Release 202505261445

2025-05-26 14:45:22 +00:00
parent f2021a3027
commit ba809840c6
19 changed files with 910 additions and 486 deletions
--- a/web/src/actions/admin/service.ts
+++ b/web/src/actions/admin/service.ts
@@ -31,10 +31,16 @@ const serviceSchemaBase = z.object({
  verificationSummary: z.string().optional().nullable().default(null),
  verificationProofMd: z.string().optional().nullable().default(null),
  acceptedCurrencies: z.array(z.nativeEnum(Currency)),
-  referral: z.string().optional().nullable().default(null),
+  referral: z
+    .string()
+    .regex(/^(\?\w+=.|\/.+)/, 'Referral must be a valid URL parameter or path, not a full URL')
+    .optional()
+    .nullable()
+    .default(null),
  imageFile: imageFileSchema,
  overallScore: zodCohercedNumber(z.number().int().min(0).max(10)).optional(),
  serviceVisibility: z.nativeEnum(ServiceVisibility),
+  internalNote: z.string().optional(),
 })

 const addSlugIfMissing = <
@@ -61,7 +67,7 @@ export const adminServiceActions = {
    accept: 'form',
    permissions: 'admin',
    input: serviceSchemaBase.omit({ id: true }).transform(addSlugIfMissing),
-    handler: async (input) => {
+    handler: async (input, context) => {
      const existing = await prisma.service.findUnique({
        where: {
          slug: input.slug,
@@ -75,12 +81,26 @@ export const adminServiceActions = {
        })
      }

-      const { imageFile, ...serviceData } = input
-      const imageUrl = imageFile ? await saveFileLocally(imageFile, imageFile.name) : undefined
+      const imageUrl = input.imageFile
+        ? await saveFileLocally(input.imageFile, input.imageFile.name)
+        : undefined

      const service = await prisma.service.create({
        data: {
-          ...serviceData,
+          name: input.name,
+          description: input.description,
+          serviceUrls: input.serviceUrls,
+          tosUrls: input.tosUrls,
+          onionUrls: input.onionUrls,
+          kycLevel: input.kycLevel,
+          verificationStatus: input.verificationStatus,
+          verificationSummary: input.verificationSummary,
+          verificationProofMd: input.verificationProofMd,
+          acceptedCurrencies: input.acceptedCurrencies,
+          referral: input.referral,
+          serviceVisibility: input.serviceVisibility,
+          slug: input.slug,
+          overallScore: input.overallScore,
          categories: {
            connect: input.categories.map((id) => ({ id })),
          },
@@ -92,6 +112,14 @@ export const adminServiceActions = {
            })),
          },
          imageUrl,
+          internalNotes: input.internalNote
+            ? {
+                create: {
+                  content: input.internalNote,
+                  addedByUserId: context.locals.user.id,
+                },
+              }
+            : undefined,
        },
        select: {
          id: true,
@@ -112,31 +140,28 @@ export const adminServiceActions = {
      })
      .transform(addSlugIfMissing),
    handler: async (input) => {
-      const { id, categories, attributes, imageFile, removeImage, ...data } = input
-
-      const existing = await prisma.service.findUnique({
+      const anotherServiceWithNewSlug = await prisma.service.findUnique({
        where: {
          slug: input.slug,
-          NOT: { id },
+          NOT: { id: input.id },
        },
      })

-      if (existing) {
+      if (anotherServiceWithNewSlug) {
        throw new ActionError({
          code: 'CONFLICT',
          message: 'A service with this slug already exists',
        })
      }

-      const imageUrl = removeImage
+      const imageUrl = input.removeImage
        ? null
-        : imageFile
-          ? await saveFileLocally(imageFile, imageFile.name)
+        : input.imageFile
+          ? await saveFileLocally(input.imageFile, input.imageFile.name)
          : undefined

-      // Get existing attributes and categories to compute differences
      const existingService = await prisma.service.findUnique({
-        where: { id },
+        where: { id: input.id },
        include: {
          categories: true,
          attributes: {
@@ -154,96 +179,191 @@ export const adminServiceActions = {
        })
      }

-      // Find categories to connect and disconnect
      const existingCategoryIds = existingService.categories.map((c) => c.id)
-      const categoriesToAdd = categories.filter((cId) => !existingCategoryIds.includes(cId))
-      const categoriesToRemove = existingCategoryIds.filter((cId) => !categories.includes(cId))
+      const categoriesToAdd = input.categories.filter((cId) => !existingCategoryIds.includes(cId))
+      const categoriesToRemove = existingCategoryIds.filter((cId) => !input.categories.includes(cId))

-      // Find attributes to connect and disconnect
      const existingAttributeIds = existingService.attributes.map((a) => a.attributeId)
-      const attributesToAdd = attributes.filter((aId) => !existingAttributeIds.includes(aId))
-      const attributesToRemove = existingAttributeIds.filter((aId) => !attributes.includes(aId))
+      const attributesToAdd = input.attributes.filter((aId) => !existingAttributeIds.includes(aId))
+      const attributesToRemove = existingAttributeIds.filter((aId) => !input.attributes.includes(aId))

      const service = await prisma.service.update({
-        where: { id },
+        where: { id: input.id },
        data: {
-          ...data,
+          name: input.name,
+          description: input.description,
+          serviceUrls: input.serviceUrls,
+          tosUrls: input.tosUrls,
+          onionUrls: input.onionUrls,
+          kycLevel: input.kycLevel,
+          verificationStatus: input.verificationStatus,
+          verificationSummary: input.verificationSummary,
+          verificationProofMd: input.verificationProofMd,
+          acceptedCurrencies: input.acceptedCurrencies,
+          referral: input.referral,
+          serviceVisibility: input.serviceVisibility,
+          slug: input.slug,
+          overallScore: input.overallScore,
+
          imageUrl,
          categories: {
            connect: categoriesToAdd.map((id) => ({ id })),
            disconnect: categoriesToRemove.map((id) => ({ id })),
          },
          attributes: {
-            // Connect new attributes
            create: attributesToAdd.map((attributeId) => ({
              attribute: {
                connect: { id: attributeId },
              },
            })),
-            // Delete specific attributes that are no longer needed
+
            deleteMany: attributesToRemove.map((attributeId) => ({
              attributeId,
            })),
          },
        },
      })
+
      return { service }
    },
  }),

-  createContactMethod: defineProtectedAction({
-    accept: 'form',
-    permissions: 'admin',
-    input: z.object({
-      label: z.string().min(1).max(50).nullable(),
-      value: z.string().url(),
-      serviceId: z.number().int().positive(),
+  contactMethod: {
+    add: defineProtectedAction({
+      accept: 'form',
+      permissions: 'admin',
+      input: z.object({
+        label: z.string().min(1).max(50).nullable(),
+        value: z.string().url(),
+        serviceId: z.number().int().positive(),
+      }),
+      handler: async (input) => {
+        const contactMethod = await prisma.serviceContactMethod.create({
+          data: {
+            label: input.label,
+            value: input.value,
+            serviceId: input.serviceId,
+          },
+        })
+        return { contactMethod }
+      },
    }),
-    handler: async (input) => {
-      const contactMethod = await prisma.serviceContactMethod.create({
-        data: {
-          label: input.label,
-          value: input.value,
-          serviceId: input.serviceId,
-        },
-      })
-      return { contactMethod }
-    },
-  }),

-  updateContactMethod: defineProtectedAction({
-    accept: 'form',
-    permissions: 'admin',
-    input: z.object({
-      id: z.number().int().positive(),
-      label: z.string().min(1).max(50).nullable(),
-      value: z.string().url(),
-      serviceId: z.number().int().positive(),
+    update: defineProtectedAction({
+      accept: 'form',
+      permissions: 'admin',
+      input: z.object({
+        id: z.number().int().positive(),
+        label: z.string().min(1).max(50).nullable(),
+        value: z.string().url(),
+        serviceId: z.number().int().positive(),
+      }),
+      handler: async (input) => {
+        const contactMethod = await prisma.serviceContactMethod.update({
+          where: { id: input.id },
+          data: {
+            label: input.label,
+            value: input.value,
+            serviceId: input.serviceId,
+          },
+        })
+        return { contactMethod }
+      },
    }),
-    handler: async (input) => {
-      const contactMethod = await prisma.serviceContactMethod.update({
-        where: { id: input.id },
-        data: {
-          label: input.label,
-          value: input.value,
-          serviceId: input.serviceId,
-        },
-      })
-      return { contactMethod }
-    },
-  }),

-  deleteContactMethod: defineProtectedAction({
-    accept: 'form',
-    permissions: 'admin',
-    input: z.object({
-      id: z.number().int().positive(),
+    delete: defineProtectedAction({
+      accept: 'form',
+      permissions: 'admin',
+      input: z.object({
+        id: z.number().int().positive(),
+      }),
+      handler: async (input) => {
+        await prisma.serviceContactMethod.delete({
+          where: { id: input.id },
+        })
+        return { success: true }
+      },
    }),
-    handler: async (input) => {
-      await prisma.serviceContactMethod.delete({
-        where: { id: input.id },
-      })
-      return { success: true }
-    },
-  }),
+  },
+
+  internalNote: {
+    add: defineProtectedAction({
+      accept: 'form',
+      permissions: 'admin',
+      input: z.object({
+        serviceId: z.number().int().positive(),
+        content: z.string().min(1),
+      }),
+      handler: async (input, { locals }) => {
+        const service = await prisma.service.findUnique({
+          where: { id: input.serviceId },
+        })
+
+        if (!service) {
+          throw new ActionError({
+            code: 'NOT_FOUND',
+            message: 'Service not found',
+          })
+        }
+
+        await prisma.internalServiceNote.create({
+          data: {
+            content: input.content,
+            serviceId: input.serviceId,
+            addedByUserId: locals.user.id,
+          },
+        })
+      },
+    }),
+
+    update: defineProtectedAction({
+      accept: 'form',
+      permissions: 'admin',
+      input: z.object({
+        noteId: z.number().int().positive(),
+        content: z.string().min(1),
+      }),
+      handler: async (input) => {
+        const note = await prisma.internalServiceNote.findUnique({
+          where: { id: input.noteId },
+        })
+
+        if (!note) {
+          throw new ActionError({
+            code: 'NOT_FOUND',
+            message: 'Note not found',
+          })
+        }
+
+        await prisma.internalServiceNote.update({
+          where: { id: input.noteId },
+          data: { content: input.content },
+        })
+      },
+    }),
+
+    delete: defineProtectedAction({
+      accept: 'form',
+      permissions: 'admin',
+      input: z.object({
+        noteId: z.number().int().positive(),
+      }),
+      handler: async (input) => {
+        const note = await prisma.internalServiceNote.findUnique({
+          where: { id: input.noteId },
+        })
+
+        if (!note) {
+          throw new ActionError({
+            code: 'NOT_FOUND',
+            message: 'Note not found',
+          })
+        }
+
+        await prisma.internalServiceNote.delete({
+          where: { id: input.noteId },
+        })
+      },
+    }),
+  },
 }
--- a/web/src/components/InputCardGroup.astro
+++ b/web/src/components/InputCardGroup.astro
@@ -70,7 +70,7 @@ const hasError = !!wrapperProps.error && wrapperProps.error.length > 0
          )}
        >
          <input
-            transition:persist={option.noTransitionPersist ? undefined : true}
+            transition:persist={option.noTransitionPersist || !multiple ? undefined : true}
            type={multiple ? 'checkbox' : 'radio'}
            name={wrapperProps.name}
            value={option.value}
--- a/web/src/icons/nostr.svg
+++ b/web/src/icons/nostr.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" fill="currentColor" viewBox="0 0 620 620">
+  <path
+    d="M620 270v328c0 12-10 22-22 22H332c-12 0-22-10-22-22v-61c1-75 9-147 26-179 9-20 26-30 44-36 36-11 98-4 124-5 0 0 80 3 80-42 0-37-36-34-36-34-39 1-69-1-88-9-33-13-34-36-34-44-1-91-134-102-252-79-128 24 2 209 2 456v33c0 12-10 22-22 22H22c-12 0-22-10-22-22V31C0 19 10 9 22 9h124c12 0 22 10 22 22 0 19 20 29 35 18C248 17 305 0 369 0c143 0 251 84 251 270Zm-238-66c0-27-21-48-47-48s-47 21-47 48c0 26 21 48 47 48s47-22 47-48Z" />
+</svg>
--- a/web/src/lib/userSecretToken.ts
+++ b/web/src/lib/userSecretToken.ts
@@ -50,7 +50,7 @@ const USER_SECRET_TOKEN_DEV_USERS_REGEX = (() => {
  }[]

  const env =
-    // This file can also be called from faker.ts, where import.meta.env is not available
+    // This file can also be called from seed.ts, where import.meta.env is not available
    // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
    (import.meta.env
      ? Object.fromEntries(specialUsersData.map(({ envToken }) => [envToken, import.meta.env[envToken]]))
--- a/web/src/lib/zodUtils.ts
+++ b/web/src/lib/zodUtils.ts
@@ -16,8 +16,8 @@ export const zodCohercedNumber = (zodPipe?: ZodTypeAny) =>
 export const zodUrlOptionalProtocol = z.preprocess(
  (input) => {
    if (typeof input !== 'string') return input
-    const trimmedVal = input.trim()
-    return !/^\w+:\/\//i.test(trimmedVal) ? `https://${trimmedVal}` : trimmedVal
+    const cleanInput = input.trim().replace(/\/$/, '')
+    return !/^\w+:\/\//i.test(cleanInput) ? `https://${cleanInput}` : cleanInput
  },
  z.string().refine((value) => /^(https?):\/\/(?=.*\.[a-z]{2,})[^\s$.?#].[^\s]*$/i.test(value), {
    message: 'Invalid URL',
--- a/web/src/pages/admin/services/[slug]/edit.astro
+++ b/web/src/pages/admin/services/[slug]/edit.astro
@@ -1,5 +1,6 @@
 ---
 import { Icon } from 'astro-icon/components'
+import { Markdown } from 'astro-remote'
 import { actions, isInputError } from 'astro:actions'
 import { orderBy } from 'lodash-es'

@@ -76,6 +77,15 @@ const verificationStepUpdateInputErrors = isInputError(verificationStepUpdateRes
 const verificationStepDeleteResult = Astro.getActionResult(actions.admin.verificationStep.delete)
 Astro.locals.banners.addIfSuccess(verificationStepDeleteResult, 'Verification step deleted successfully')

+const internalNoteCreateResult = Astro.getActionResult(actions.admin.service.internalNote.add)
+Astro.locals.banners.addIfSuccess(internalNoteCreateResult, 'Internal note added successfully')
+const internalNoteInputErrors = isInputError(internalNoteCreateResult?.error)
+  ? internalNoteCreateResult.error.fields
+  : {}
+
+const internalNoteDeleteResult = Astro.getActionResult(actions.admin.service.internalNote.delete)
+Astro.locals.banners.addIfSuccess(internalNoteDeleteResult, 'Internal note deleted successfully')
+
 const [service, categories, attributes] = await Astro.locals.banners.tryMany([
  [
    'Error fetching service',
@@ -130,6 +140,20 @@ const [service, categories, attributes] = await Astro.locals.banners.tryMany([
              label: 'asc',
            },
          },
+          internalNotes: {
+            include: {
+              addedByUser: {
+                select: {
+                  name: true,
+                  displayName: true,
+                  picture: true,
+                },
+              },
+            },
+            orderBy: {
+              createdAt: 'desc',
+            },
+          },
          _count: {
            select: {
              verificationRequests: true,
@@ -290,13 +314,14 @@ if (!service) return Astro.rewrite('/404')
        </div>

        <InputText
-          label="Referral Code/Link"
+          label="Referral link path"
          name="referral"
          inputProps={{
-            value: service.referral ?? undefined,
-            placeholder: 'e.g., REFCODE123 or https://example.com?ref=123',
+            value: service.referral,
+            placeholder: 'e.g. ?ref=123 or /ref/123',
          }}
          error={serviceInputErrors.referral}
+          description="Will be appended to the service URL"
        />

        <div class="flex items-center justify-between gap-2">
@@ -448,6 +473,108 @@ if (!service) return Astro.rewrite('/404')
      </form>
    </FormSection>

+    <FormSection title="Internal Notes" id="internal-notes">
+      <FormSubSection title="Existing Notes">
+        {
+          service.internalNotes.length === 0 ? (
+            <p class="border-night-600 bg-night-800 text-day-300 rounded-xl border p-6 text-center">
+              No internal notes yet.
+            </p>
+          ) : (
+            <div class="space-y-4">
+              {service.internalNotes.map((note) => (
+                <div class="border-night-600 bg-night-800 rounded-md border p-4">
+                  <input
+                    type="checkbox"
+                    class="peer/edit-note sr-only"
+                    data-edit-note-checkbox
+                    id={`edit-note-${note.id}`}
+                  />
+
+                  <div class="flex items-start justify-between">
+                    <div class="flex-grow space-y-1">
+                      <div
+                        data-note-content
+                        class="prose text-day-200 prose-sm prose-invert max-w-none text-pretty"
+                      >
+                        <Markdown content={note.content} />
+                      </div>
+                      <div class="text-day-500 flex items-center gap-2 text-xs">
+                        <TimeFormatted date={note.createdAt} hourPrecision />
+                        {note.addedByUser && (
+                          <span class="flex items-center gap-1">
+                            by <UserBadge user={note.addedByUser} size="sm" />
+                          </span>
+                        )}
+                      </div>
+                    </div>
+
+                    <div class="flex items-center gap-1">
+                      <Button
+                        as="label"
+                        for={`edit-note-${note.id}`}
+                        variant="faded"
+                        size="sm"
+                        icon="ri:edit-line"
+                        iconOnly
+                        label="Edit"
+                      />
+
+                      <form method="POST" action={actions.admin.service.internalNote.delete} class="contents">
+                        <input type="hidden" name="noteId" value={note.id} />
+                        <Button
+                          type="submit"
+                          size="sm"
+                          variant="faded"
+                          icon="ri:delete-bin-line"
+                          iconOnly
+                          label="Delete"
+                        />
+                      </form>
+                    </div>
+                  </div>
+
+                  <form
+                    method="POST"
+                    action={actions.admin.service.internalNote.update}
+                    data-note-edit-form
+                    data-astro-reload
+                    class="mt-4 hidden space-y-4 peer-checked/edit-note:block"
+                  >
+                    <input type="hidden" name="noteId" value={note.id} />
+                    <InputTextArea
+                      label="Note Content"
+                      name="content"
+                      value={note.content}
+                      inputProps={{ class: 'bg-night-700' }}
+                    />
+                    <InputSubmitButton label="Save" icon="ri:save-line" hideCancel />
+                  </form>
+                </div>
+              ))}
+            </div>
+          )
+        }
+      </FormSubSection>
+
+      <FormSubSection title="Add New Note">
+        <form method="POST" action={actions.admin.service.internalNote.add} class="space-y-4">
+          <input type="hidden" name="serviceId" value={service.id} />
+          <InputTextArea
+            label="Note Content"
+            name="content"
+            inputProps={{
+              required: true,
+              rows: 4,
+              placeholder: 'Add internal note about this service...',
+            }}
+            error={internalNoteInputErrors.content}
+          />
+          <InputSubmitButton label="Add Note" icon="ri:add-line" hideCancel />
+        </form>
+      </FormSubSection>
+    </FormSection>
+
    <FormSection title="Events">
      <FormSubSection title="Existing Events">
        {
@@ -898,7 +1025,7 @@ if (!service) return Astro.rewrite('/404')
                        <Tooltip text="Delete">
                          <form
                            method="POST"
-                            action={actions.admin.service.deleteContactMethod}
+                            action={actions.admin.service.contactMethod.delete}
                            class="contents"
                          >
                            <input type="hidden" name="id" value={method.id} />
@@ -919,7 +1046,7 @@ if (!service) return Astro.rewrite('/404')
                    <form
                      id={`edit-contact-method-${method.id}`}
                      method="POST"
-                      action={actions.admin.service.updateContactMethod}
+                      action={actions.admin.service.contactMethod.update}
                      class="border-night-500 bg-night-700 mt-3 hidden space-y-3 rounded-md border p-3"
                    >
                      <input type="hidden" name="id" value={method.id} />
@@ -954,7 +1081,7 @@ if (!service) return Astro.rewrite('/404')
      </FormSubSection>

      <FormSubSection title="Add New Contact Method">
-        <form method="POST" action={actions.admin.service.createContactMethod} class="space-y-2">
+        <form method="POST" action={actions.admin.service.contactMethod.add} class="space-y-2">
          <input type="hidden" name="serviceId" value={service.id} />

          <InputText label="Override Label" name="label" />
--- a/web/src/pages/admin/services/index.astro
+++ b/web/src/pages/admin/services/index.astro
@@ -111,6 +111,7 @@ const services = await Astro.locals.banners.try(
        _count: {
          select: {
            verificationRequests: true,
+            internalNotes: true,
          },
        },
      },
@@ -440,9 +441,18 @@ const truncate = (text: string, length: number) => {
                    </div>
                  </td>
                  <td class="px-4 py-3 text-center">
-                    <span class="inline-flex items-center rounded-full bg-orange-900/30 px-2.5 py-0.5 text-xs text-orange-400">
-                      {service._count.verificationRequests}
-                    </span>
+                    <div class="flex flex-col items-center justify-center gap-1">
+                      <span class="inline-flex items-center rounded-full bg-orange-900/30 px-2.5 py-0.5 text-xs text-orange-400">
+                        {service._count.verificationRequests}
+                      </span>
+
+                      {service._count.internalNotes > 0 && (
+                        <span class="inline-flex items-center text-purple-400">
+                          <Icon name="ri:sticky-note-line" class="mr-0.5 size-4" />
+                          {service._count.internalNotes}
+                        </span>
+                      )}
+                    </div>
                  </td>
                  <td class="px-4 py-3 text-center text-xs text-zinc-400">{service.formattedDate}</td>
                  <td class="px-4 py-3 text-right">
--- a/web/src/pages/admin/services/new.astro
+++ b/web/src/pages/admin/services/new.astro
@@ -350,13 +350,13 @@ const inputErrors = isInputError(result?.error) ? result.error.fields : {}
      </div>

      <div>
-        <label class="font-title mb-2 block text-sm text-green-500" for="referral">referral</label>
+        <label class="font-title mb-2 block text-sm text-green-500" for="referral">referral link path</label>
        <input
          transition:persist
          type="text"
          name="referral"
          id="referral"
-          placeholder="Optional referral code/link"
+          placeholder="e.g. ?ref=123 or /ref/123"
          class="font-title w-full rounded-md border border-green-500/30 bg-black/50 p-2 text-gray-300 placeholder-gray-500 focus:border-green-500 focus:ring-green-500"
        />
        {
@@ -366,6 +366,26 @@ const inputErrors = isInputError(result?.error) ? result.error.fields : {}
        }
      </div>

+      <div>
+        <label for="internalNote" class="font-title mb-2 block text-sm text-green-500">internalNote</label>
+        <div class="space-y-2">
+          <textarea
+            transition:persist
+            name="internalNote"
+            id="internalNote"
+            rows={4}
+            placeholder="Markdown supported"
+            class="font-title w-full rounded-md border border-green-500/30 bg-black/50 p-2 text-gray-300 placeholder-gray-500 focus:border-green-500 focus:ring-green-500"
+            set:text=""
+          />
+        </div>
+        {
+          inputErrors.internalNote && (
+            <p class="font-title mt-1 text-sm text-red-500">{inputErrors.internalNote.join(', ')}</p>
+          )
+        }
+      </div>
+
      <button
        type="submit"
        class="font-title inline-flex justify-center rounded-md border border-green-500/30 bg-green-500/10 px-4 py-2 text-sm text-green-400 shadow-xs transition-colors duration-200 hover:bg-green-500/20 focus:ring-2 focus:ring-green-500 focus:ring-offset-2 focus:ring-offset-black focus:outline-hidden"
--- a/web/src/pages/admin/users/[username].astro
+++ b/web/src/pages/admin/users/[username].astro
@@ -1,5 +1,6 @@
 ---
 import { Icon } from 'astro-icon/components'
+import { Markdown } from 'astro-remote'
 import { actions, isInputError } from 'astro:actions'

 import BadgeSmall from '../../../components/BadgeSmall.astro'
@@ -304,8 +305,8 @@ if (!user) return Astro.rewrite('/404')
                </div>
              </div>

-              <div data-note-content>
-                <p class="text-day-200 wrap-anywhere whitespace-pre-wrap" set:text={note.content} />
+              <div data-note-content class="prose prose-sm text-day-200 prose-invert max-w-none text-pretty">
+                <Markdown content={note.content} />
              </div>

              <form
--- a/web/src/pages/service-suggestion/edit.astro
+++ b/web/src/pages/service-suggestion/edit.astro
@@ -53,6 +53,7 @@ const service = await Astro.locals.banners.try(
            icon: true,
          },
        },
+        serviceVisibility: true,
      },
      where: { id: params.serviceId },
    }),
@@ -101,7 +102,7 @@ if (!service) return Astro.rewrite('/404')
      error={inputErrors.notes}
    />

-    <Captcha action={actions.serviceSuggestion.createService} />
+    <Captcha action={actions.serviceSuggestion.editService} />

    <InputHoneypotTrap name="message" />

--- a/web/src/pages/service/[slug].astro
+++ b/web/src/pages/service/[slug].astro
@@ -16,6 +16,8 @@ import DropdownButton from '../../components/DropdownButton.astro'
 import DropdownButtonItemForm from '../../components/DropdownButtonItemForm.astro'
 import DropdownButtonItemLink from '../../components/DropdownButtonItemLink.astro'
 import FormatTimeInterval from '../../components/FormatTimeInterval.astro'
+import InputSubmitButton from '../../components/InputSubmitButton.astro'
+import InputTextArea from '../../components/InputTextArea.astro'
 import MyPicture from '../../components/MyPicture.astro'
 import { makeOgImageUrl, type OgImageAllTemplatesWithProps } from '../../components/OgImage'
 import ScoreGauge from '../../components/ScoreGauge.astro'
@@ -23,6 +25,7 @@ import ScoreSquare from '../../components/ScoreSquare.astro'
 import ServiceLinkButton from '../../components/ServiceLinkButton.astro'
 import TimeFormatted from '../../components/TimeFormatted.astro'
 import Tooltip from '../../components/Tooltip.astro'
+import UserBadge from '../../components/UserBadge.astro'
 import VerificationWarningBanner from '../../components/VerificationWarningBanner.astro'
 import { getAttributeCategoryInfo } from '../../constants/attributeCategories'
 import { getAttributeTypeInfo } from '../../constants/attributeTypes'
@@ -159,6 +162,21 @@ const [service, dbNotificationPreferences] = await Astro.locals.banners.tryMany(
              updatedAt: true,
            },
          },
+          internalNotes: {
+            select: {
+              id: true,
+              content: true,
+              createdAt: true,
+              addedByUser: {
+                select: {
+                  name: true,
+                  displayName: true,
+                  picture: true,
+                },
+              },
+            },
+            orderBy: { createdAt: 'desc' },
+          },
          _count: {
            select: {
              comments: {
@@ -749,6 +767,61 @@ const serviceVisibilityInfo = getServiceVisibilityInfo(service.serviceVisibility
    )
  }

+  <AdminOnly>
+    <div class="border-day-500 mt-6 mb-3 flex items-center justify-between border-b">
+      <h2 class="font-title text-day-100 text-lg font-bold">Internal Notes</h2>
+      <a
+        href={`/admin/services/${service.slug}/edit#internal-notes`}
+        class="text-day-500 hover:text-day-200 inline-flex items-center gap-1 text-xs leading-none transition-colors hover:underline"
+      >
+        Manage
+        <Icon name="ri:arrow-right-s-line" class="size-4" />
+      </a>
+    </div>
+
+    {
+      service.internalNotes.length === 0 ? (
+        <p class="text-day-400 mt-2 text-center text-xs">No internal notes yet.</p>
+      ) : (
+        <div
+          class={cn(
+            'grid grid-cols-1 items-start gap-2',
+            service.internalNotes.length > 1 && 'sm:grid-cols-2'
+          )}
+        >
+          {service.internalNotes.map((note) => (
+            <div class="border-night-600 bg-night-800 rounded-lg border p-3">
+              <div class="prose text-day-200 prose-sm prose-invert max-w-none text-pretty">
+                <Markdown content={note.content} />
+              </div>
+
+              <div class="text-day-500 mt-2 flex items-center gap-1 text-xs">
+                <TimeFormatted date={note.createdAt} hourPrecision />
+                {note.addedByUser && (
+                  <span class="flex items-center gap-1">
+                    by <UserBadge user={note.addedByUser} size="sm" />
+                  </span>
+                )}
+              </div>
+            </div>
+          ))}
+        </div>
+      )
+    }
+
+    <form
+      method="POST"
+      action={actions.admin.service.internalNote.add}
+      data-note-edit-form
+      class="mt-4 space-y-4"
+    >
+      <input type="hidden" name="serviceId" value={service.id} />
+
+      <InputTextArea label="Add a note" name="content" />
+      <InputSubmitButton label="Save" icon="ri:save-line" hideCancel />
+    </form>
+  </AdminOnly>
+
  <h2 class="font-title border-day-500 text-day-200 mt-6 mb-3 border-b text-lg font-bold" id="scores">
    Scores
  </h2>
--- a/web/src/pages/u/[username].astro
+++ b/web/src/pages/u/[username].astro
@@ -1,5 +1,6 @@
 ---
 import { Icon } from 'astro-icon/components'
+import { Markdown } from 'astro-remote'
 import { actions } from 'astro:actions'
 import { sortBy } from 'lodash-es'

@@ -525,7 +526,9 @@ const isCurrentUser = !!Astro.locals.user && user.id === Astro.locals.user.id
                    <TimeFormatted date={note.createdAt} hourPrecision />
                  </span>
                </div>
-                <div class="text-day-200 wrap-anywhere whitespace-pre-wrap" set:text={note.content} />
+                <div class="prose text-day-200 prose-sm prose-invert max-w-none text-pretty">
+                  <Markdown content={note.content} />
+                </div>
              </div>
            ))}
          </div>