feat(mod): lite /mod panel + clarify ACL vs housekeeping legacy

Co-authored-by: Cursor <[email protected]>

src/lib/admin/guard.ts

@@ -26,7 +26,9 @@ export async function requireStaff(): Promise<StaffUser> {
  * Staff gate plus a specific ACL slug. Use for FormData server actions that
  * must not stop at admin.dashboard alone (RCON, user edits, settings writes).
  */
-export async function requirePermission(permission: string): Promise<StaffUser> {
+export async function requirePermission(
+	permission: string,
+): Promise<StaffUser> {
 	const { session, permissions } = await getAdminContext();
 	if (!canAccess(permissions, PERMS.ADMIN_DASHBOARD, session.user.rank))
 		redirectSafe("/", "/");
@@ -56,3 +58,35 @@ export async function requireStaffRateLimited(): Promise<StaffUser> {
 		redirectSafe("/admin?error=ratelimit", "/admin");
 	return staff;
 }
+
+/**
+ * Mod-lite gate: needs any mod.* / moderation ACL, not admin.dashboard.
+ * Use for `/mod` layout so mid-ranks can access without full housekeeping.
+ */
+export async function requireMod(): Promise<StaffUser> {
+	const { session, permissions } = await getAdminContext();
+	const ok =
+		canAccess(permissions, PERMS.MOD_DASHBOARD, session.user.rank) ||
+		canAccess(permissions, PERMS.MODERATION_VIEW, session.user.rank) ||
+		canAccess(permissions, PERMS.MOD_CFH_VIEW, session.user.rank) ||
+		canAccess(permissions, PERMS.MOD_ACTIONS, session.user.rank) ||
+		canAccess(permissions, PERMS.MOD_BANS_VIEW, session.user.rank);
+	if (!ok) redirectSafe("/", "/");
+	return {
+		id: session.user.id,
+		rank: session.user.rank,
+		username: session.user.username,
+	};
+}
+
+/** Mod-lite page gate: any-of permission list (no admin.dashboard required). */
+export async function requireModPermission(
+	permission: string | readonly string[],
+): Promise<StaffUser> {
+	const staff = await requireMod();
+	const { permissions } = await getAdminContext();
+	const needed = Array.isArray(permission) ? permission : [permission];
+	const ok = needed.some((slug) => canAccess(permissions, slug, staff.rank));
+	if (!ok) redirectSafe("/mod", "/mod");
+	return staff;
+}