Extend fine-grained ACL to settings, content, shop, and radio.

Gate pages and mutations on module PERMS instead of dashboard-only staff checks, add radio view/edit slugs with migration 0015, and expand the operations contract tests.

Co-authored-by: Cursor <[email protected]>

src/actions/admin-articles.ts

@@ -2,7 +2,8 @@
 
 import { revalidatePath } from "next/cache";
 import { redirect } from "next/navigation";
-import { requireStaff } from "@/lib/admin/guard";
+import { requirePermission } from "@/lib/admin/guard";
+import { PERMS } from "@/lib/permissions";
 import { slugify } from "@/lib/format";
 import { prisma } from "@/lib/prisma";
 
@@ -22,7 +23,7 @@ async function uniqueSlug(title: string): Promise<string> {
 }
 
 export async function createArticle(formData: FormData): Promise<void> {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.NEWS_EDIT);
 	const title = String(formData.get("title") ?? "")
 		.normalize("NFC")
 		.trim();
@@ -61,7 +62,7 @@ export async function createArticle(formData: FormData): Promise<void> {
 }
 
 export async function updateArticle(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermission(PERMS.NEWS_EDIT);
 	const id = BigInt(String(formData.get("id")));
 	try {
 		await prisma.websiteArticles.update({
@@ -93,7 +94,7 @@ export async function updateArticle(formData: FormData): Promise<void> {
 }
 
 export async function deleteArticle(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermission(PERMS.NEWS_EDIT);
 	const id = BigInt(String(formData.get("id")));
 	try {
 		await prisma.$transaction([

src/actions/admin-bans.ts

@@ -2,7 +2,8 @@
 
 import { revalidatePath } from "next/cache";
 import type { $Enums } from "@/generated/prisma/client";
-import { requireStaffRateLimited as requireStaff } from "@/lib/admin/guard";
+import { requirePermissionRateLimited } from "@/lib/admin/guard";
+import { PERMS } from "@/lib/permissions";
 import { prisma } from "@/lib/prisma";
 import { rcon } from "@/lib/services/rcon";
 import { logStaffActivity } from "@/lib/services/staff-activity";
@@ -17,7 +18,7 @@ const BAN_TYPES: ReadonlySet<string> = new Set([
 const PERMANENT_SECONDS = 100 * 365 * 24 * 3600;
 
 export async function createBan(formData: FormData): Promise<void> {
-	const staff = await requireStaff();
+	const staff = await requirePermissionRateLimited(PERMS.USERS_BAN);
 	const userId = Number(formData.get("userId"));
 	const reason =
 		String(formData.get("reason") ?? "")
@@ -63,7 +64,7 @@ export async function createBan(formData: FormData): Promise<void> {
 }
 
 export async function liftBan(formData: FormData): Promise<void> {
-	const staff = await requireStaff();
+	const staff = await requirePermissionRateLimited(PERMS.USERS_BAN);
 	const id = Number(formData.get("id"));
 	if (id > 0) {
 		await prisma.ban.delete({ where: { id } });

src/actions/admin-emulator.ts

@@ -1,7 +1,8 @@
 "use server";
 
 import { revalidatePath } from "next/cache";
-import { requireStaff } from "@/lib/admin/guard";
+import { requirePermission } from "@/lib/admin/guard";
+import { PERMS } from "@/lib/permissions";
 import { prisma } from "@/lib/prisma";
 
 // emulator_settings: PK is the string column `key`, payload is `value` (VarChar 512).
@@ -10,7 +11,7 @@ import { prisma } from "@/lib/prisma";
 // keys via upsert. We never migrate or drop them.
 
 export async function updateEmulatorSetting(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermission(PERMS.SETTINGS_EDIT);
 	const key = String(formData.get("key") ?? "")
 		.normalize("NFC")
 		.trim()
@@ -28,7 +29,7 @@ export async function updateEmulatorSetting(formData: FormData): Promise<void> {
 }
 
 export async function updateEmulatorText(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermission(PERMS.SETTINGS_EDIT);
 	const key = String(formData.get("key") ?? "")
 		.normalize("NFC")
 		.trim()

src/actions/admin-radio-api-keys.ts

@@ -3,7 +3,8 @@
 import { randomBytes } from "node:crypto";
 import { revalidatePath } from "next/cache";
 import { redirect } from "next/navigation";
-import { requireStaff } from "@/lib/admin/guard";
+import { requirePermission } from "@/lib/admin/guard";
+import { PERMS } from "@/lib/permissions";
 import { prisma } from "@/lib/prisma";
 import { logStaffActivity } from "@/lib/services/staff-activity";
 
@@ -35,7 +36,7 @@ function intOr(raw: FormDataEntryValue | null, fallback: number): number {
 }
 
 export async function createApiKey(formData: FormData): Promise<void> {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.RADIO_EDIT);
 
 	const name = str(formData.get("name")).trim().slice(0, 255);
 	if (!name) return;
@@ -77,7 +78,7 @@ export async function createApiKey(formData: FormData): Promise<void> {
 }
 
 export async function toggleApiKey(formData: FormData): Promise<void> {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.RADIO_EDIT);
 
 	const id = parseId(formData.get("id"));
 	if (id == null) return;
@@ -109,7 +110,7 @@ export async function toggleApiKey(formData: FormData): Promise<void> {
 }
 
 export async function deleteApiKey(formData: FormData): Promise<void> {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.RADIO_EDIT);
 
 	const id = parseId(formData.get("id"));
 	if (id == null) return;

src/actions/admin-radio-autodj.ts

@@ -1,7 +1,8 @@
 "use server";
 
 import { revalidatePath } from "next/cache";
-import { requireStaff } from "@/lib/admin/guard";
+import { requirePermission } from "@/lib/admin/guard";
+import { PERMS } from "@/lib/permissions";
 import { prisma } from "@/lib/prisma";
 import { logStaffActivity } from "@/lib/services/staff-activity";
 
@@ -51,7 +52,7 @@ function optUInt(raw: FormDataEntryValue | null): number | null {
 // ── AutoDJ playlist CRUD (radio_auto_dj_playlist) ────────────────────────
 
 export async function createTrack(formData: FormData): Promise<void> {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.RADIO_EDIT);
 	const title = str(formData.get("title")).trim().slice(0, 255);
 	if (!title) return;
 
@@ -91,7 +92,7 @@ export async function createTrack(formData: FormData): Promise<void> {
 }
 
 export async function toggleTrack(formData: FormData): Promise<void> {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.RADIO_EDIT);
 	const id = parseId(formData.get("id"));
 	if (id === null) return;
 
@@ -117,7 +118,7 @@ export async function toggleTrack(formData: FormData): Promise<void> {
 }
 
 export async function deleteTrack(formData: FormData): Promise<void> {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.RADIO_EDIT);
 	const id = parseId(formData.get("id"));
 	if (id === null) return;
 

src/actions/admin-radio-extra.ts

@@ -1,7 +1,8 @@
 "use server";
 
 import { revalidatePath } from "next/cache";
-import { requireStaff } from "@/lib/admin/guard";
+import { requirePermission } from "@/lib/admin/guard";
+import { PERMS } from "@/lib/permissions";
 import { prisma } from "@/lib/prisma";
 import { siteSettings } from "@/lib/services/site-settings";
 
@@ -36,7 +37,7 @@ function bool(raw: FormDataEntryValue | null): boolean {
  * siteSettings cache so the public radio pages pick the change up immediately.
  */
 export async function saveRadioSetting(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermission(PERMS.RADIO_EDIT);
 	const key = str(formData.get("key")).trim().slice(0, 255);
 	const value = str(formData.get("value"));
 	const comment = str(formData.get("comment")).trim().slice(0, 255);
@@ -61,7 +62,7 @@ export async function saveRadioSetting(formData: FormData): Promise<void> {
  * only touch those (and never wipe unrelated settings).
  */
 export async function saveRadioSettings(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermission(PERMS.RADIO_EDIT);
 	const keysRaw = str(formData.get("__keys"));
 	const keys = keysRaw
 		.split(",")
@@ -90,7 +91,7 @@ export async function saveRadioSettings(formData: FormData): Promise<void> {
 // ── Radio banners CRUD (radio_banners) ─────────────────────────────────────
 
 export async function createRadioBanner(formData: FormData): Promise<void> {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.RADIO_EDIT);
 	const imagePath = str(formData.get("imagePath")).trim().slice(0, 255);
 	if (!imagePath) return;
 
@@ -123,7 +124,7 @@ export async function createRadioBanner(formData: FormData): Promise<void> {
 }
 
 export async function updateRadioBanner(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermission(PERMS.RADIO_EDIT);
 	const id = parseId(formData.get("id"));
 	if (id === null) return;
 
@@ -156,7 +157,7 @@ export async function updateRadioBanner(formData: FormData): Promise<void> {
 }
 
 export async function deleteRadioBanner(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermission(PERMS.RADIO_EDIT);
 	const id = parseId(formData.get("id"));
 	if (id === null) return;
 	try {
@@ -170,7 +171,7 @@ export async function deleteRadioBanner(formData: FormData): Promise<void> {
 // ── Radio ranks CRUD (radio_ranks) ─────────────────────────────────────────
 
 export async function createRadioRank(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermission(PERMS.RADIO_EDIT);
 	const name = str(formData.get("name")).trim().slice(0, 255);
 	if (!name) return;
 
@@ -197,7 +198,7 @@ export async function createRadioRank(formData: FormData): Promise<void> {
 }
 
 export async function updateRadioRank(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermission(PERMS.RADIO_EDIT);
 	const id = parseId(formData.get("id"));
 	if (id === null) return;
 
@@ -225,7 +226,7 @@ export async function updateRadioRank(formData: FormData): Promise<void> {
 }
 
 export async function deleteRadioRank(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermission(PERMS.RADIO_EDIT);
 	const id = parseId(formData.get("id"));
 	if (id === null) return;
 	try {

src/actions/admin-radio-moderation.ts

@@ -1,7 +1,8 @@
 "use server";
 
 import { revalidatePath } from "next/cache";
-import { requireStaff } from "@/lib/admin/guard";
+import { requirePermission } from "@/lib/admin/guard";
+import { PERMS } from "@/lib/permissions";
 import { prisma } from "@/lib/prisma";
 import { logStaffActivity } from "@/lib/services/staff-activity";
 
@@ -22,7 +23,7 @@ function parseId(raw: FormDataEntryValue | null): bigint | null {
  * moderation route. Fails soft if the row is already gone.
  */
 export async function deleteShout(formData: FormData): Promise<void> {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.RADIO_EDIT);
 	const id = parseId(formData.get("id"));
 	if (id === null) return;
 

src/actions/admin-radio-points.ts

@@ -2,7 +2,8 @@
 
 import { revalidatePath } from "next/cache";
 import { redirect } from "next/navigation";
-import { requireStaff } from "@/lib/admin/guard";
+import { requirePermission } from "@/lib/admin/guard";
+import { PERMS } from "@/lib/permissions";
 import { prisma } from "@/lib/prisma";
 import { siteSettings } from "@/lib/services/site-settings";
 import { logStaffActivity } from "@/lib/services/staff-activity";
@@ -46,7 +47,7 @@ function intStr(raw: FormDataEntryValue | null): string {
 }
 
 export async function savePoints(formData: FormData): Promise<void> {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.RADIO_EDIT);
 
 	const currencyRaw = str(formData.get("radio_points_currency"))
 		.trim()

src/actions/admin-settings.ts

@@ -1,12 +1,13 @@
 "use server";
 
 import { revalidatePath } from "next/cache";
-import { requireStaffRateLimited as requireStaff } from "@/lib/admin/guard";
+import { requirePermissionRateLimited } from "@/lib/admin/guard";
+import { PERMS } from "@/lib/permissions";
 import { prisma } from "@/lib/prisma";
 import { siteSettings } from "@/lib/services/site-settings";
 
 export async function updateSetting(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermissionRateLimited(PERMS.SETTINGS_EDIT);
 	const key = String(formData.get("key") ?? "")
 		.normalize("NFC")
 		.trim();
@@ -18,7 +19,7 @@ export async function updateSetting(formData: FormData): Promise<void> {
 }
 
 export async function createSetting(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermissionRateLimited(PERMS.SETTINGS_EDIT);
 	const key = String(formData.get("key") ?? "")
 		.normalize("NFC")
 		.trim()
@@ -39,7 +40,7 @@ export async function createSetting(formData: FormData): Promise<void> {
 }
 
 export async function deleteSetting(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermissionRateLimited(PERMS.SETTINGS_EDIT);
 	const key = String(formData.get("key") ?? "")
 		.normalize("NFC")
 		.trim();

src/actions/admin-shop.ts

@@ -2,7 +2,8 @@
 
 import { revalidatePath } from "next/cache";
 import { redirect } from "next/navigation";
-import { requireStaff } from "@/lib/admin/guard";
+import { requirePermission } from "@/lib/admin/guard";
+import { PERMS } from "@/lib/permissions";
 import { formPositiveBigInt } from "@/lib/form-data";
 import { prisma } from "@/lib/prisma";
 import { logServerError } from "@/lib/server-log";
@@ -30,7 +31,7 @@ function reqUInt(formData: FormData, key: string): number {
 }
 
 export async function createShopArticle(formData: FormData): Promise<void> {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.SHOP_EDIT);
 
 	const name = String(formData.get("name") ?? "")
 		.normalize("NFC")
@@ -90,7 +91,7 @@ export async function createShopArticle(formData: FormData): Promise<void> {
 }
 
 export async function updateShopArticle(formData: FormData): Promise<void> {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.SHOP_EDIT);
 
 	const id = formPositiveBigInt(formData, "id");
 	if (!id) return;
@@ -152,7 +153,7 @@ export async function updateShopArticle(formData: FormData): Promise<void> {
 }
 
 export async function deleteShopArticle(formData: FormData): Promise<void> {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.SHOP_EDIT);
 
 	const id = formPositiveBigInt(formData, "id");
 	if (!id) return;

src/actions/admin-theme.ts

@@ -2,7 +2,8 @@
 
 import { revalidatePath } from "next/cache";
 import { redirect } from "next/navigation";
-import { requireStaff } from "@/lib/admin/guard";
+import { requirePermission } from "@/lib/admin/guard";
+import { PERMS } from "@/lib/permissions";
 import { prisma } from "@/lib/prisma";
 import { siteSettings } from "@/lib/services/site-settings";
 import { logStaffActivity } from "@/lib/services/staff-activity";
@@ -30,7 +31,7 @@ async function writeSetting(key: string, value: string): Promise<void> {
 }
 
 export async function saveTheme(formData: FormData): Promise<void> {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.SETTINGS_EDIT);
 
 	try {
 		for (const mode of ["light", "dark"] as const) {
@@ -96,7 +97,7 @@ export async function saveTheme(formData: FormData): Promise<void> {
 }
 
 export async function applyPreset(formData: FormData): Promise<void> {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.SETTINGS_EDIT);
 	const name = String(formData.get("preset") ?? "").normalize("NFC");
 	// eslint-disable-next-line security/detect-object-injection -- guarded by null check below
 	const preset = PRESETS[name];
@@ -120,7 +121,7 @@ export async function applyPreset(formData: FormData): Promise<void> {
 }
 
 export async function saveCustomTheme(formData: FormData): Promise<void> {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.SETTINGS_EDIT);
 	const name = String(formData.get("name") ?? "")
 		.normalize("NFC")
 		.trim();
@@ -141,7 +142,7 @@ export async function saveCustomTheme(formData: FormData): Promise<void> {
 }
 
 export async function applyCustomTheme(formData: FormData): Promise<void> {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.SETTINGS_EDIT);
 	const id = String(formData.get("id") ?? "")
 		.normalize("NFC")
 		.trim();
@@ -167,7 +168,7 @@ export async function applyCustomTheme(formData: FormData): Promise<void> {
 }
 
 export async function renameCustomTheme(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermission(PERMS.SETTINGS_EDIT);
 	const id = String(formData.get("id") ?? "")
 		.normalize("NFC")
 		.trim();
@@ -186,7 +187,7 @@ export async function renameCustomTheme(formData: FormData): Promise<void> {
 }
 
 export async function deleteCustomTheme(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermission(PERMS.SETTINGS_EDIT);
 	const id = String(formData.get("id") ?? "")
 		.normalize("NFC")
 		.trim();

src/actions/admin-wordfilter.ts

@@ -1,12 +1,13 @@
 "use server";
 
 import { revalidatePath } from "next/cache";
-import { requireStaff } from "@/lib/admin/guard";
+import { requirePermission } from "@/lib/admin/guard";
+import { PERMS } from "@/lib/permissions";
 import { prisma } from "@/lib/prisma";
 import { rcon } from "@/lib/services/rcon";
 
 export async function addWord(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermission(PERMS.WORDFILTER_EDIT);
 	const word = String(formData.get("word") ?? "")
 		.normalize("NFC")
 		.trim()
@@ -23,7 +24,7 @@ export async function addWord(formData: FormData): Promise<void> {
 }
 
 export async function deleteWord(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermission(PERMS.WORDFILTER_EDIT);
 	const raw = String(formData.get("id") ?? "").normalize("NFC");
 	if (!raw) return;