Revert "Implement admin back-pass flow and guarded admin actions"

This reverts commit 5595bfd3b1.
2026-02-08 14:43:26 +01:00
parent 5595bfd3b1
commit 5ec18d20ea
25 changed files with 108 additions and 571 deletions
--- a/API.md
+++ b/API.md
@@ -14,7 +14,7 @@ GET /api/me — id, displayName, username, isAdmin, currentPhase, votesFinal

 ## Player (requires auth)
 POST /api/me/phase/next — advance caller to next phase (Suggest→Vote requires at least one own suggestion; Vote→Results is gated by resultsOpen)  
-POST /api/me/phase/prev — move caller backward (admin: Results→Vote→Suggest, player: Vote→Suggest only when granted a one-time back pass)
+POST /api/me/phase/prev — admin-only move caller backward (Results→Vote→Suggest)

 ## Suggestions (requires auth + phase gating)
 GET /api/suggestions/mine — own suggestions (Suggest phase)  
@@ -32,11 +32,9 @@ POST /api/votes/finalize — `{ final: bool }` toggles caller’s finalized stat
 GET /api/results — leaderboard with totals, counts, averages, caller’s vote, media/links, link metadata

 ## Admin (requires authenticated admin user)
-POST /api/admin/results — `{ resultsOpen: bool }` locks/unlocks results and aligns player phases (closing results moves players with suggestions to `Vote`, players without suggestions to `Suggest`)  
+POST /api/admin/results — `{ resultsOpen: bool }` locks/unlocks results and aligns player phases  
 GET  /api/admin/vote-status — readiness overview (who finalized)  
-POST /api/admin/players/{playerId}/phase — `{ phase: "Suggest" }`; move a player from `Vote` back to `Suggest`  
-DELETE /api/admin/players/{playerId} — `{ adminPassword: string }`; delete a player and all related data  
 POST /api/admin/link-suggestions — `{ sourceSuggestionId, targetSuggestionId }`; merges vote groups during Vote, clears votes in the linked group, unfinalizes **all** players  
 POST /api/admin/unlink-suggestions — `{ suggestionId }`; breaks links, clears votes for that group, unfinalizes **all** players  
-POST /api/admin/reset — `{ adminPassword: string }`; clear suggestions/votes; keep players; reset phases/vote-final flags  
-POST /api/admin/factory-reset — `{ adminPassword: string }`; wipe players, suggestions, votes, state
+POST /api/admin/reset — clear suggestions/votes; keep players; reset phases/vote-final flags  
+POST /api/admin/factory-reset — wipe players, suggestions, votes, state
--- a/Contracts/Dtos.cs
+++ b/Contracts/Dtos.cs
@@ -19,7 +19,3 @@ public record LinkSuggestionsRequest(int SourceSuggestionId, int TargetSuggestio
 public record UnlinkSuggestionsRequest(int SuggestionId);

 public record GrantJokerRequest(Guid PlayerId);
-
-public record AdminPasswordRequest(string AdminPassword);
-
-public record SetPlayerPhaseRequest(Phase Phase);
--- a/Endpoints/AdminEndpoints.cs
+++ b/Endpoints/AdminEndpoints.cs
@@ -17,23 +17,7 @@ public static class AdminEndpoints

        admin.MapPost("/joker", async ([FromBody] GrantJokerRequest request, AdminWorkflowService service) => await service.GrantJokerAsync(request.PlayerId));

-        admin.MapPost("/players/{playerId:guid}/phase", async (Guid playerId, [FromBody] SetPlayerPhaseRequest request, HttpContext ctx, AppDbContext db, AdminWorkflowService service) =>
-        {
-            var player = await EndpointHelpers.GetAuthenticatedPlayer(ctx, db);
-            if (player is null)
-                return EndpointHelpers.UnauthorizedError();
-
-            return await service.SetPlayerPhaseAsync(playerId, request.Phase);
-        });
-
-        admin.MapDelete("/players/{playerId:guid}", async (Guid playerId, [FromBody] AdminPasswordRequest request, HttpContext ctx, AppDbContext db, AdminWorkflowService service) =>
-        {
-            var player = await EndpointHelpers.GetAuthenticatedPlayer(ctx, db);
-            if (player is null)
-                return EndpointHelpers.UnauthorizedError();
-
-            return await service.DeletePlayerAsync(playerId, player.Id, request.AdminPassword);
-        });
+        admin.MapDelete("/players/{playerId:guid}", async (Guid playerId, AdminWorkflowService service) => await service.DeletePlayerAsync(playerId));

        admin.MapPost("/link-suggestions", async ([FromBody] LinkSuggestionsRequest request, HttpContext ctx, AppDbContext db, AdminWorkflowService service) =>
        {
@@ -53,23 +37,9 @@ public static class AdminEndpoints
            return await service.UnlinkSuggestionsAsync(player.Id, request.SuggestionId);
        });

-        admin.MapPost("/reset", async ([FromBody] AdminPasswordRequest request, HttpContext ctx, AppDbContext db, AdminWorkflowService service) =>
-        {
-            var player = await EndpointHelpers.GetAuthenticatedPlayer(ctx, db);
-            if (player is null)
-                return EndpointHelpers.UnauthorizedError();
+        admin.MapPost("/reset", async (AdminWorkflowService service) => await service.ResetAsync());

-            return await service.ResetAsync(player.Id, request.AdminPassword);
-        });
-
-        admin.MapPost("/factory-reset", async ([FromBody] AdminPasswordRequest request, HttpContext ctx, AppDbContext db, AdminWorkflowService service) =>
-        {
-            var player = await EndpointHelpers.GetAuthenticatedPlayer(ctx, db);
-            if (player is null)
-                return EndpointHelpers.UnauthorizedError();
-
-            return await service.FactoryResetAsync(player.Id, request.AdminPassword);
-        });
+        admin.MapPost("/factory-reset", async (AdminWorkflowService service) => await service.FactoryResetAsync());
    }
 }

--- a/Endpoints/AdminWorkflowService.cs
+++ b/Endpoints/AdminWorkflowService.cs
@@ -1,7 +1,6 @@
 using GameList.Contracts;
 using GameList.Data;
 using GameList.Domain;
-using GameList.Infrastructure;
 using Microsoft.EntityFrameworkCore;

 namespace GameList.Endpoints;
@@ -22,21 +21,7 @@ internal sealed class AdminWorkflowService(AppDbContext db)
        }
        else
        {
-            var playersWithSuggestions = await db.Suggestions.Select(s => s.PlayerId).Distinct().ToListAsync();
-            if (playersWithSuggestions.Count == 0)
-            {
-                await db.Players.ExecuteUpdateAsync(p => p.SetProperty(x => x.CurrentPhase, Phase.Suggest).SetProperty(x => x.VotesFinal, false));
-            }
-            else
-            {
-                await db.Players
-                    .Where(p => playersWithSuggestions.Contains(p.Id))
-                    .ExecuteUpdateAsync(p => p.SetProperty(x => x.CurrentPhase, Phase.Vote).SetProperty(x => x.VotesFinal, false));
-
-                await db.Players
-                    .Where(p => !playersWithSuggestions.Contains(p.Id))
-                    .ExecuteUpdateAsync(p => p.SetProperty(x => x.CurrentPhase, Phase.Suggest).SetProperty(x => x.VotesFinal, false));
-            }
+            await db.Players.ExecuteUpdateAsync(p => p.SetProperty(x => x.CurrentPhase, Phase.Vote).SetProperty(x => x.VotesFinal, false));
        }

        await db.SaveChangesAsync();
@@ -54,32 +39,11 @@ internal sealed class AdminWorkflowService(AppDbContext db)
            .Select(p => new VoteStatusDto(p.Id, p.DisplayName ?? p.Username, p.Username, p.CurrentPhase, p.VotesFinal, p.HasJoker, p.Suggestions.Count, p.Suggestions.Select(s => s.Name).ToList()))
            .ToListAsync();

-        var waiting = voters.Where(v => v.Phase == Phase.Vote && !v.Finalized).Select(v => v.Name).ToList();
+        var waiting = voters.Where(v => !v.Finalized).Select(v => v.Name).ToList();
        var ready = waiting.Count == 0;
        return Results.Ok(new VoteStatusResponse(voters, ready, waiting));
    }

-    public async Task<IResult> SetPlayerPhaseAsync(Guid playerId, Phase phase)
-    {
-        if (phase != Phase.Suggest)
-            return EndpointHelpers.BadRequestError("Players can only be moved back to the Suggest phase.");
-
-        var player = await db.Players.FirstOrDefaultAsync(p => p.Id == playerId);
-        if (player is null)
-            return EndpointHelpers.NotFoundError("Player not found.");
-
-        var current = await EndpointHelpers.GetCurrentPhaseAsync(db, player.Id);
-        if (current != Phase.Vote)
-            return EndpointHelpers.BadRequestError("Player must currently be in the Vote phase to move back.");
-
-        player.CurrentPhase = Phase.Suggest;
-        player.VotesFinal = false;
-        await db.SaveChangesAsync();
-
-        var state = await db.AppState.AsNoTracking().SingleAsync();
-        return Results.Ok(new PhaseTransitionResponse(player.CurrentPhase, state.ResultsOpen));
-    }
-
    public async Task<IResult> GrantJokerAsync(Guid playerId)
    {
        var player = await db.Players.FirstOrDefaultAsync(p => p.Id == playerId);
@@ -97,12 +61,8 @@ internal sealed class AdminWorkflowService(AppDbContext db)
        return Results.Ok(new AdminGrantJokerResponse(player.Id, player.HasJoker));
    }

-    public async Task<IResult> DeletePlayerAsync(Guid playerId, Guid adminPlayerId, string? adminPassword)
+    public async Task<IResult> DeletePlayerAsync(Guid playerId)
    {
-        var passwordCheck = await ValidateAdminPasswordAsync(adminPlayerId, adminPassword);
-        if (!passwordCheck.IsValid)
-            return passwordCheck.Error!;
-
        var player = await db.Players.Include(p => p.Suggestions).FirstOrDefaultAsync(p => p.Id == playerId);
        if (player is null)
            return EndpointHelpers.NotFoundError("Player not found.");
@@ -218,12 +178,8 @@ internal sealed class AdminWorkflowService(AppDbContext db)
        return Results.Ok(new AdminUnlinkSuggestionsResponse(groupIds, await db.Players.CountAsync()));
    }

-    public async Task<IResult> ResetAsync(Guid adminPlayerId, string? adminPassword)
+    public async Task<IResult> ResetAsync()
    {
-        var passwordCheck = await ValidateAdminPasswordAsync(adminPlayerId, adminPassword);
-        if (!passwordCheck.IsValid)
-            return passwordCheck.Error!;
-
        await using var tx = await db.Database.BeginTransactionAsync();

        await db.Votes.ExecuteDeleteAsync();
@@ -239,12 +195,8 @@ internal sealed class AdminWorkflowService(AppDbContext db)
        return Results.Ok(new AdminResetStateResponse(Phase.Suggest, state.ResultsOpen, state.UpdatedAt));
    }

-    public async Task<IResult> FactoryResetAsync(Guid adminPlayerId, string? adminPassword)
+    public async Task<IResult> FactoryResetAsync()
    {
-        var passwordCheck = await ValidateAdminPasswordAsync(adminPlayerId, adminPassword);
-        if (!passwordCheck.IsValid)
-            return passwordCheck.Error!;
-
        await using var tx = await db.Database.BeginTransactionAsync();

        await db.Votes.ExecuteDeleteAsync();
@@ -260,19 +212,4 @@ internal sealed class AdminWorkflowService(AppDbContext db)

        return Results.Ok(new AdminResetStateResponse(Phase.Suggest, fresh.ResultsOpen, fresh.UpdatedAt));
    }
-
-    private async Task<(bool IsValid, IResult? Error)> ValidateAdminPasswordAsync(Guid adminPlayerId, string? adminPassword)
-    {
-        if (string.IsNullOrEmpty(adminPassword))
-            return (false, EndpointHelpers.BadRequestError("Admin password is required."));
-
-        var admin = await db.Players.AsNoTracking().FirstOrDefaultAsync(p => p.Id == adminPlayerId);
-        if (admin is null)
-            return (false, EndpointHelpers.UnauthorizedError());
-
-        if (!PasswordHasher.Verify(adminPassword, admin.PasswordHash, admin.PasswordSalt))
-            return (false, EndpointHelpers.UnauthorizedError("Invalid admin password."));
-
-        return (true, null);
-    }
 }
--- a/Endpoints/StateWorkflowService.cs
+++ b/Endpoints/StateWorkflowService.cs
@@ -72,32 +72,15 @@ internal sealed class StateWorkflowService(AppDbContext db)

    public async Task<IResult> PrevPhaseAsync(Player player)
    {
-        var appState = await db.AppState.SingleAsync();
-        var shouldSave = EndpointHelpers.ReconcilePlayerPhase(player, appState.ResultsOpen);
-
        if (!player.IsAdmin)
-        {
-            if (player.CurrentPhase != Phase.Vote)
-                return EndpointHelpers.BadRequestError("You can only move back from the Vote phase.");
+            return EndpointHelpers.BadRequestError("Only admins can move backward.");

-            if (!player.HasJoker)
-                return EndpointHelpers.BadRequestError("Only admins can move backward.");
-
-            player.CurrentPhase = Phase.Suggest;
-            player.VotesFinal = false;
-            player.HasJoker = false;
-            shouldSave = true;
-            await db.SaveChangesAsync();
-            return Results.Ok(new PhaseTransitionResponse(player.CurrentPhase, appState.ResultsOpen));
-        }
+        var appState = await db.AppState.SingleAsync();
+        _ = EndpointHelpers.ReconcilePlayerPhase(player, appState.ResultsOpen);

        player.CurrentPhase = PrevPhase(player.CurrentPhase);
        player.VotesFinal = false;
-        shouldSave = true;
-
-        if (shouldSave)
-            await db.SaveChangesAsync();
-
+        await db.SaveChangesAsync();
        return Results.Ok(new PhaseTransitionResponse(player.CurrentPhase, appState.ResultsOpen));
    }

--- a/GameList.Tests/AdminTests.cs
+++ b/GameList.Tests/AdminTests.cs
@@ -77,13 +77,7 @@ public class AdminTests
            Score = 8
        });

-        var resp = await admin.SendAsync(new HttpRequestMessage(HttpMethod.Delete, $"/api/admin/players/{await player.GetProfileIdAsync()}")
-        {
-            Content = JsonContent.Create(new
-            {
-                AdminPassword = "Pass123!"
-            })
-        });
+        var resp = await admin.DeleteAsync($"/api/admin/players/{await player.GetProfileIdAsync()}");
        resp.EnsureSuccessStatusCode();

        await factory.WithDbContextAsync(db =>
@@ -195,10 +189,7 @@ public class AdminTests
        await player.RegisterAsync("player");
        await player.CreateSuggestionAsync("Keep");

-        var reset = await admin.PostAsJsonAsync("/api/admin/reset", new
-        {
-            AdminPassword = "Pass123!"
-        });
+        var reset = await admin.PostAsJsonAsync("/api/admin/reset", new { });
        reset.EnsureSuccessStatusCode();

        await factory.WithDbContextAsync(db =>
@@ -218,10 +209,7 @@ public class AdminTests
            }
        });

-        var factoryReset = await admin.PostAsJsonAsync("/api/admin/factory-reset", new
-        {
-            AdminPassword = "Pass123!"
-        });
+        var factoryReset = await admin.PostAsJsonAsync("/api/admin/factory-reset", new { });
        factoryReset.EnsureSuccessStatusCode();

        await factory.WithDbContextAsync(db =>
@@ -241,26 +229,21 @@ public class AdminTests
    }

    [Fact]
-    public async Task Admin_results_closing_moves_only_players_with_suggestions_back_to_vote()
+    public async Task Admin_results_closing_moves_back_to_vote_and_clears_finalize()
    {
        await using var factory = new TestWebApplicationFactory();
        var admin = factory.CreateClientWithCookies();
        await admin.RegisterAsync("admin", admin: true);
        var player = factory.CreateClientWithCookies();
        await player.RegisterAsync("player");
-        var fresh = factory.CreateClientWithCookies();
-        await fresh.RegisterAsync("fresh");
-        await player.CreateSuggestionAsync("Player game");

        var open = await admin.PostAsJsonAsync("/api/admin/results", new { resultsOpen = true });
        open.EnsureSuccessStatusCode();

        await factory.WithDbContextAsync(async db =>
        {
-            var p = await db.Players.SingleAsync(x => x.Username == "player");
-            var freshPlayer = await db.Players.SingleAsync(x => x.Username == "fresh");
+            var p = await db.Players.FirstAsync(x => !x.IsAdmin);
            p.VotesFinal = true;
-            freshPlayer.VotesFinal = true;
            var state = await db.AppState.SingleAsync();
            state.UpdatedAt = DateTimeOffset.UnixEpoch;
            await db.SaveChangesAsync();
@@ -271,12 +254,9 @@ public class AdminTests

        await factory.WithDbContextAsync(async db =>
        {
-            var p = await db.Players.SingleAsync(x => x.Username == "player");
-            var freshPlayer = await db.Players.SingleAsync(x => x.Username == "fresh");
+            var p = await db.Players.FirstAsync(x => !x.IsAdmin);
            Assert.Equal(Phase.Vote, p.CurrentPhase);
            Assert.False(p.VotesFinal);
-            Assert.Equal(Phase.Suggest, freshPlayer.CurrentPhase);
-            Assert.False(freshPlayer.VotesFinal);
            var state = await db.AppState.AsNoTracking().SingleAsync();
            Assert.False(state.ResultsOpen);
            Assert.True(state.UpdatedAt > DateTimeOffset.UnixEpoch);
@@ -445,10 +425,7 @@ public class AdminTests
            await db.SaveChangesAsync();
        });

-        var reset = await admin.PostAsJsonAsync("/api/admin/reset", new
-        {
-            AdminPassword = "Pass123!"
-        });
+        var reset = await admin.PostAsJsonAsync("/api/admin/reset", new { });
        reset.EnsureSuccessStatusCode();

        await factory.WithDbContextAsync(async db =>
@@ -460,10 +437,7 @@ public class AdminTests
            Assert.False(state.ResultsOpen);
        });

-        var factoryReset = await admin.PostAsJsonAsync("/api/admin/factory-reset", new
-        {
-            AdminPassword = "Pass123!"
-        });
+        var factoryReset = await admin.PostAsJsonAsync("/api/admin/factory-reset", new { });
        factoryReset.EnsureSuccessStatusCode();
        await factory.WithDbContextAsync(async db =>
        {
@@ -471,56 +445,4 @@ public class AdminTests
            Assert.False(state.ResultsOpen);
        });
    }
-
-    [Fact]
-    public async Task Admin_destructive_actions_require_valid_admin_password()
-    {
-        await using var factory = new TestWebApplicationFactory();
-        var admin = factory.CreateClientWithCookies();
-        await admin.RegisterAsync("admin", admin: true);
-        var player = factory.CreateClientWithCookies();
-        await player.RegisterAsync("victim");
-
-        var delete = await admin.SendAsync(new HttpRequestMessage(HttpMethod.Delete, $"/api/admin/players/{await player.GetProfileIdAsync()}")
-        {
-            Content = JsonContent.Create(new
-            {
-                AdminPassword = "wrong"
-            })
-        });
-        Assert.Equal(HttpStatusCode.Unauthorized, delete.StatusCode);
-
-        var reset = await admin.PostAsJsonAsync("/api/admin/reset", new
-        {
-            AdminPassword = "wrong"
-        });
-        Assert.Equal(HttpStatusCode.Unauthorized, reset.StatusCode);
-
-        var factoryReset = await admin.PostAsJsonAsync("/api/admin/factory-reset", new
-        {
-            AdminPassword = "wrong"
-        });
-        Assert.Equal(HttpStatusCode.Unauthorized, factoryReset.StatusCode);
-    }
-
-    [Fact]
-    public async Task Admin_can_move_voter_back_to_suggest_via_phase_endpoint()
-    {
-        await using var factory = new TestWebApplicationFactory();
-        var admin = factory.CreateClientWithCookies();
-        await admin.RegisterAsync("admin", admin: true);
-
-        var player = factory.CreateClientWithCookies();
-        await player.RegisterAsync("moveme");
-        await player.AdvanceToVoteAsync("Move seed");
-
-        var move = await admin.PostAsJsonAsync($"/api/admin/players/{await player.GetProfileIdAsync()}/phase", new
-        {
-            Phase = "Suggest"
-        });
-        move.EnsureSuccessStatusCode();
-
-        var me = await player.GetFromJsonAsync<JsonElement>("/api/me");
-        Assert.Equal(nameof(Phase.Suggest), me.GetProperty("currentPhase").GetString());
-    }
 }
--- a/GameList.Tests/StateTests.cs
+++ b/GameList.Tests/StateTests.cs
@@ -224,32 +224,6 @@ public class StateTests
        Assert.Equal(nameof(Phase.Suggest), me.GetProperty("currentPhase").GetString());
    }

-    [Fact]
-    public async Task Phase_prev_with_granted_joker_moves_player_back_once_and_consumes_it()
-    {
-        await using var factory = new TestWebApplicationFactory();
-        var admin = factory.CreateClientWithCookies();
-        await admin.RegisterAsync("admin", admin: true);
-
-        var player = factory.CreateClientWithCookies();
-        await player.RegisterAsync("jokerback");
-        await player.AdvanceToVoteAsync("Joker back seed");
-
-        var grant = await admin.PostAsJsonAsync("/api/admin/joker", new { playerId = await player.GetProfileIdAsync() });
-        grant.EnsureSuccessStatusCode();
-
-        var back = await player.PostAsJsonAsync("/api/me/phase/prev", new { });
-        back.EnsureSuccessStatusCode();
-
-        var meAfterBack = await player.GetFromJsonAsync<JsonElement>("/api/me");
-        Assert.Equal(nameof(Phase.Suggest), meAfterBack.GetProperty("currentPhase").GetString());
-        Assert.False(meAfterBack.GetProperty("hasJoker").GetBoolean());
-
-        await player.PostAsJsonAsync("/api/me/phase/next", new { });
-        var denied = await player.PostAsJsonAsync("/api/me/phase/prev", new { });
-        Assert.Equal(HttpStatusCode.BadRequest, denied.StatusCode);
-    }
-
    [Fact]
    public async Task State_endpoint_requires_auth_and_counts()
    {
--- a/README.md
+++ b/README.md
@@ -25,9 +25,7 @@ Pick'n'Play is a .NET 10 ASP.NET Core Minimal API app with a static HTML/CSS/JS
 - Authentication: username/password with HttpOnly `player` cookie.
 - Admin authorization: authenticated account with `IsAdmin=true`.
 - Gameplay phases: `Suggest`, `Vote`, `Results`.
- Backward movement: admins can move backward; players can move `Vote -> Suggest` only when granted a one-time back pass.
 - Storage: SQLite database under `App_Data/gamelist.db`.
- Sensitive admin actions (`reset`, `factory-reset`, player deletion) require admin password confirmation.

 ## Module Ownership

--- a/SPEC.md
+++ b/SPEC.md
@@ -11,7 +11,6 @@ Help a small Discord group (4–8 players) pick a co-op game via phased flow:
 - Username/password login (cookie auth)
 - Admins flagged via admin key at registration
 - Per-user phase tracking; admins can move themselves backward, everyone can move forward (subject to admin “results open” toggle and Suggest→Vote requiring at least one own suggestion)
- Admins can grant a one-time back pass so a voter can move from Vote back to Suggest once

 ## Suggest Phase
 - Up to **5 suggestions** per player
@@ -24,13 +23,11 @@ Help a small Discord group (4–8 players) pick a co-op game via phased flow:
 - All suggestions visible with authors
 - Score each suggestion 0–10
 - Players see only their own votes; can finalize/unfinalize their ballot
- A player with a granted back pass can move from Vote back to Suggest exactly once (consumed on use)
 - **Linked games**: admins can link duplicates; linked games share a vote group. Moving a slider on one updates all linked siblings.
 - Linking or unlinking games clears votes for the linked group and unfinalizes **all** players so ballots can be reviewed again

 ## Results Phase
 - Visible only after admin enables results; players auto-advance when opened
- When results are closed again, only players with one or more suggestions return to Vote; players without suggestions return to Suggest
 - Leaderboard sorted by average score; shows totals, counts, player’s own vote, and links/media

 ## Non-functional
--- a/TESTS.md
+++ b/TESTS.md
@@ -42,13 +42,13 @@ stateDiagram-v2
 - /api/state returns player-specific phase, votesFinal, hasJoker, counts; unauthorized returns 401.
 - GetPhase auto-upgrades legacy Reveal -> Vote and realigns when resultsOpen toggles (to Results and back to Vote clearing votesFinal).
 - /me/phase/next: moves Suggest->Vote, Vote->Results only when resultsOpen true; clears votesFinal; rejects when results locked.
- /me/phase/prev: admin moves back one step; non-admin can move Vote->Suggest only with granted back pass; move clears votesFinal and consumes pass.
+- /me/phase/prev: admin only; moves back one step, clears votesFinal, rejects for player.
 - Display name is immutable after registration; attempts to change via /api/me/name return 404.

 ### 3) Suggestions
 - GET /mine returns only caller’s suggestions ordered by CreatedAt.
 - POST /: success with valid data; enforces ≤5 per player; trims optional fields; requires display name; rejects bad image URL/ext, unreachable image (mocked), invalid game/youtube URLs, invalid player counts, missing name/too long.
- Back-pass path: admin grants pass in Vote, player can consume it to move Vote->Suggest once; consumable and clears finalized state.
+- Joker path: when phase=Vote and HasJoker=true allows creation, consumes joker, resets VotesFinal for all players.
 - Phase gating: non-admin cannot create/update/delete outside Suggest (except joker create); admin bypasses phase checks for update/delete.
 - PUT /{id}: player can edit own in Suggest; name locked outside Suggest; admin can edit any time; validation mirrors create.
 - DELETE /{id}: player deletes own in Suggest; admin any time; also breaks child links and deletes related votes.
@@ -65,15 +65,14 @@ stateDiagram-v2
 - Phase mismatch and locked results return 400; unauthorized 401.

 ### 6) Admin Operations
- POST /admin/results toggles resultsOpen and aligns all player phases (to Results, or back to Vote only for players with suggestions and Suggest otherwise); updates UpdatedAt.
+- POST /admin/results toggles resultsOpen and aligns all player phases (to Results or back to Vote clearing votesFinal); updates UpdatedAt.
 - GET /admin/vote-status returns list ordered by display/username with suggestion counts, finalized flag, joker flag; ready/waiting derived correctly.
- POST /admin/joker grants one-time back pass only when target in Vote; resets VotesFinal for target.
- POST /admin/players/{id}/phase allows admin to move a player from Vote back to Suggest.
- DELETE /admin/players/{id}: requires admin password; removes player, cascades suggestions, breaks links to their suggestions, deletes related votes, wrapped in transaction.
+- POST /admin/joker grants joker only when target in Vote; resets VotesFinal for target.
+- DELETE /admin/players/{id}: removes player, cascades suggestions, breaks links to their suggestions, deletes related votes, wrapped in transaction.
 - POST /admin/link-suggestions: only in Vote; errors on same ids/already linked/not found; re-parents groups correctly; deletes votes for affected group and unfinalizes affected players.
 - POST /admin/unlink-suggestions: only in Vote; clears parents for group, deletes votes in group, unfinalizes affected players; no-op safe when missing.
- POST /admin/reset: requires admin password; wipes suggestions/votes, resets phases to Suggest, clears votesFinal/hasJoker, closes results, updates timestamp.
- POST /admin/factory-reset: requires admin password; wipes all players/suggestions/votes/state; reseeds AppState with defaults; transactional.
+- POST /admin/reset: wipes suggestions/votes, resets phases to Suggest, clears votesFinal/hasJoker, closes results, updates timestamp.
+- POST /admin/factory-reset: wipes all players/suggestions/votes/state; reseeds AppState with defaults; transactional.

 ### 7) Infrastructure/Helpers
 - PasswordHasher: hash+verify roundtrip, rejects empty password, constant-time compare (FixedTimeEquals usage).
--- a/wwwroot/app.js
+++ b/wwwroot/app.js
@@ -47,7 +47,7 @@ async function refreshWithUiErrorHandling() {

 function scheduleNextRefresh() {
  refreshTimerId = window.setTimeout(async () => {
-    if (!document.hidden && !state.adminStatusMenuOpen) {
+    if (!document.hidden) {
      await refreshWithUiErrorHandling();
    }
    scheduleNextRefresh();
@@ -59,7 +59,7 @@ function startRefreshScheduler() {
  refreshSchedulerStarted = true;

  document.addEventListener("visibilitychange", () => {
-    if (!document.hidden && !state.adminStatusMenuOpen) {
+    if (!document.hidden) {
      refreshWithUiErrorHandling();
    }
  });
--- a/wwwroot/css/admin.css
+++ b/wwwroot/css/admin.css
@@ -30,11 +30,6 @@
    font-size: 12px;
    letter-spacing: 0.3px;
 }
-.admin-status-select {
-    width: 100%;
-    min-width: 140px;
-    padding: 6px 8px;
-}

 .admin-panel {
    position: fixed;
--- a/wwwroot/data/i18n/faq/de.md
+++ b/wwwroot/data/i18n/faq/de.md
@@ -108,7 +108,7 @@ Wenn ein Admin doppelte Spiele verknüpft:
 Mit **„Finalisieren"** werden deine Bewertungen gesperrt. Deaktiviere es, um erneut zu bearbeiten.

 „Finalisieren" ist nur während der Abstimmungsphase verfügbar und wird automatisch zurückgesetzt, wenn:
- - Du mit einem Zurück-Pass zurück in die Vorschlagsphase wechselst
+ - Ein Joker ein neues Spiel hinzufügt
 - Ein Admin Spiele verknüpft oder trennt

 ### Abstimmen nach Änderungen
@@ -119,26 +119,26 @@ Wenn neue Spiele hinzugefügt oder Verknüpfungen geändert werden:

 Überprüfe deine Liste und bewerte erneut, bevor du wieder finalisierst.

-## Zurück-Pass (Einmalige Rückkehr)
+## Joker (Späte Ergänzungen)

-### Was ist ein Zurück-Pass?
+### Was ist ein Joker?

-Ein **Zurück-Pass** ist eine einmalige Berechtigung, mit der du von der **Abstimmungsphase** zurück in die **Vorschlagsphase** wechseln kannst. Ein Admin muss ihn dir während der Abstimmung geben.
+Ein **Joker** ist ein einmaliger zusätzlicher Vorschlags-Slot, der nur während der **Abstimmungsphase** verfügbar ist. Ein Admin muss ihn dir gewähren.

 ### So funktioniert es

-Wenn du einen Zurück-Pass erhältst:
- Erscheint ein **Zurück**-Button in der Abstimmungsphase für dein Konto
- Bei Nutzung wechselst du einmal in die Vorschlagsphase zurück und der Pass wird verbraucht
- Deine Finalisierung wird beim Zurückwechseln aufgehoben
+Wenn du einen Joker erhältst:
+- Erscheint ein Button in der oberen Leiste, mit dem du ein weiteres Spiel hinzufügen kannst
+- Nach der Nutzung wird der Joker sofort verbraucht
+- Die Finalisierung aller Abstimmungen werden automatisch zurückgesetzt, damit das neue Spiel bewertet werden kann

-Admins können bei Bedarf später einen weiteren Pass vergeben.
+Admins können bei Bedarf zusätzliche Joker vergeben.

 ## Ergebnisse

 ### Wann sind die Ergebnisse sichtbar?

-Die Ergebnisse bleiben verborgen, bis ein Admin sie freigibt. Danach werden alle Spieler automatisch in die **Ergebnisphase** verschoben. Falls nötig, kann ein Admin die Ergebnisse wieder schließen: Spieler mit mindestens einem Vorschlag kehren in die Abstimmungsphase zurück, Spieler ohne Vorschlag in die Vorschlagsphase, und Finalisierungen werden zurückgesetzt.
+Die Ergebnisse bleiben verborgen, bis ein Admin sie freigibt. Danach werden alle Spieler automatisch in die **Ergebnisphase** verschoben. Falls nötig, kann ein Admin die Ergebnisse wieder schließen: Alle kehren in die Abstimmungsphase zurück und alle Abstimmungen werden zur Anpassung zurückgesetzt.

 ### Kann ich in der Ergebnisphase etwas bearbeiten?

@@ -148,15 +148,13 @@ Nein. Vorschläge und Bewertungen sind schreibgeschützt. Wende dich bei Bedarf

 ### Was können Admin-Konten tun?

-   Zurück-Pässe während der Abstimmung vergeben
+-   Joker während der Abstimmung vergeben
 -   Doppelte Vorschläge verknüpfen oder trennen
 -   Vorschläge löschen
 -   Abstimmungsstatus einsehen (wer finalisiert hat)
 -   Einen Spieler löschen (inklusive dessen Vorschläge und Stimmen)
-   Spieler über den Status-Dropdown von Abstimmung zurück auf Vorschlag setzen
 -   Die Datenbank auf Werkseinstellungen zurücksetzen
 -   Zu vorherigen Phasen zurückkehren
-   Reset-/Löschaktionen mit dem eigenen Admin-Passwort bestätigen

 ### Was können Admin-Konten nicht tun?

@@ -176,7 +174,7 @@ Stelle sicher:

 ### „Du hast das Limit von 5 Vorschlägen erreicht."

-Bitte einen Admin um einen Zurück-Pass, wenn du wieder in die Vorschlagsphase wechseln und deine Liste anpassen musst.
+Warte auf die Abstimmungsphase und bitte bei Bedarf um einen Joker.

 ### „Füge mindestens einen Vorschlag hinzu, bevor du in die Abstimmungsphase wechselst."

--- a/wwwroot/data/i18n/faq/en.md
+++ b/wwwroot/data/i18n/faq/en.md
@@ -82,20 +82,21 @@ Common reasons:

 Check the bottom-right corner of the screen for error messages.

-## Back Pass (One-Time Return)
+## Jokers (Late Additions)

-### What is a back pass?
+### What is a joker?

-A **back pass** is a one-time permission that lets you move from **Vote** back to **Suggest**. An admin must grant it to you during Vote.
+A **joker** is a one-time extra suggestion slot available only during the **Vote phase**. An admin must grant it to you.

 ### How it works

-If you receive a back pass:
- - A **Back** button appears in Vote for your account.
- - Using it moves you to Suggest once and consumes the pass.
- - Your finalized flag is cleared when you move back.
+If you receive a joker:
+ - A button appears in the top bar allowing you to add one more game.
+ - Once used, the joker is consumed immediately.
+ - Your ballot becomes unfinalized.
+ - All players are unfinalized so the new game can be scored.

-Admins may grant another pass later if needed.
+Admins may grant additional jokers if necessary.

 ## Voting

@@ -125,7 +126,7 @@ If an admin links duplicate games:
 Toggling **"Finalize"** locks your scores. Toggle it off to edit again.

 Finalize is only available during the Vote phase and will automatically reset if:
- - You move back to Suggest with a granted back pass
+ - A joker adds a new game
 - An admin links or unlinks games

 ### Voting after changes
@@ -141,7 +142,7 @@ Review your list and rescore before finalizing again.
 ### When are results visible?

 Results are hidden until an admin opens them. When opened, all players are automatically moved to the **Results phase**.
-If needed, an admin can close the Results: players with at least one suggestion return to Vote, players without suggestions return to Suggest, and finalized ballots are cleared.
+If needed, an admin can close the Results: everyone returns to the Vote phase, and all ballots are unfinalized for adjustments.

 ### Can I edit anything in Results?

@@ -151,15 +152,13 @@ No. Suggestions and votes are read-only. Contact an admin for assistance.

 ### What can admin accounts do?

+-   Grant jokers during Vote
 -   Link or unlink duplicate suggestions
 -   Delete suggestions
 -   View vote readiness (who has finalized)
 -   Delete a player (removes their suggestions and votes)
-   Move players from Vote back to Suggest from the status dropdown
-   Grant one-time back passes
 -   Reset the database to factory defaults
 -   Move backward to previous phases
-   Confirm reset/delete actions with their own admin password

 ### What can't admin accounts do?

@@ -179,7 +178,7 @@ Make sure:

 ### "You have reached the 5 suggestion limit."

-Ask an admin to grant a back pass if you need to return to Suggest and adjust your list.
+Wait for the Vote phase and request a joker if needed.

 ### "Add at least one suggestion before entering the Vote phase."

--- a/wwwroot/data/i18n/translations.json
+++ b/wwwroot/data/i18n/translations.json
@@ -26,7 +26,6 @@
    "counts.format": "Players: {players} • Suggestions: {suggestions} • Votes: {votes}",
    "nav.prev": "Back",
    "nav.next": "Next",
-    "nav.backToSuggestOnce": "Use pass: back to suggest",
    "nav.addSuggestionFirst": "Add a game first",
    "nav.waitingForResults": "Waiting…",
    "nav.freezeTitle": "Ready to reveal?",
@@ -103,16 +102,11 @@
    "vote.listUpdatedConfirm": "OK",
    "admin.title": "Admin",
    "admin.tools": "Admin tools",
-    "admin.resultsOpenButtonEnable": "Allow results phase",
-    "admin.resultsOpenButtonDisable": "Lock results phase",
+    "admin.resultsOpenToggle": "Allow results phase",
    "admin.resultsLocked": "Results locked by admin",
    "admin.resultsUpdated": "Results availability updated",
    "admin.reset": "Reset (keep players)",
    "admin.factoryReset": "Factory reset",
-    "admin.resetConfirmBody": "Enter your admin password to reset all games and votes while keeping player accounts.",
-    "admin.factoryResetConfirmBody": "Enter your admin password to permanently delete all accounts, games, votes, and state.",
-    "admin.passwordLabel": "Admin password",
-    "admin.passwordRequired": "Admin password is required.",
    "admin.resetDone": "Reset complete",
    "admin.factoryResetDone": "Factory reset complete",
    "admin.readyForResults": "Ready for results",
@@ -121,10 +115,9 @@
    "admin.playerUsername": "Username",
    "admin.playerStatus": "Status",
    "admin.playerGames": "Games",
-    "admin.playerJoker": "Back pass",
+    "admin.playerJoker": "Joker",
    "admin.playerDelete": "Delete",
-    "admin.grantJokerChip": "Grant back",
-    "admin.statusUpdated": "Player status updated",
+    "admin.grantJokerChip": "Grant",
    "admin.statusSuggesting": "Suggesting",
    "admin.statusVoting": "Voting",
    "admin.statusFinished": "Finished",
@@ -132,7 +125,7 @@
    "admin.deleteBody": "Delete player \"{name}\" and all their games and votes? This cannot be undone.",
    "admin.deleteConfirm": "Delete",
    "admin.deleteDone": "Player deleted",
-    "admin.jokerGranted": "Back pass granted",
+    "admin.jokerGranted": "Joker granted",
    "admin.linkTitle": "Link games",
    "admin.linkSource": "Game to link",
    "admin.linkTarget": "Link to (parent)",
@@ -193,7 +186,6 @@
    "counts.format": "Spieler: {players} • Vorschläge: {suggestions} • Stimmen: {votes}",
    "nav.prev": "Zurück",
    "nav.next": "Weiter",
-    "nav.backToSuggestOnce": "Pass nutzen: zurück zu Vorschlag",
    "nav.addSuggestionFirst": "Zuerst ein Spiel vorschlagen",
    "nav.waitingForResults": "Warten…",
    "nav.freezeTitle": "Bereit zum Aufdecken?",
@@ -270,16 +262,11 @@
    "vote.listUpdatedConfirm": "OK",
    "admin.title": "Admin",
    "admin.tools": "Admin-Werkzeuge",
-    "admin.resultsOpenButtonEnable": "Ergebnisse freigeben",
-    "admin.resultsOpenButtonDisable": "Ergebnisse sperren",
+    "admin.resultsOpenToggle": "Ergebnisse freigeben",
    "admin.resultsLocked": "Ergebnisse vom Admin gesperrt",
    "admin.resultsUpdated": "Ergebnisfreigabe aktualisiert",
    "admin.reset": "Zurücksetzen (Spieler behalten)",
    "admin.factoryReset": "Werkseinstellung",
-    "admin.resetConfirmBody": "Gib dein Admin-Passwort ein, um alle Spiele und Stimmen zurückzusetzen, aber die Konten zu behalten.",
-    "admin.factoryResetConfirmBody": "Gib dein Admin-Passwort ein, um alle Konten, Spiele, Stimmen und den Zustand dauerhaft zu löschen.",
-    "admin.passwordLabel": "Admin-Passwort",
-    "admin.passwordRequired": "Admin-Passwort ist erforderlich.",
    "admin.resetDone": "Zurücksetzen abgeschlossen",
    "admin.factoryResetDone": "Werkseinstellung abgeschlossen",
    "admin.readyForResults": "Bereit für Ergebnisse",
@@ -288,10 +275,9 @@
    "admin.playerUsername": "Benutzername",
    "admin.playerStatus": "Status",
    "admin.playerGames": "Spiele",
-    "admin.playerJoker": "Zurück-Pass",
+    "admin.playerJoker": "Joker",
    "admin.playerDelete": "Löschen",
-    "admin.grantJokerChip": "Pass geben",
-    "admin.statusUpdated": "Status aktualisiert",
+    "admin.grantJokerChip": "Joker",
    "admin.statusSuggesting": "Vorschlagen",
    "admin.statusVoting": "Bewerten",
    "admin.statusFinished": "Fertig",
@@ -299,7 +285,7 @@
    "admin.deleteBody": "Spieler \"{name}\" samt Spielen und Stimmen löschen? Dies kann nicht rückgängig gemacht werden.",
    "admin.deleteConfirm": "Löschen",
    "admin.deleteDone": "Spieler gelöscht",
-    "admin.jokerGranted": "Zurück-Pass vergeben",
+    "admin.jokerGranted": "Joker vergeben",
    "admin.linkTitle": "Spiele verknüpfen",
    "admin.linkSource": "Spiel verknüpfen",
    "admin.linkTarget": "Verknüpfen mit",
--- a/wwwroot/index.html
+++ b/wwwroot/index.html
@@ -170,7 +170,7 @@
              <th data-i18n="admin.playerUsername">Username</th>
              <th data-i18n="admin.playerStatus">Status</th>
              <th data-i18n="admin.playerGames">Games</th>
-              <th data-i18n="admin.playerJoker">Back pass</th>
+              <th data-i18n="admin.playerJoker">Joker</th>
              <th data-i18n="admin.playerDelete">Delete</th>
            </tr>
          </thead>
@@ -178,7 +178,10 @@
        </table>
      </div>
    </div>
-    <button id="results-open-toggle" class="secondary" type="button" data-i18n="admin.resultsOpenButtonEnable">Allow results phase</button>
+    <label class="stack toggle-row">
+      <input type="checkbox" id="results-open" />
+      <span data-i18n="admin.resultsOpenToggle">Allow results phase</span>
+    </label>
    <div class="stack hidden" id="admin-linker">
      <h4 data-i18n="admin.linkTitle">Link games</h4>
      <label class="stack">
--- a/wwwroot/js/admin-ui.js
+++ b/wwwroot/js/admin-ui.js
@@ -15,27 +15,6 @@ function displayPlayerStatus(player) {
    return phase;
 }

-function renderStatusSelect(player) {
-    const statusText = displayPlayerStatus(player);
-    const safeStatusText = escapeHtml(statusText);
-    const playerId = escapeHtml(player.playerId);
-
-    if (player.phase === "Vote") {
-        return `
-        <select class="admin-status-select" data-player-phase="${playerId}" data-current-phase="Vote">
-          <option value="Vote" selected>${safeStatusText}</option>
-          <option value="Suggest">${escapeHtml(t("admin.statusSuggesting"))}</option>
-        </select>
-      `;
-    }
-
-    return `
-      <select class="admin-status-select" disabled data-player-phase="${playerId}" data-current-phase="${escapeHtml(player.phase)}">
-        <option value="${escapeHtml(player.phase)}" selected>${safeStatusText}</option>
-      </select>
-    `;
-}
-
 export function renderAdminVoteStatus() {
    if (!state.me?.isAdmin) return;
    const statusBadge = $("admin-ready-status");
@@ -45,13 +24,14 @@ export function renderAdminVoteStatus() {
    table.innerHTML = "";
    state.adminVoteStatus.voters.forEach((v) => {
        const tr = document.createElement("tr");
+        const statusText = displayPlayerStatus(v);
        const gamesTooltip = escapeHtml((v.suggestionTitles || []).join(", "));
        const nameText = escapeHtml(truncate(v.name, 28));
        const userText = escapeHtml(truncate(v.username, 24));
        tr.innerHTML = `
        <td title="${escapeHtml(v.name)}">${nameText}</td>
        <td class="muted small" title="${escapeHtml(v.username)}">${userText}</td>
-        <td>${renderStatusSelect(v)}</td>
+        <td>${statusText}</td>
        <td title="${gamesTooltip}">${v.suggestionCount ?? 0}</td>
        <td><button class="chip" data-grant-joker="${v.playerId}" type="button">${v.hasJoker ? "🎟" : t("admin.grantJokerChip")}</button></td>
        <td><button class="chip danger-chip" data-delete-player="${v.playerId}" data-name="${v.name}" type="button">✕</button></td>
--- a/wwwroot/js/api.js
+++ b/wwwroot/js/api.js
@@ -56,11 +56,10 @@ export const api = {
 export const adminApi = {
  setResultsOpen: (resultsOpen) => request("/api/admin/results", { method: "POST", body: { resultsOpen } }),
  voteStatus: () => request("/api/admin/vote-status"),
-  reset: (adminPassword) => request("/api/admin/reset", { method: "POST", body: { adminPassword } }),
-  factoryReset: (adminPassword) => request("/api/admin/factory-reset", { method: "POST", body: { adminPassword } }),
+  reset: () => request("/api/admin/reset", { method: "POST" }),
+  factoryReset: () => request("/api/admin/factory-reset", { method: "POST" }),
  grantJoker: (playerId) => request("/api/admin/joker", { method: "POST", body: { playerId } }),
-  deletePlayer: (playerId, adminPassword) => request(`/api/admin/players/${playerId}`, { method: "DELETE", body: { adminPassword } }),
-  setPlayerPhase: (playerId, phase) => request(`/api/admin/players/${playerId}/phase`, { method: "POST", body: { phase } }),
+  deletePlayer: (playerId) => request(`/api/admin/players/${playerId}`, { method: "DELETE" }),
  linkSuggestions: (sourceSuggestionId, targetSuggestionId) =>
    request("/api/admin/link-suggestions", { method: "POST", body: { sourceSuggestionId, targetSuggestionId } }),
  unlinkSuggestions: (suggestionId) =>
--- a/wwwroot/js/app-admin-handlers.js
+++ b/wwwroot/js/app-admin-handlers.js
@@ -3,7 +3,7 @@ import { t } from "./i18n.js";
 import { state } from "./state.js";
 import { $, toast } from "./dom.js";
 import {
-    openPasswordConfirmModal,
+    openConfirmModal,
    openResultsRelockModal,
    renderPhasePill,
 } from "./ui.js";
@@ -13,10 +13,8 @@ async function adminAction(fn, successMessage, runSerializedRefresh) {
        await fn();
        toast(successMessage);
        await runSerializedRefresh();
-        return true;
    } catch (err) {
        toast(err.message, true);
-        return false;
    }
 }

@@ -34,56 +32,24 @@ function setupAdminPanelToggle() {
 }

 function setupResetButtons(runSerializedRefresh) {
-    const askPasswordThenRun = ({
-        title,
-        body,
-        confirmLabel,
-        action,
-        done,
-    }) => {
-        openPasswordConfirmModal({
-            title,
-            body,
-            confirmLabel,
-            onConfirm: async (password, close) => {
-                const success = await adminAction(
-                    () => action(password),
-                    done,
-                    runSerializedRefresh,
-                );
-                if (success) close();
-            },
-        });
-    };
-
    $("reset").addEventListener("click", () =>
-        askPasswordThenRun({
-            title: t("admin.reset"),
-            body: t("admin.resetConfirmBody"),
-            confirmLabel: t("admin.reset"),
-            action: (password) => adminApi.reset(password),
-            done: t("admin.resetDone"),
-        }),
+        adminAction(adminApi.reset, t("admin.resetDone"), runSerializedRefresh),
    );
-
    $("factory-reset").addEventListener("click", () =>
-        askPasswordThenRun({
-            title: t("admin.factoryReset"),
-            body: t("admin.factoryResetConfirmBody"),
-            confirmLabel: t("admin.factoryReset"),
-            action: (password) => adminApi.factoryReset(password),
-            done: t("admin.factoryResetDone"),
-        }),
+        adminAction(
+            adminApi.factoryReset,
+            t("admin.factoryResetDone"),
+            runSerializedRefresh,
+        ),
    );
 }

 function setupResultsToggle(runSerializedRefresh) {
-    const resultsToggle = $("results-open-toggle");
+    const resultsToggle = $("results-open");
    if (!resultsToggle) return;

-    resultsToggle.addEventListener("click", async () => {
-        const desired = !state.resultsOpen;
-        resultsToggle.disabled = true;
+    resultsToggle.addEventListener("change", async (e) => {
+        const desired = !!e.target.checked;
        try {
            const resp = await adminApi.setResultsOpen(desired);
            const wasResultsOpen = state.resultsOpen;
@@ -96,9 +62,8 @@ function setupResultsToggle(runSerializedRefresh) {
            toast(t("admin.resultsUpdated"));
            await runSerializedRefresh();
        } catch (err) {
+            e.target.checked = !desired;
            toast(err.message, true);
-        } finally {
-            resultsToggle.disabled = false;
        }
    });
 }
@@ -127,45 +92,6 @@ function setupPlayerTableActions(runSerializedRefresh) {
    const playerTable = $("admin-player-table");
    if (!playerTable) return;

-    const syncSelectFocusState = () => {
-        state.adminStatusMenuOpen = !!playerTable.querySelector(
-            ".admin-status-select:focus",
-        );
-    };
-
-    playerTable.addEventListener("focusin", (e) => {
-        if (e.target.closest(".admin-status-select")) {
-            state.adminStatusMenuOpen = true;
-        }
-    });
-
-    playerTable.addEventListener("focusout", () => {
-        window.setTimeout(syncSelectFocusState, 0);
-    });
-
-    playerTable.addEventListener("change", async (e) => {
-        const statusSelect = e.target.closest(".admin-status-select");
-        if (!statusSelect || statusSelect.disabled) return;
-
-        const playerId = statusSelect.dataset.playerPhase;
-        const currentPhase = statusSelect.dataset.currentPhase;
-        const desiredPhase = statusSelect.value;
-        if (!playerId || !desiredPhase || desiredPhase === currentPhase) return;
-
-        statusSelect.disabled = true;
-        try {
-            await adminApi.setPlayerPhase(playerId, desiredPhase);
-            toast(t("admin.statusUpdated"));
-            await runSerializedRefresh();
-        } catch (err) {
-            statusSelect.value = currentPhase ?? statusSelect.value;
-            toast(err.message, true);
-        } finally {
-            statusSelect.disabled = false;
-            state.adminStatusMenuOpen = false;
-        }
-    });
-
    playerTable.addEventListener("click", async (e) => {
        const grantBtn = e.target.closest("[data-grant-joker]");
        const deleteBtn = e.target.closest("[data-delete-player]");
@@ -181,13 +107,13 @@ function setupPlayerTableActions(runSerializedRefresh) {
        } else if (deleteBtn) {
            const playerId = deleteBtn.dataset.deletePlayer;
            const name = deleteBtn.dataset.name || "";
-            openPasswordConfirmModal({
+            openConfirmModal({
                title: t("admin.deleteTitle"),
                body: t("admin.deleteBody", { name }),
                confirmLabel: t("admin.deleteConfirm"),
-                onConfirm: async (password, close) => {
+                onConfirm: async (close) => {
                    try {
-                        await adminApi.deletePlayer(playerId, password);
+                        await adminApi.deletePlayer(playerId);
                        toast(t("admin.deleteDone"));
                        close();
                        await runSerializedRefresh();
--- a/wwwroot/js/app-auth-handlers.js
+++ b/wwwroot/js/app-auth-handlers.js
@@ -1,11 +1,6 @@
 import { api } from "./api.js";
 import { t } from "./i18n.js";
-import {
-    state,
-    clearUserState,
-    clearSavedUsername,
-    setSavedUsername,
-} from "./state.js";
+import { state, clearUserState, setSavedUsername } from "./state.js";
 import { $, toast } from "./dom.js";
 import {
    handleAuthError,
@@ -144,38 +139,24 @@ function setupLogoutHandler() {
    const logoutBtn = $("logout");
    if (!logoutBtn) return;

-    const clearAuthFormFields = () => {
-        [
-            "login-username",
-            "login-password",
-            "register-username",
-            "register-password",
-            "register-displayName",
-            "register-adminkey",
-        ].forEach((id) => {
-            const input = $(id);
-            if (input) input.value = "";
-        });
-
-        ["login-consent", "register-consent"].forEach((id) => {
-            const box = $(id);
-            if (box) box.checked = false;
-        });
-    };
-
    logoutBtn.addEventListener("click", async (e) => {
        e.preventDefault();
+        const lastUser = state.me?.username;
        try {
            await api.logout();
        } catch (err) {
            toast(err.message, true);
        }
        clearUserState();
-        clearSavedUsername();
        state.isAuthenticated = false;
-        setAuthMode("login");
        setAuthUI(false);
-        clearAuthFormFields();
+        if (lastUser) {
+            setSavedUsername(lastUser);
+            const loginUser = $("login-username");
+            if (loginUser) loginUser.value = lastUser;
+            const loginPass = $("login-password");
+            if (loginPass) loginPass.value = "";
+        }
    });
 }

--- a/wwwroot/js/data.js
+++ b/wwwroot/js/data.js
@@ -34,15 +34,7 @@ export async function loadSuggestionsData() {
        const latest = await api.allSuggestions();
        const latestSig = signatureSuggestions(latest);
        const changed = latestSig !== state.allSuggestionsSig;
-        const canCompareWithDisplayedVoteList =
-            state.phase === "Vote" &&
-            state.votesRendered &&
-            !!state.displayedVoteSuggestionsSig;
-        if (
-            changed &&
-            canCompareWithDisplayedVoteList &&
-            latestSig !== state.displayedVoteSuggestionsSig
-        ) {
+        if (changed && state.phase === "Vote" && state.allSuggestionsSig) {
            const added = latest
                .filter((s) => !prevById[s.id])
                .map((s) => s.name);
--- a/wwwroot/js/modals-ui.js
+++ b/wwwroot/js/modals-ui.js
@@ -80,84 +80,6 @@ export function openConfirmModal({
    document.body.appendChild(overlay);
 }

-export function openPasswordConfirmModal({
-    title,
-    body,
-    confirmLabel,
-    cancelLabel = t("modal.cancel"),
-    onConfirm,
-}) {
-    const overlay = document.createElement("div");
-    overlay.className = "edit-modal";
-    const panel = document.createElement("div");
-    panel.className = "edit-panel";
-    panel.innerHTML = `
-      <div class="edit-header">
-        <h3>${title}</h3>
-        <button class="lightbox-close" aria-label="${t("modal.close")}">x</button>
-      </div>
-      <div class="edit-body">
-        <p>${body}</p>
-      </div>
-    `;
-
-    const close = () => overlay.remove();
-    const bodyWrap = panel.querySelector(".edit-body");
-    const fieldWrap = document.createElement("label");
-    fieldWrap.className = "stack";
-    fieldWrap.innerHTML = `
-      <span class="label">${t("admin.passwordLabel")}</span>
-      <input type="password" autocomplete="current-password" />
-    `;
-    bodyWrap?.appendChild(fieldWrap);
-    const passwordInput = fieldWrap.querySelector("input");
-
-    const actions = document.createElement("div");
-    actions.className = "stack horizontal";
-    const confirmBtn = document.createElement("button");
-    confirmBtn.className = "danger";
-    confirmBtn.textContent = confirmLabel ?? t("modal.confirm");
-    actions.append(confirmBtn);
-
-    if (cancelLabel !== null && cancelLabel !== undefined) {
-        const cancelBtn = document.createElement("button");
-        cancelBtn.className = "ghost";
-        cancelBtn.type = "button";
-        cancelBtn.textContent = cancelLabel;
-        actions.append(cancelBtn);
-        cancelBtn.addEventListener("click", close);
-    }
-    bodyWrap?.appendChild(actions);
-
-    overlay.addEventListener("click", (e) => {
-        if (
-            e.target.classList.contains("edit-modal") ||
-            e.target.classList.contains("lightbox-close")
-        ) {
-            close();
-        }
-    });
-
-    confirmBtn.addEventListener("click", async () => {
-        const password = passwordInput?.value ?? "";
-        if (!password.trim()) {
-            toast(t("admin.passwordRequired"), true);
-            passwordInput?.focus();
-            return;
-        }
-
-        try {
-            await onConfirm?.(password, close);
-        } catch (err) {
-            toast(err.message, true);
-        }
-    });
-
-    overlay.appendChild(panel);
-    document.body.appendChild(overlay);
-    passwordInput?.focus();
-}
-
 export function openResultsRelockModal() {
    openConfirmModal({
        title: t("results.relockedTitle"),
--- a/wwwroot/js/state.js
+++ b/wwwroot/js/state.js
@@ -11,12 +11,10 @@ export const state = {
    mySuggestions: [],
    allSuggestions: [],
    allSuggestionsSig: null,
-    displayedVoteSuggestionsSig: null,
    myVotes: [],
    results: [],
    votesRendered: false,
    adminVoteStatus: null,
-    adminStatusMenuOpen: false,
 };

 export function clearUserState() {
@@ -29,13 +27,9 @@ export function clearUserState() {
    state.counts = null;
    state.mySuggestions = [];
    state.allSuggestions = [];
-    state.allSuggestionsSig = null;
-    state.displayedVoteSuggestionsSig = null;
    state.myVotes = [];
    state.results = [];
    state.votesRendered = false;
-    state.adminVoteStatus = null;
-    state.adminStatusMenuOpen = false;
    const adminCard = document.getElementById("admin-card");
    if (adminCard) adminCard.classList.add("hidden");
 }
@@ -44,5 +38,3 @@ export const getSavedUsername = () =>
    localStorage.getItem("last_username") || "";
 export const setSavedUsername = (name) =>
    localStorage.setItem("last_username", name);
-export const clearSavedUsername = () =>
-    localStorage.removeItem("last_username");
--- a/wwwroot/js/ui.js
+++ b/wwwroot/js/ui.js
@@ -27,7 +27,6 @@ import { renderResults } from "./results-ui.js";
 import {
    openConfirmModal,
    openLightbox,
-    openPasswordConfirmModal,
    openResultsRelockModal,
    openSuggestionsChangedModal,
 } from "./modals-ui.js";
@@ -65,7 +64,6 @@ export {
    openConfirmModal,
    openLightbox,
    openNewSuggestionModal,
-    openPasswordConfirmModal,
    openResultsRelockModal,
    openSuggestionsChangedModal,
    renderAllSuggestions,
--- a/wwwroot/js/votes-ui.js
+++ b/wwwroot/js/votes-ui.js
@@ -42,7 +42,6 @@ export function renderVotes() {
        li.querySelector(".card-body").appendChild(footer);
        list.appendChild(li);
    });
-    state.displayedVoteSuggestionsSig = state.allSuggestionsSig;
    updatePhaseNav();
    updateMissingBadgeFromDom();
    list.scrollTop = prevScroll;
@@ -203,11 +202,9 @@ export function updatePhaseNav() {

    showNav("nav-suggest", phase === "Suggest");
    showNav("nav-vote", phase === "Vote");
-    const playerCanMoveBackToSuggest =
-        !isAdmin && phase === "Vote" && state.hasJoker;
    const jokerBtn = $("open-joker-modal");
    if (jokerBtn) {
-        const showJoker = false;
+        const showJoker = phase === "Vote" && state.hasJoker;
        jokerBtn.classList.toggle("hidden", !showJoker);
        jokerBtn.disabled = !showJoker;
    }
@@ -245,14 +242,11 @@ export function updatePhaseNav() {
    renderAdminLinker();
    updateMissingBadgeFromDom();

-    const votePrev = $("nav-vote-prev");
-    if (votePrev) {
-        const canUseBack = isAdmin || playerCanMoveBackToSuggest;
-        votePrev.classList.toggle("hidden", !canUseBack);
-        votePrev.textContent = playerCanMoveBackToSuggest
-            ? t("nav.backToSuggestOnce")
-            : t("nav.prev");
-    }
+    const backButtons = ["nav-vote-prev"];
+    backButtons.forEach((id) => {
+        const btn = $(id);
+        if (btn) btn.classList.toggle("hidden", !isAdmin);
+    });

    const suggestNext = $("nav-suggest-next");
    if (suggestNext) {
@@ -274,10 +268,8 @@ export function updatePhaseNav() {
            : t("nav.next");
    }

-    const adminResultsToggle = $("results-open-toggle");
+    const adminResultsToggle = $("results-open");
    if (adminResultsToggle) {
-        adminResultsToggle.textContent = state.resultsOpen
-            ? t("admin.resultsOpenButtonDisable")
-            : t("admin.resultsOpenButtonEnable");
+        adminResultsToggle.checked = !!state.resultsOpen;
    }
 }