick="loadFlags()">refresh</button>
+        </div>
+        <table>
+            <thead>
+                <tr>
+                    <th>seq</th>
+                    <th>uri</th>
+                    <th>label</th>
+                    <th>status</th>
+                    <th>action</th>
+                </tr>
+            </thead>
+            <tbody id="flags-table">
+                <tr><td colspan="5" class="loading">loading...</td></tr>
+            </tbody>
+        </table>
+    </div>
+
+    <script>
+        let authToken = localStorage.getItem('moderation_token') || '';
+
+        if (authToken) {
+            document.getElementById('token').value = '••••••••';
+            showContent();
+            loadFlags();
+        }
+
+        function authenticate() {
+            authToken = document.getElementById('token').value;
+            localStorage.setItem('moderation_token', authToken);
+            showContent();
+            loadFlags();
+        }
+
+        function showContent() {
+            document.getElementById('content').style.display = 'block';
+        }
+
+        function showStatus(message, type) {
+            const status = document.getElementById('status');
+            status.textContent = message;
+            status.className = 'status ' + type;
+        }
+
+        async function loadFlags() {
+            const tbody = document.getElementById('flags-table');
+            tbody.innerHTML = '<tr><td colspan="5" class="loading">loading...</td></tr>';
+
+            try {
+                const res = await fetch('/admin/flags', {
+                    headers: { 'X-Moderation-Key': authToken }
+                });
+
+                if (!res.ok) {
+                    if (res.status === 401) {
+                        showStatus('invalid token', 'error');
+                        localStorage.removeItem('moderation_token');
+                        return;
+                    }
+                    throw new Error('failed to load flags');
+                }
+
+                const data = await res.json();
+
+                if (data.tracks.length === 0) {
+                    tbody.innerHTML = '<tr><td colspan="5" class="empty">no flagged tracks</td></tr>';
+                    return;
+                }
+
+                tbody.innerHTML = data.tracks.map(track => `
+                    <tr>
+                        <td>${track.seq}</td>
+                        <td class="uri">${escapeHtml(track.uri)}</td>
+                        <td><span class="badge pending">${escapeHtml(track.val)}</span></td>
+                        <td><span class="badge ${track.resolved ? 'resolved' : 'pending'}">${track.resolved ? 'resolved' : 'pending'}</span></td>
+                        <td>
+                            <button class="resolve-btn"
+                                    onclick="resolveFlag('${escapeHtml(track.uri)}', '${escapeHtml(track.val)}')"
+                                    ${track.resolved ? 'disabled' : ''}>
+                                ${track.resolved ? 'resolved' : 'mark false positive'}
+                            </button>
+                        </td>
+                    </tr>
+                `).join('');
+
+            } catch (err) {
+                tbody.innerHTML = `<tr><td colspan="5" class="empty">error: ${err.message}</td></tr>`;
+            }
+        }
+
+        async function resolveFlag(uri, val) {
+            try {
+                const res = await fetch('/admin/resolve', {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/json',
+                        'X-Moderation-Key': authToken
+                    },
+                    body: JSON.stringify({ uri, val })
+                });
+
+                if (!res.ok) {
+                    const data = await res.json();
+                    throw new Error(data.message || 'failed to resolve');
+                }
+
+                showStatus('flag resolved successfully', 'success');
+                loadFlags();
+
+            } catch (err) {
+                showStatus(err.message, 'error');
+            }
+        }
+
+        function escapeHtml(str) {
+            return str.replace(/&/g, '&amp;')
+                      .replace(/</g, '&lt;')
+                      .replace(/>/g, '&gt;')
+                      .replace(/"/g, '&quot;')
+                      .replace(/'/g, '&#039;');
+        }
+    </script>
+</body>
+</html>
+"##;

moderation/src/audd.rs

···
+//! AuDD audio fingerprinting integration.
+
+use axum::{extract::State, Json};
+use serde::{Deserialize, Serialize};
+use tracing::info;
+
+use crate::state::{AppError, AppState};
+
+// --- request/response types ---
+
+#[derive(Debug, Deserialize)]
+pub struct ScanRequest {
+    pub audio_url: String,
+}
+
+#[derive(Debug, Serialize)]
+pub struct ScanResponse {
+    pub matches: Vec<AuddMatch>,
+    pub is_flagged: bool,
+    pub highest_score: i32,
+    pub raw_response: serde_json::Value,
+}
+
+#[derive(Debug, Serialize, Clone)]
+pub struct AuddMatch {
+    pub artist: String,
+    pub title: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub album: Option<String>,
+    pub score: i32,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub isrc: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub timecode: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub offset_ms: Option<i64>,
+}
+
+// --- audd api types ---
+
+#[derive(Debug, Deserialize)]
+pub struct AuddResponse {
+    pub status: Option<String>,
+    pub result: Option<AuddResult>,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(untagged)]
+pub enum AuddResult {
+    Groups(Vec<AuddGroup>),
+    Single(AuddSong),
+}
+
+#[derive(Debug, Deserialize)]
+pub struct AuddGroup {
+    pub offset: Option<serde_json::Value>,
+    pub songs: Option<Vec<AuddSong>>,
+}
+
+#[derive(Debug, Deserialize)]
+#[allow(dead_code)]
+pub struct AuddSong {
+    pub artist: Option<String>,
+    pub title: Option<String>,
+    pub album: Option<String>,
+    pub score: Option<i32>,
+    pub isrc: Option<String>,
+    pub timecode: Option<String>,
+    pub release_date: Option<String>,
+    pub label: Option<String>,
+    pub song_link: Option<String>,
+}
+
+// --- handler ---
+
+/// Scan audio for copyright matches via AuDD.
+pub async fn scan(
+    State(state): State<AppState>,
+    Json(request): Json<ScanRequest>,
+) -> Result<Json<ScanResponse>, AppError> {
+    info!(audio_url = %request.audio_url, "scanning audio");
+
+    let client = reqwest::Client::new();
+    let response = client
+        .post(&state.audd_api_url)
+        .form(&[
+            ("api_token", &state.audd_api_token),
+            ("url", &request.audio_url),
+            ("accurate_offsets", &"1".to_string()),
+        ])
+        .send()
+        .await
+        .map_err(|e| AppError::Audd(format!("request failed: {e}")))?;
+
+    let raw_response: serde_json::Value = response
+        .json()
+        .await
+        .map_err(|e| AppError::Audd(format!("failed to parse response: {e}")))?;
+
+    let audd_response: AuddResponse = serde_json::from_value(raw_response.clone())
+        .map_err(|e| AppError::Audd(format!("failed to parse audd response: {e}")))?;
+
+    if audd_response.status.as_deref() == Some("error") {
+        return Err(AppError::Audd(format!(
+            "audd returned error: {}",
+            raw_response
+        )));
+    }
+
+    let matches = extract_matches(&audd_response);
+    let highest_score = matches.iter().map(|m| m.score).max().unwrap_or(0);
+    let is_flagged = !matches.is_empty();
+
+    info!(
+        match_count = matches.len(),
+        highest_score,
+        is_flagged,
+        "scan complete"
+    );
+
+    Ok(Json(ScanResponse {
+        matches,
+        is_flagged,
+        highest_score,
+        raw_response,
+    }))
+}
+
+// --- helpers ---
+
+fn extract_matches(response: &AuddResponse) -> Vec<AuddMatch> {
+    let Some(result) = &response.result else {
+        return vec![];
+    };
+
+    match result {
+        AuddResult::Groups(groups) => groups
+            .iter()
+            .flat_map(|group| {
+                group
+                    .songs
+                    .as_ref()
+                    .map(|songs| {
+                        songs
+                            .iter()
+                            .map(|song| parse_song(song, group.offset.as_ref()))
+                            .collect::<Vec<_>>()
+                    })
+                    .unwrap_or_default()
+            })
+            .collect(),
+        AuddResult::Single(song) => vec![parse_song(song, None)],
+    }
+}
+
+fn parse_song(song: &AuddSong, offset: Option<&serde_json::Value>) -> AuddMatch {
+    let offset_ms = offset.and_then(|v| match v {
+        serde_json::Value::Number(n) => n.as_i64(),
+        serde_json::Value::String(s) => parse_timecode_to_ms(s),
+        _ => None,
+    });
+
+    AuddMatch {
+        artist: song.artist.clone().unwrap_or_else(|| "Unknown".to_string()),
+        title: song.title.clone().unwrap_or_else(|| "Unknown".to_string()),
+        album: song.album.clone(),
+        score: song.score.unwrap_or(0),
+        isrc: song.isrc.clone(),
+        timecode: song.timecode.clone(),
+        offset_ms,
+    }
+}
+
+fn parse_timecode_to_ms(timecode: &str) -> Option<i64> {
+    let parts: Vec<&str> = timecode.split(':').collect();
+    match parts.len() {
+        2 => {
+            let mins: i64 = parts[0].parse().ok()?;
+            let secs: i64 = parts[1].parse().ok()?;
+            Some((mins * 60 + secs) * 1000)
+        }
+        3 => {
+            let hours: i64 = parts[0].parse().ok()?;
+            let mins: i64 = parts[1].parse().ok()?;
+            let secs: i64 = parts[2].parse().ok()?;
+            Some((hours * 3600 + mins * 60 + secs) * 1000)
+        }
+        _ => None,
+    }
+}

moderation/src/auth.rs

···
+//! Authentication middleware.
+
+use axum::{extract::Request, http::StatusCode, middleware::Next, response::Response};
+use tracing::warn;
+
+/// Auth middleware that checks X-Moderation-Key header for protected endpoints.
+pub async fn auth_middleware(
+    req: Request,
+    next: Next,
+    auth_token: Option<String>,
+) -> Result<Response, StatusCode> {
+    let path = req.uri().path();
+
+    // Public endpoints - no auth required
+    if path == "/"
+        || path == "/health"
+        || path.starts_with("/xrpc/com.atproto.label.")
+    {
+        return Ok(next.run(req).await);
+    }
+
+    let Some(expected_token) = auth_token else {
+        warn!("no MODERATION_AUTH_TOKEN set - accepting all requests");
+        return Ok(next.run(req).await);
+    };
+
+    let token = req
+        .headers()
+        .get("X-Moderation-Key")
+        .and_then(|v| v.to_str().ok());
+
+    match token {
+        Some(t) if t == expected_token => Ok(next.run(req).await),
+        Some(_) => {
+            warn!("invalid auth token provided");
+            Err(StatusCode::UNAUTHORIZED)
+        }
+        None => {
+            warn!("missing X-Moderation-Key header");
+            Err(StatusCode::UNAUTHORIZED)
+        }
+    }
+}

moderation/src/config.rs

···
+//! Configuration loading from environment variables.
+
+use anyhow::anyhow;
+use std::env;
+
+/// Service configuration loaded from environment.
+pub struct Config {
+    pub host: String,
+    pub port: u16,
+    pub auth_token: Option<String>,
+    pub audd_api_token: String,
+    pub audd_api_url: String,
+    pub database_url: Option<String>,
+    pub labeler_did: Option<String>,
+    pub labeler_signing_key: Option<String>,
+}
+
+impl Config {
+    /// Load configuration from environment variables.
+    pub fn from_env() -> anyhow::Result<Self> {
+        Ok(Self {
+            host: env::var("MODERATION_HOST").unwrap_or_else(|_| "0.0.0.0".to_string()),
+            port: env::var("MODERATION_PORT")
+                .ok()
+                .and_then(|v| v.parse().ok())
+                .unwrap_or(8083),
+            auth_token: env::var("MODERATION_AUTH_TOKEN").ok(),
+            audd_api_token: env::var("MODERATION_AUDD_API_TOKEN")
+                .map_err(|_| anyhow!("MODERATION_AUDD_API_TOKEN is required"))?,
+            audd_api_url: env::var("MODERATION_AUDD_API_URL")
+                .unwrap_or_else(|_| "https://enterprise.audd.io/".to_string()),
+            database_url: env::var("MODERATION_DATABASE_URL").ok(),
+            labeler_did: env::var("MODERATION_LABELER_DID").ok(),
+            labeler_signing_key: env::var("MODERATION_LABELER_SIGNING_KEY").ok(),
+        })
+    }
+
+    /// Check if labeler is fully configured.
+    pub fn labeler_enabled(&self) -> bool {
+        self.database_url.is_some()
+            && self.labeler_did.is_some()
+            && self.labeler_signing_key.is_some()
+    }
+}

moderation/src/db.rs

···
 use chrono::{DateTime, Utc};
 use sqlx::{postgres::PgPoolOptions, PgPool};
 
+use crate::admin::FlaggedTrack;
 use crate::labels::Label;
 
 /// Database connection pool and operations.
···
             .fetch_one(&self.pool)
             .await
             .map(|s| s.unwrap_or(0))
+    }
+
+    /// Get all copyright-violation labels with their resolution status.
+    ///
+    /// A label is resolved if there's a negation label for the same uri+val.
+    pub async fn get_pending_flags(&self) -> Result<Vec<FlaggedTrack>, sqlx::Error> {
+        // Get all copyright-violation labels (non-negations)
+        let rows = sqlx::query_as::<_, LabelRow>(
+            r#"
+            SELECT seq, src, uri, cid, val, neg, cts, exp, sig
+            FROM labels
+            WHERE val = 'copyright-violation' AND neg = false
+            ORDER BY seq DESC
+            "#,
+        )
+        .fetch_all(&self.pool)
+        .await?;
+
+        // Get all negation labels for these URIs
+        let uris: Vec<String> = rows.iter().map(|r| r.uri.clone()).collect();
+        let negated_uris: std::collections::HashSet<String> = if !uris.is_empty() {
+            sqlx::query_scalar::<_, String>(
+                r#"
+                SELECT DISTINCT uri
+                FROM labels
+                WHERE val = 'copyright-violation' AND neg = true
+                "#,
+            )
+            .fetch_all(&self.pool)
+            .await?
+            .into_iter()
+            .collect()
+        } else {
+            std::collections::HashSet::new()
+        };
+
+        let tracks = rows
+            .into_iter()
+            .map(|r| FlaggedTrack {
+                seq: r.seq,
+                uri: r.uri.clone(),
+                val: r.val,
+                created_at: r.cts.format("%Y-%m-%d %H:%M:%S").to_string(),
+                resolved: negated_uris.contains(&r.uri),
+            })
+            .collect();
+
+        Ok(tracks)
     }
 }
 

moderation/src/handlers.rs

···
+//! HTTP request handlers for core endpoints.
+
+use axum::{extract::State, response::Html, Json};
+use serde::{Deserialize, Serialize};
+use tracing::info;
+
+use crate::labels::Label;
+use crate::state::{AppError, AppState};
+
+// --- types ---
+
+#[derive(Debug, Serialize)]
+pub struct HealthResponse {
+    pub status: &'static str,
+    pub labeler_enabled: bool,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct EmitLabelRequest {
+    /// AT URI of the resource to label (e.g., at://did:plc:xxx/fm.plyr.track/abc123)
+    pub uri: String,
+    /// Label value (e.g., "copyright-violation")
+    #[serde(default = "default_label_val")]
+    pub val: String,
+    /// Optional CID of specific version
+    pub cid: Option<String>,
+    /// If true, negate an existing label
+    #[serde(default)]
+    pub neg: bool,
+}
+
+fn default_label_val() -> String {
+    "copyright-violation".to_string()
+}
+
+#[derive(Debug, Serialize)]
+pub struct EmitLabelResponse {
+    pub seq: i64,
+    pub label: Label,
+}
+
+// --- handlers ---
+
+/// Health check endpoint.
+pub async fn health(State(state): State<AppState>) -> Json<HealthResponse> {
+    Json(HealthResponse {
+        status: "ok",
+        labeler_enabled: state.db.is_some(),
+    })
+}
+
+/// Landing page with service info.
+pub async fn landing(State(state): State<AppState>) -> Html<String> {
+    let labeler_did = state
+        .signer
+        .as_ref()
+        .map(|s| s.did().to_string())
+        .unwrap_or_else(|| "not configured".to_string());
+
+    Html(format!(
+        r#"<!DOCTYPE html>
+<html>
+<head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <title>plyr.fm moderation</title>
+    <style>
+        body {{
+            font-family: system-ui, -apple-system, sans-serif;
+            background: #0a0a0a;
+            color: #e5e5e5;
+            max-width: 600px;
+            margin: 80px auto;
+            padding: 20px;
+            line-height: 1.6;
+        }}
+        h1 {{ color: #fff; margin-bottom: 8px; }}
+        .subtitle {{ color: #888; margin-bottom: 32px; }}
+        a {{ color: #3b82f6; }}
+        code {{
+            background: #1a1a1a;
+            padding: 2px 6px;
+            border-radius: 4px;
+            font-size: 0.9em;
+        }}
+        .endpoint {{
+            background: #111;
+            border: 1px solid #222;
+            border-radius: 8px;
+            padding: 16px;
+            margin: 12px 0;
+        }}
+        .endpoint-name {{ color: #10b981; font-family: monospace; }}
+    </style>
+</head>
+<body>
+    <h1>plyr.fm moderation</h1>
+    <p class="subtitle">ATProto labeler for audio content moderation</p>
+
+    <p>This service provides content labels for <a href="https://plyr.fm">plyr.fm</a>,
+    the music streaming platform on ATProto.</p>
+
+    <p><strong>Labeler DID:</strong> <code>{}</code></p>
+
+    <h2>Endpoints</h2>
+
+    <div class="endpoint">
+        <div class="endpoint-name">GET /xrpc/com.atproto.label.queryLabels</div>
+        <p>Query labels by URI pattern</p>
+    </div>
+
+    <div class="endpoint">
+        <div class="endpoint-name">GET /xrpc/com.atproto.label.subscribeLabels</div>
+        <p>WebSocket subscription for real-time label updates</p>
+    </div>
+
+    <p style="margin-top: 32px; color: #666;">
+        <a href="https://bsky.app/profile/moderation.plyr.fm">@moderation.plyr.fm</a>
+    </p>
+</body>
+</html>"#,
+        labeler_did
+    ))
+}
+
+/// Emit a new label (internal API).
+pub async fn emit_label(
+    State(state): State<AppState>,
+    Json(request): Json<EmitLabelRequest>,
+) -> Result<Json<EmitLabelResponse>, AppError> {
+    let db = state.db.as_ref().ok_or(AppError::LabelerNotConfigured)?;
+    let signer = state.signer.as_ref().ok_or(AppError::LabelerNotConfigured)?;
+
+    info!(uri = %request.uri, val = %request.val, neg = request.neg, "emitting label");
+
+    // Create and sign the label
+    let mut label = Label::new(signer.did(), &request.uri, &request.val);
+    if let Some(cid) = request.cid {
+        label = label.with_cid(cid);
+    }
+    if request.neg {
+        label = label.negated();
+    }
+    let label = signer.sign_label(label)?;
+
+    // Store in database
+    let seq = db.store_label(&label).await?;
+    info!(seq, uri = %request.uri, "label stored");
+
+    // Broadcast to subscribers
+    if let Some(tx) = &state.label_tx {
+        let _ = tx.send((seq, label.clone()));
+    }
+
+    Ok(Json(EmitLabelResponse { seq, label }))
+}

moderation/src/labels.rs

···
 
         // Encode to DAG-CBOR
         let cbor_bytes =
-            serde_ipld_dagcbor::to_vec(&unsigned).map_err(|e| LabelError::Serialization(e))?;
+            serde_ipld_dagcbor::to_vec(&unsigned).map_err(LabelError::Serialization)?;
 
         // Sign with secp256k1
         let signature: Signature = signing_key.sign(&cbor_bytes);

moderation/src/main.rs

···
 //! - AuDD audio fingerprinting for copyright detection
 //! - ATProto labeler endpoints (queryLabels, subscribeLabels)
 //! - Label emission for copyright violations
+//! - Admin UI for reviewing and resolving flags
 
-use std::{env, net::SocketAddr, sync::Arc};
+use std::{net::SocketAddr, sync::Arc};
 
 use anyhow::anyhow;
 use axum::{
-    extract::{
-        ws::{Message, WebSocket, WebSocketUpgrade},
-        Query, Request, State,
-    },
-    http::StatusCode,
-    middleware::{self, Next},
-    response::{IntoResponse, Response},
+    middleware,
     routing::{get, post},
-    Json, Router,
+    Router,
 };
-use futures::StreamExt;
-use serde::{Deserialize, Serialize};
 use tokio::{net::TcpListener, sync::broadcast};
-use tokio_stream::wrappers::BroadcastStream;
-use tracing::{error, info, warn};
+use tracing::{info, warn};
 
+mod admin;
+mod audd;
+mod config;
 mod db;
+mod handlers;
 mod labels;
-
-use db::LabelDb;
-use labels::{Label, LabelSigner};
-
-// --- config ---
-
-struct Config {
-    host: String,
-    port: u16,
-    auth_token: Option<String>,
-    audd_api_token: String,
-    audd_api_url: String,
-    database_url: Option<String>,
-    labeler_did: Option<String>,
-    labeler_signing_key: Option<String>,
-}
-
-impl Config {
-    fn from_env() -> anyhow::Result<Self> {
-        Ok(Self {
-            host: env::var("MODERATION_HOST").unwrap_or_else(|_| "0.0.0.0".to_string()),
-            port: env::var("MODERATION_PORT")
-                .ok()
-                .and_then(|v| v.parse().ok())
-                .unwrap_or(8083),
-            auth_token: env::var("MODERATION_AUTH_TOKEN").ok(),
-            audd_api_token: env::var("MODERATION_AUDD_API_TOKEN")
-                .map_err(|_| anyhow!("MODERATION_AUDD_API_TOKEN is required"))?,
-            audd_api_url: env::var("MODERATION_AUDD_API_URL")
-                .unwrap_or_else(|_| "https://enterprise.audd.io/".to_string()),
-            database_url: env::var("MODERATION_DATABASE_URL").ok(),
-            labeler_did: env::var("MODERATION_LABELER_DID").ok(),
-            labeler_signing_key: env::var("MODERATION_LABELER_SIGNING_KEY").ok(),
-        })
-    }
-
-    fn labeler_enabled(&self) -> bool {
-        self.database_url.is_some()
-            && self.labeler_did.is_some()
-            && self.labeler_signing_key.is_some()
-    }
-}
-
-// --- request/response types ---
-
-#[derive(Debug, Deserialize)]
-struct ScanRequest {
-    audio_url: String,
-}
-
-#[derive(Debug, Serialize)]
-struct ScanResponse {
-    matches: Vec<AuddMatch>,
-    is_flagged: bool,
-    highest_score: i32,
-    raw_response: serde_json::Value,
-}
-
-#[derive(Debug, Serialize, Clone)]
-struct AuddMatch {
-    artist: String,
-    title: String,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    album: Option<String>,
-    score: i32,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    isrc: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    timecode: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    offset_ms: Option<i64>,
-}
-
-#[derive(Debug, Serialize)]
-struct HealthResponse {
-    status: &'static str,
-    labeler_enabled: bool,
-}
-
-// --- emit label request ---
-
-#[derive(Debug, Deserialize)]
-struct EmitLabelRequest {
-    /// AT URI of the resource to label (e.g., at://did:plc:xxx/fm.plyr.track/abc123)
-    uri: String,
-    /// Label value (e.g., "copyright-violation")
-    #[serde(default = "default_label_val")]
-    val: String,
-    /// Optional CID of specific version
-    cid: Option<String>,
-    /// If true, negate an existing label
-    #[serde(default)]
-    neg: bool,
-}
-
-fn default_label_val() -> String {
-    "copyright-violation".to_string()
-}
-
-#[derive(Debug, Serialize)]
-struct EmitLabelResponse {
-    seq: i64,
-    label: Label,
-}
-
-// --- xrpc types ---
-
-#[derive(Debug, Deserialize)]
-#[serde(rename_all = "camelCase")]
-struct QueryLabelsParams {
-    uri_patterns: String, // comma-separated
-    sources: Option<String>,
-    cursor: Option<String>,
-    limit: Option<i64>,
-}
-
-#[derive(Debug, Serialize)]
-struct QueryLabelsResponse {
-    cursor: Option<String>,
-    labels: Vec<Label>,
-}
-
-#[derive(Debug, Deserialize)]
-struct SubscribeLabelsParams {
-    cursor: Option<i64>,
-}
-
-// --- audd api types ---
-
-#[derive(Debug, Deserialize)]
-struct AuddResponse {
-    status: Option<String>,
-    result: Option<AuddResult>,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(untagged)]
-enum AuddResult {
-    Groups(Vec<AuddGroup>),
-    Single(AuddSong),
-}
+mod auth;
+mod state;
+mod xrpc;
 
-#[derive(Debug, Deserialize)]
-struct AuddGroup {
-    offset: Option<serde_json::Value>,
-    songs: Option<Vec<AuddSong>>,
-}
-
-#[derive(Debug, Deserialize)]
-#[allow(dead_code)]
-struct AuddSong {
-    artist: Option<String>,
-    title: Option<String>,
-    album: Option<String>,
-    score: Option<i32>,
-    isrc: Option<String>,
-    timecode: Option<String>,
-    release_date: Option<String>,
-    label: Option<String>,
-    song_link: Option<String>,
-}
-
-// --- main ---
+pub use state::{AppError, AppState};
 
 #[tokio::main]
 async fn main() -> anyhow::Result<()> {
···
         .with_target(false)
         .init();
 
-    let config = Config::from_env()?;
+    let config = config::Config::from_env()?;
     let auth_token = config.auth_token.clone();
 
     // Initialize labeler components if configured
     let (db, signer, label_tx) = if config.labeler_enabled() {
-        let db = LabelDb::connect(config.database_url.as_ref().unwrap()).await?;
+        let db = db::LabelDb::connect(config.database_url.as_ref().unwrap()).await?;
         db.migrate().await?;
         info!("labeler database connected and migrated");
 
-        let signer = LabelSigner::from_hex(
+        let signer = labels::LabelSigner::from_hex(
             config.labeler_signing_key.as_ref().unwrap(),
             config.labeler_did.as_ref().unwrap(),
         )?;
         info!(did = %signer.did(), "labeler signer initialized");
 
-        let (tx, _) = broadcast::channel::<(i64, Label)>(1024);
+        let (tx, _) = broadcast::channel::<(i64, labels::Label)>(1024);
         (Some(db), Some(signer), Some(tx))
     } else {
         warn!("labeler not configured - XRPC endpoints will return 503");
···
 
     let app = Router::new()
         // Landing page
-        .route("/", get(landing))
+        .route("/", get(handlers::landing))
         // Health check
-        .route("/health", get(health))
-        // AuDD scanning (existing)
-        .route("/scan", post(scan))
+        .route("/health", get(handlers::health))
+        // AuDD scanning
+        .route("/scan", post(audd::scan))
         // Label emission (internal API)
-        .route("/emit-label", post(emit_label))
+        .route("/emit-label", post(handlers::emit_label))
+        // Admin UI and API
+        .route("/admin", get(admin::admin_ui))
+        .route("/admin/flags", get(admin::list_flagged))
+        .route("/admin/resolve", post(admin::resolve_flag))
         // ATProto XRPC endpoints (public)
-        .route("/xrpc/com.atproto.label.queryLabels", get(query_labels))
+        .route("/xrpc/com.atproto.label.queryLabels", get(xrpc::query_labels))
         .route(
             "/xrpc/com.atproto.label.subscribeLabels",
-            get(subscribe_labels),
+            get(xrpc::subscribe_labels),
         )
         .layer(middleware::from_fn(move |req, next| {
-            auth_middleware(req, next, auth_token.clone())
+            auth::auth_middleware(req, next, auth_token.clone())
         }))
         .with_state(state);
 
···
     axum::serve(listener, app).await?;
     Ok(())
 }
-
-// --- state ---
-
-#[derive(Clone)]
-struct AppState {
-    audd_api_token: String,
-    audd_api_url: String,
-    db: Option<Arc<LabelDb>>,
-    signer: Option<Arc<LabelSigner>>,
-    label_tx: Option<broadcast::Sender<(i64, Label)>>,
-}
-
-// --- middleware ---
-
-async fn auth_middleware(
-    req: Request,
-    next: Next,
-    auth_token: Option<String>,
-) -> Result<Response, StatusCode> {
-    let path = req.uri().path();
-
-    // Public endpoints - no auth required
-    if path == "/"
-        || path == "/health"
-        || path.starts_with("/xrpc/com.atproto.label.")
-    {
-        return Ok(next.run(req).await);
-    }
-
-    let Some(expected_token) = auth_token else {
-        warn!("no MODERATION_AUTH_TOKEN set - accepting all requests");
-        return Ok(next.run(req).await);
-    };
-
-    let token = req
-        .headers()
-        .get("X-Moderation-Key")
-        .and_then(|v| v.to_str().ok());
-
-    match token {
-        Some(t) if t == expected_token => Ok(next.run(req).await),
-        Some(_) => {
-            warn!("invalid auth token provided");
-            Err(StatusCode::UNAUTHORIZED)
-        }
-        None => {
-            warn!("missing X-Moderation-Key header");
-            Err(StatusCode::UNAUTHORIZED)
-        }
-    }
-}
-
-// --- handlers ---
-
-async fn health(State(state): State<AppState>) -> Json<HealthResponse> {
-    Json(HealthResponse {
-        status: "ok",
-        labeler_enabled: state.db.is_some(),
-    })
-}
-
-async fn landing(State(state): State<AppState>) -> axum::response::Html<String> {
-    let labeler_did = state
-        .signer
-        .as_ref()
-        .map(|s| s.did().to_string())
-        .unwrap_or_else(|| "not configured".to_string());
-
-    axum::response::Html(format!(
-        r#"<!DOCTYPE html>
-<html>
-<head>
-    <meta charset="utf-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1">
-    <title>plyr.fm moderation</title>
-    <style>
-        body {{
-            font-family: system-ui, -apple-system, sans-serif;
-            background: #0a0a0a;
-            color: #e5e5e5;
-            max-width: 600px;
-            margin: 80px auto;
-            padding: 20px;
-            line-height: 1.6;
-        }}
-        h1 {{ color: #fff; margin-bottom: 8px; }}
-        .subtitle {{ color: #888; margin-bottom: 32px; }}
-        a {{ color: #3b82f6; }}
-        code {{
-            background: #1a1a1a;
-            padding: 2px 6px;
-            border-radius: 4px;
-            font-size: 0.9em;
-        }}
-        .endpoint {{
-            background: #111;
-            border: 1px solid #222;
-            border-radius: 8px;
-            padding: 16px;
-            margin: 12px 0;
-        }}
-        .endpoint-name {{ color: #10b981; font-family: monospace; }}
-    </style>
-</head>
-<body>
-    <h1>plyr.fm moderation</h1>
-    <p class="subtitle">ATProto labeler for audio content moderation</p>
-
-    <p>This service provides content labels for <a href="https://plyr.fm">plyr.fm</a>,
-    the music streaming platform on ATProto.</p>
-
-    <p><strong>Labeler DID:</strong> <code>{}</code></p>
-
-    <h2>Endpoints</h2>
-
-    <div class="endpoint">
-        <div class="endpoint-name">GET /xrpc/com.atproto.label.queryLabels</div>
-        <p>Query labels by URI pattern</p>
-    </div>
-
-    <div class="endpoint">
-        <div class="endpoint-name">GET /xrpc/com.atproto.label.subscribeLabels</div>
-        <p>WebSocket subscription for real-time label updates</p>
-    </div>
-
-    <p style="margin-top: 32px; color: #666;">
-        <a href="https://bsky.app/profile/moderation.plyr.fm">@moderation.plyr.fm</a>
-    </p>
-</body>
-</html>"#,
-        labeler_did
-    ))
-}
-
-async fn scan(
-    State(state): State<AppState>,
-    Json(request): Json<ScanRequest>,
-) -> Result<Json<ScanResponse>, AppError> {
-    info!(audio_url = %request.audio_url, "scanning audio");
-
-    let client = reqwest::Client::new();
-    let response = client
-        .post(&state.audd_api_url)
-        .form(&[
-            ("api_token", &state.audd_api_token),
-            ("url", &request.audio_url),
-            ("accurate_offsets", &"1".to_string()),
-        ])
-        .send()
-        .await
-        .map_err(|e| AppError::Audd(format!("request failed: {e}")))?;
-
-    let raw_response: serde_json::Value = response
-        .json()
-        .await
-        .map_err(|e| AppError::Audd(format!("failed to parse response: {e}")))?;
-
-    let audd_response: AuddResponse = serde_json::from_value(raw_response.clone())
-        .map_err(|e| AppError::Audd(format!("failed to parse audd response: {e}")))?;
-
-    if audd_response.status.as_deref() == Some("error") {
-        return Err(AppError::Audd(format!(
-            "audd returned error: {}",
-            raw_response
-        )));
-    }
-
-    let matches = extract_matches(&audd_response);
-    let highest_score = matches.iter().map(|m| m.score).max().unwrap_or(0);
-    let is_flagged = !matches.is_empty();
-
-    info!(
-        match_count = matches.len(),
-        highest_score,
-        is_flagged,
-        "scan complete"
-    );
-
-    Ok(Json(ScanResponse {
-        matches,
-        is_flagged,
-        highest_score,
-        raw_response,
-    }))
-}
-
-async fn emit_label(
-    State(state): State<AppState>,
-    Json(request): Json<EmitLabelRequest>,
-) -> Result<Json<EmitLabelResponse>, AppError> {
-    let db = state.db.as_ref().ok_or(AppError::LabelerNotConfigured)?;
-    let signer = state.signer.as_ref().ok_or(AppError::LabelerNotConfigured)?;
-
-    info!(uri = %request.uri, val = %request.val, neg = request.neg, "emitting label");
-
-    // Create and sign the label
-    let mut label = Label::new(signer.did(), &request.uri, &request.val);
-    if let Some(cid) = request.cid {
-        label = label.with_cid(cid);
-    }
-    if request.neg {
-        label = label.negated();
-    }
-    let label = signer.sign_label(label)?;
-
-    // Store in database
-    let seq = db.store_label(&label).await?;
-    info!(seq, uri = %request.uri, "label stored");
-
-    // Broadcast to subscribers
-    if let Some(tx) = &state.label_tx {
-        let _ = tx.send((seq, label.clone()));
-    }
-
-    Ok(Json(EmitLabelResponse { seq, label }))
-}
-
-async fn query_labels(
-    State(state): State<AppState>,
-    Query(params): Query<QueryLabelsParams>,
-) -> Result<Json<QueryLabelsResponse>, AppError> {
-    let db = state.db.as_ref().ok_or(AppError::LabelerNotConfigured)?;
-
-    let uri_patterns: Vec<String> = params
-        .uri_patterns
-        .split(',')
-        .map(|s| s.trim().to_string())
-        .collect();
-    let sources: Option<Vec<String>> = params
-        .sources
-        .map(|s| s.split(',').map(|s| s.trim().to_string()).collect());
-    let limit = params.limit.unwrap_or(50).min(250).max(1);
-
-    let (rows, cursor) = db
-        .query_labels(
-            &uri_patterns,
-            sources.as_deref(),
-            params.cursor.as_deref(),
-            limit,
-        )
-        .await?;
-
-    let labels: Vec<Label> = rows.iter().map(|r| r.to_label()).collect();
-
-    Ok(Json(QueryLabelsResponse { cursor, labels }))
-}
-
-async fn subscribe_labels(
-    State(state): State<AppState>,
-    Query(params): Query<SubscribeLabelsParams>,
-    ws: WebSocketUpgrade,
-) -> Result<Response, AppError> {
-    let db = state.db.clone().ok_or(AppError::LabelerNotConfigured)?;
-    let label_tx = state.label_tx.clone().ok_or(AppError::LabelerNotConfigured)?;
-
-    Ok(ws.on_upgrade(move |socket| handle_subscribe(socket, db, label_tx, params.cursor)))
-}
-
-async fn handle_subscribe(
-    mut socket: WebSocket,
-    db: Arc<LabelDb>,
-    label_tx: broadcast::Sender<(i64, Label)>,
-    cursor: Option<i64>,
-) {
-    // If cursor provided, backfill from that point
-    let start_seq = if let Some(c) = cursor {
-        // Send historical labels first
-        match db.get_labels_since(c, 1000).await {
-            Ok(rows) => {
-                for row in &rows {
-                    let msg = SubscribeLabelsMessage {
-                        seq: row.seq,
-                        labels: vec![row.to_label()],
-                    };
-                    if let Ok(json) = serde_json::to_string(&msg) {
-                        if socket.send(Message::Text(json.into())).await.is_err() {
-                            return;
-                        }
-                    }
-                }
-                rows.last().map(|r| r.seq).unwrap_or(c)
-            }
-            Err(e) => {
-                error!(error = %e, "failed to backfill labels");
-                return;
-            }
-        }
-    } else {
-        // Start from current position
-        db.get_latest_seq().await.unwrap_or(0)
-    };
-
-    // Subscribe to live updates
-    let rx = label_tx.subscribe();
-    let mut stream = BroadcastStream::new(rx);
-
-    let mut last_seq = start_seq;
-
-    loop {
-        tokio::select! {
-            // Receive from broadcast
-            Some(result) = stream.next() => {
-                match result {
-                    Ok((seq, label)) => {
-                        if seq > last_seq {
-                            let msg = SubscribeLabelsMessage {
-                                seq,
-                                labels: vec![label],
-                            };
-                            if let Ok(json) = serde_json::to_string(&msg) {
-                                if socket.send(Message::Text(json.into())).await.is_err() {
-                                    break;
-                                }
-                            }
-                            last_seq = seq;
-                        }
-                    }
-                    Err(_) => continue, // Lagged, skip
-                }
-            }
-            // Check for client disconnect
-            msg = socket.recv() => {
-                match msg {
-                    Some(Ok(Message::Close(_))) | None => break,
-                    Some(Ok(Message::Ping(data))) => {
-                        if socket.send(Message::Pong(data)).await.is_err() {
-                            break;
-                        }
-                    }
-                    _ => {}
-                }
-            }
-        }
-    }
-}
-
-#[derive(Serialize)]
-struct SubscribeLabelsMessage {
-    seq: i64,
-    labels: Vec<Label>,
-}
-
-fn extract_matches(response: &AuddResponse) -> Vec<AuddMatch> {
-    let Some(result) = &response.result else {
-        return vec![];
-    };
-
-    match result {
-        AuddResult::Groups(groups) => groups
-            .iter()
-            .flat_map(|group| {
-                group
-                    .songs
-                    .as_ref()
-                    .map(|songs| {
-                        songs
-                            .iter()
-                            .map(|song| parse_song(song, group.offset.as_ref()))
-                            .collect::<Vec<_>>()
-                    })
-                    .unwrap_or_default()
-            })
-            .collect(),
-        AuddResult::Single(song) => vec![parse_song(song, None)],
-    }
-}
-
-fn parse_song(song: &AuddSong, offset: Option<&serde_json::Value>) -> AuddMatch {
-    let offset_ms = offset.and_then(|v| match v {
-        serde_json::Value::Number(n) => n.as_i64(),
-        serde_json::Value::String(s) => parse_timecode_to_ms(s),
-        _ => None,
-    });
-
-    AuddMatch {
-        artist: song.artist.clone().unwrap_or_else(|| "Unknown".to_string()),
-        title: song.title.clone().unwrap_or_else(|| "Unknown".to_string()),
-        album: song.album.clone(),
-        score: song.score.unwrap_or(0),
-        isrc: song.isrc.clone(),
-        timecode: song.timecode.clone(),
-        offset_ms,
-    }
-}
-
-fn parse_timecode_to_ms(timecode: &str) -> Option<i64> {
-    let parts: Vec<&str> = timecode.split(':').collect();
-    match parts.len() {
-        2 => {
-            let mins: i64 = parts[0].parse().ok()?;
-            let secs: i64 = parts[1].parse().ok()?;
-            Some((mins * 60 + secs) * 1000)
-        }
-        3 => {
-            let hours: i64 = parts[0].parse().ok()?;
-            let mins: i64 = parts[1].parse().ok()?;
-            let secs: i64 = parts[2].parse().ok()?;
-            Some((hours * 3600 + mins * 60 + secs) * 1000)
-        }
-        _ => None,
-    }
-}
-
-// --- errors ---
-
-#[derive(Debug, thiserror::Error)]
-enum AppError {
-    #[error("audd error: {0}")]
-    Audd(String),
-
-    #[error("labeler not configured")]
-    LabelerNotConfigured,
-
-    #[error("label error: {0}")]
-    Label(#[from] labels::LabelError),
-
-    #[error("database error: {0}")]
-    Database(#[from] sqlx::Error),
-}
-
-impl IntoResponse for AppError {
-    fn into_response(self) -> Response {
-        error!(error = %self, "request failed");
-        let (status, error_type) = match &self {
-            AppError::Audd(_) => (StatusCode::BAD_GATEWAY, "AuddError"),
-            AppError::LabelerNotConfigured => (StatusCode::SERVICE_UNAVAILABLE, "LabelerNotConfigured"),
-            AppError::Label(_) => (StatusCode::INTERNAL_SERVER_ERROR, "LabelError"),
-            AppError::Database(_) => (StatusCode::INTERNAL_SERVER_ERROR, "DatabaseError"),
-        };
-        let body = serde_json::json!({
-            "error": error_type,
-            "message": self.to_string()
-        });
-        (status, Json(body)).into_response()
-    }
-}

moderation/src/state.rs

···
+//! Application state and error types.
+
+use std::sync::Arc;
+
+use axum::{
+    http::StatusCode,
+    response::{IntoResponse, Response},
+    Json,
+};
+use tokio::sync::broadcast;
+use tracing::error;
+
+use crate::db::LabelDb;
+use crate::labels::{Label, LabelError, LabelSigner};
+
+/// Shared application state.
+#[derive(Clone)]
+pub struct AppState {
+    pub audd_api_token: String,
+    pub audd_api_url: String,
+    pub db: Option<Arc<LabelDb>>,
+    pub signer: Option<Arc<LabelSigner>>,
+    pub label_tx: Option<broadcast::Sender<(i64, Label)>>,
+}
+
+/// Application error type.
+#[derive(Debug, thiserror::Error)]
+pub enum AppError {
+    #[error("audd error: {0}")]
+    Audd(String),
+
+    #[error("labeler not configured")]
+    LabelerNotConfigured,
+
+    #[error("label error: {0}")]
+    Label(#[from] LabelError),
+
+    #[error("database error: {0}")]
+    Database(#[from] sqlx::Error),
+}
+
+impl IntoResponse for AppError {
+    fn into_response(self) -> Response {
+        error!(error = %self, "request failed");
+        let (status, error_type) = match &self {
+            AppError::Audd(_) => (StatusCode::BAD_GATEWAY, "AuddError"),
+            AppError::LabelerNotConfigured => {
+                (StatusCode::SERVICE_UNAVAILABLE, "LabelerNotConfigured")
+            }
+            AppError::Label(_) => (StatusCode::INTERNAL_SERVER_ERROR, "LabelError"),
+            AppError::Database(_) => (StatusCode::INTERNAL_SERVER_ERROR, "DatabaseError"),
+        };
+        let body = serde_json::json!({
+            "error": error_type,
+            "message": self.to_string()
+        });
+        (status, Json(body)).into_response()
+    }
+}

moderation/src/xrpc.rs

···
+//! ATProto XRPC endpoints for the labeler protocol.
+
+use std::sync::Arc;
+
+use axum::{
+    extract::{
+        ws::{Message, WebSocket, WebSocketUpgrade},
+        Query, State,
+    },
+    response::Response,
+    Json,
+};
+use futures::StreamExt;
+use serde::{Deserialize, Serialize};
+use tokio::sync::broadcast;
+use tokio_stream::wrappers::BroadcastStream;
+use tracing::error;
+
+use crate::db::LabelDb;
+use crate::labels::Label;
+use crate::state::{AppError, AppState};
+
+// --- types ---
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct QueryLabelsParams {
+    pub uri_patterns: String, // comma-separated
+    pub sources: Option<String>,
+    pub cursor: Option<String>,
+    pub limit: Option<i64>,
+}
+
+#[derive(Debug, Serialize)]
+pub struct QueryLabelsResponse {
+    pub cursor: Option<String>,
+    pub labels: Vec<Label>,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct SubscribeLabelsParams {
+    pub cursor: Option<i64>,
+}
+
+#[derive(Serialize)]
+struct SubscribeLabelsMessage {
+    seq: i64,
+    labels: Vec<Label>,
+}
+
+// --- handlers ---
+
+/// Query labels by URI pattern.
+pub async fn query_labels(
+    State(state): State<AppState>,
+    Query(params): Query<QueryLabelsParams>,
+) -> Result<Json<QueryLabelsResponse>, AppError> {
+    let db = state.db.as_ref().ok_or(AppError::LabelerNotConfigured)?;
+
+    let uri_patterns: Vec<String> = params
+        .uri_patterns
+        .split(',')
+        .map(|s| s.trim().to_string())
+        .collect();
+    let sources: Option<Vec<String>> = params
+        .sources
+        .map(|s| s.split(',').map(|s| s.trim().to_string()).collect());
+    let limit = params.limit.unwrap_or(50).clamp(1, 250);
+
+    let (rows, cursor) = db
+        .query_labels(
+            &uri_patterns,
+            sources.as_deref(),
+            params.cursor.as_deref(),
+            limit,
+        )
+        .await?;
+
+    let labels: Vec<Label> = rows.iter().map(|r| r.to_label()).collect();
+
+    Ok(Json(QueryLabelsResponse { cursor, labels }))
+}
+
+/// WebSocket subscription for real-time label updates.
+pub async fn subscribe_labels(
+    State(state): State<AppState>,
+    Query(params): Query<SubscribeLabelsParams>,
+    ws: WebSocketUpgrade,
+) -> Result<Response, AppError> {
+    let db = state.db.clone().ok_or(AppError::LabelerNotConfigured)?;
+    let label_tx = state
+        .label_tx
+        .clone()
+        .ok_or(AppError::LabelerNotConfigured)?;
+
+    Ok(ws.on_upgrade(move |socket| handle_subscribe(socket, db, label_tx, params.cursor)))
+}
+
+async fn handle_subscribe(
+    mut socket: WebSocket,
+    db: Arc<LabelDb>,
+    label_tx: broadcast::Sender<(i64, Label)>,
+    cursor: Option<i64>,
+) {
+    // If cursor provided, backfill from that point
+    let start_seq = if let Some(c) = cursor {
+        // Send historical labels first
+        match db.get_labels_since(c, 1000).await {
+            Ok(rows) => {
+                for row in &rows {
+                    let msg = SubscribeLabelsMessage {
+                        seq: row.seq,
+                        labels: vec![row.to_label()],
+                    };
+                    if let Ok(json) = serde_json::to_string(&msg) {
+                        if socket.send(Message::Text(json)).await.is_err() {
+                            return;
+                        }
+                    }
+                }
+                rows.last().map(|r| r.seq).unwrap_or(c)
+            }
+            Err(e) => {
+                error!(error = %e, "failed to backfill labels");
+                return;
+            }
+        }
+    } else {
+        // Start from current position
+        db.get_latest_seq().await.unwrap_or(0)
+    };
+
+    // Subscribe to live updates
+    let rx = label_tx.subscribe();
+    let mut stream = BroadcastStream::new(rx);
+
+    let mut last_seq = start_seq;
+
+    loop {
+        tokio::select! {
+            // Receive from broadcast
+            Some(result) = stream.next() => {
+                match result {
+                    Ok((seq, label)) => {
+                        if seq > last_seq {
+                            let msg = SubscribeLabelsMessage {
+                                seq,
+                                labels: vec![label],
+                            };
+                            if let Ok(json) = serde_json::to_string(&msg) {
+                                if socket.send(Message::Text(json)).await.is_err() {
+                                    break;
+                                }
+                            }
+                            last_seq = seq;
+                        }
+                    }
+                    Err(_) => continue, // Lagged, skip
+                }
+            }
+            // Check for client disconnect
+            msg = socket.recv() => {
+                match msg {
+                    Some(Ok(Message::Close(_))) | None => break,
+                    Some(Ok(Message::Ping(data))) => {
+                        if socket.send(Message::Pong(data)).await.is_err() {
+                            break;
+                        }
+                    }
+                    _ => {}
+                }
+            }
+        }
+    }
+}