Finish fine-grained ACL across remaining admin pages and actions.

Replace leftover requireStaff gates with module PERMS, drop hardcoded room rank thresholds, and expand contract tests so admin mutations cannot regress to dashboard-only checks.

Co-authored-by: Cursor <[email protected]>

src/app/admin/ads/[id]/page.tsx

@@ -1,8 +1,9 @@
 import { Megaphone } from "lucide-react";
 import Link from "next/link";
-import { notFound } from "next/navigation";
+import { notFound, redirect } from "next/navigation";
 import { deleteAd, updateAd } from "@/actions/admin-ads";
 import { prisma } from "@/lib/prisma";
+import { canAccess, getAdminContext, PERMS } from "@/lib/permissions";
 
 export const dynamic = "force-dynamic";
 
@@ -11,6 +12,11 @@ export default async function EditAd({
 }: {
 	params: Promise<{ id: string }>;
 }) {
+	const { session, permissions } = await getAdminContext();
+	if (!canAccess(permissions, PERMS.PAGES_VIEW, session.user.rank)) {
+		redirect("/admin");
+	}
+
 	const { id } = await params;
 	let ad: Awaited<ReturnType<typeof prisma.websiteAds.findUnique>> = null;
 	try {

src/app/admin/ads/new/page.tsx

@@ -1,8 +1,15 @@
 import { Megaphone } from "lucide-react";
 import Link from "next/link";
+import { redirect } from "next/navigation";
 import { createAd } from "@/actions/admin-ads";
+import { canAccess, getAdminContext, PERMS } from "@/lib/permissions";
+
+export default async function NewAd() {
+	const { session, permissions } = await getAdminContext();
+	if (!canAccess(permissions, PERMS.PAGES_EDIT, session.user.rank)) {
+		redirect("/admin");
+	}
 
-export default function NewAd() {
 	return (
 		<main>
 			<div className="flex items-center gap-3 mb-6">

src/app/admin/ads/page.tsx

@@ -3,10 +3,17 @@ import Link from "next/link";
 import { getTranslations } from "next-intl/server";
 import { StatusCard } from "@/components/admin/dashboard";
 import { prisma } from "@/lib/prisma";
+import { redirect } from "next/navigation";
+import { canAccess, getAdminContext, PERMS } from "@/lib/permissions";
 
 export const dynamic = "force-dynamic";
 
 export default async function AdminAds() {
+	const { session, permissions } = await getAdminContext();
+	if (!canAccess(permissions, PERMS.PAGES_VIEW, session.user.rank)) {
+		redirect("/admin");
+	}
+
 	const t = await getTranslations("pages.admin.ads");
 	let ads: Awaited<ReturnType<typeof prisma.websiteAds.findMany>>;
 	try {