fix(admin): restore sidebar categories via ACL grant repair

Co-authored-by: Cursor <[email protected]>

src/app/admin/layout.tsx

@@ -12,7 +12,7 @@ import { ThemeSwitcher } from "@/components/theme-switcher";
 import { requireStaff } from "@/lib/admin/guard";
 import { collectNavPermissionSlugs } from "@/lib/admin-nav";
 import { setCsrfCookie } from "@/lib/foundation/security";
-import { canAccess, getAdminContext } from "@/lib/permissions";
+import { canAccess, getAdminContext, PERMS } from "@/lib/permissions";
 import { prisma } from "@/lib/prisma";
 import { siteSettings } from "@/lib/services/site-settings";
 
@@ -70,11 +70,21 @@ async function Sidebar({
 	const initial = staff.username.charAt(0).toUpperCase();
 	const { permissions } = await getAdminContext();
 	const isSuperAdmin = permissions.isSuperAdmin;
+	const hasDashboard = canAccess(
+		permissions,
+		PERMS.ADMIN_DASHBOARD,
+		staff.rank,
+	);
+	// Super-admins see everything. Everyone else sees items their ACL grants.
+	// If they can open the admin panel but ACL is incomplete (common after HK→ACL
+	// migration gaps), still show *.view nav entries so categories do not vanish.
 	const allowedPermissions = isSuperAdmin
 		? []
-		: collectNavPermissionSlugs().filter((slug) =>
-				canAccess(permissions, slug, staff.rank),
-			);
+		: collectNavPermissionSlugs().filter((slug) => {
+				if (canAccess(permissions, slug, staff.rank)) return true;
+				if (!hasDashboard) return false;
+				return slug.endsWith(".view") || slug === PERMS.ADMIN_DASHBOARD;
+			});
 
 	return (
 		<aside