Before the doublework change

server/auth.ts

@@ -52,11 +52,22 @@ export function requireAdmin(req: Request, res: Response, next: NextFunction) {
   next()
 }
 
+// Operator-designated admins, by handle. Set ADMIN_HANDLES to a comma-separated list
+// (e.g. `ADMIN_HANDLES=jens,ops`); those users receive an admin token at sign-in, so the
+// /admin route and admin APIs open for them. Changing the list takes effect on next login.
+export function isAdminHandle(handle: string) {
+  const handles = (process.env.ADMIN_HANDLES || '').split(',').map(entry => entry.trim().toLowerCase()).filter(Boolean)
+  return handles.includes(handle.trim().toLowerCase())
+}
+
 // Mint a player token (path A: GUPI is the issuer for now). Verification is
 // issuer-agnostic — a glitch.university token with the same sub verifies identically.
-export function signPlayerToken(user: { id: string; displayName: string }) {
+// A handle listed in ADMIN_HANDLES is promoted to an admin token here at sign-in.
+export function signPlayerToken(user: { id: string; displayName: string; handle: string }) {
   if (!process.env.JWT_SECRET) throw new Error('JWT_SECRET is required')
-  return jwt.sign({ sub: user.id, name: user.displayName, role: 'player' }, process.env.JWT_SECRET, { expiresIn: '30d' })
+  const admin = isAdminHandle(user.handle)
+  const claims = { sub: user.id, name: user.displayName, preferred_username: user.handle, role: admin ? 'admin' : 'player', ...(admin ? { isAdmin: true } : {}) }
+  return jwt.sign(claims, process.env.JWT_SECRET, { expiresIn: '30d' })
 }
 
 export function createDevelopmentAdminToken() {