Finish fine-grained ACL across remaining admin pages and actions.

Replace leftover requireStaff gates with module PERMS, drop hardcoded room rank thresholds, and expand contract tests so admin mutations cannot regress to dashboard-only checks.

Co-authored-by: Cursor <[email protected]>

src/actions/admin-ip.ts

@@ -1,7 +1,8 @@
 "use server";
 
 import { revalidatePath } from "next/cache";
-import { requireStaff } from "@/lib/admin/guard";
+import { requirePermission } from "@/lib/admin/guard";
+import { PERMS } from "@/lib/permissions";
 import { prisma } from "@/lib/prisma";
 
 function parseIp(formData: FormData): string {
@@ -20,7 +21,7 @@ function parseAsn(formData: FormData): string | null {
 }
 
 export async function addWhitelist(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermission(PERMS.SETTINGS_EDIT);
 	const ipAddress = parseIp(formData);
 	if (!ipAddress) return;
 	const asn = parseAsn(formData);
@@ -31,7 +32,7 @@ export async function addWhitelist(formData: FormData): Promise<void> {
 }
 
 export async function deleteWhitelist(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermission(PERMS.SETTINGS_EDIT);
 	const raw = String(formData.get("id") ?? "")
 		.normalize("NFC")
 		.trim();
@@ -41,7 +42,7 @@ export async function deleteWhitelist(formData: FormData): Promise<void> {
 }
 
 export async function addBlacklist(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermission(PERMS.SETTINGS_EDIT);
 	const ipAddress = parseIp(formData);
 	if (!ipAddress) return;
 	const asn = parseAsn(formData);
@@ -52,7 +53,7 @@ export async function addBlacklist(formData: FormData): Promise<void> {
 }
 
 export async function deleteBlacklist(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermission(PERMS.SETTINGS_EDIT);
 	const raw = String(formData.get("id") ?? "")
 		.normalize("NFC")
 		.trim();