Finish fine-grained ACL across remaining admin pages and actions.

Replace leftover requireStaff gates with module PERMS, drop hardcoded room rank thresholds, and expand contract tests so admin mutations cannot regress to dashboard-only checks.

Co-authored-by: Cursor <[email protected]>

src/actions/rooms.ts

@@ -1,13 +1,14 @@
 "use server";
 
 import { revalidatePath } from "next/cache";
-import { requireStaff } from "@/lib/admin/guard";
+import { requirePermission } from "@/lib/admin/guard";
+import { PERMS } from "@/lib/permissions";
 import { prisma } from "@/lib/prisma";
 import { rcon } from "@/lib/services/rcon";
 import { logStaffActivity } from "@/lib/services/staff-activity";
 
 export async function updateRoomItem(payload: Record<string, unknown>) {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.ROOMS_EDIT);
 	const { roomId, itemId, ...data } = payload as {
 		roomId: number;
 		itemId: number;
@@ -31,7 +32,7 @@ export async function bulkDeleteRoomItems({
 	roomId: number;
 	itemIds: number[];
 }) {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.ROOMS_EDIT);
 	await prisma.items.deleteMany({ where: { id: { in: itemIds }, roomId } });
 	await logStaffActivity({
 		staffId: staff.id,
@@ -49,7 +50,7 @@ export async function deleteRoomItem({
 	roomId: number;
 	itemId: number;
 }) {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.ROOMS_EDIT);
 	await prisma.items.delete({ where: { id: itemId } });
 	await logStaffActivity({
 		staffId: staff.id,
@@ -68,7 +69,7 @@ export async function roomRconAction({
 	roomId: number;
 	action: string;
 }) {
-	await requireStaff();
+	await requirePermission(PERMS.ROOMS_EDIT);
 	if (action === "reload") {
 		await rcon.send("reloadroom", { room_id: roomId });
 	} else if (action === "kick") {
@@ -81,7 +82,7 @@ export async function roomRconAction({
 }
 
 export async function deleteRoom({ id }: { id: number }) {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.ROOMS_DELETE);
 	await prisma.rooms.delete({ where: { id } });
 	await logStaffActivity({
 		staffId: staff.id,
@@ -103,7 +104,7 @@ export async function updateRoom({
 	state?: string;
 	usersMax?: number;
 }) {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.ROOMS_EDIT);
 	await prisma.rooms.update({ where: { id }, data: data as any });
 	await logStaffActivity({
 		staffId: staff.id,