Extend fine-grained ACL to settings, content, shop, and radio.

Gate pages and mutations on module PERMS instead of dashboard-only staff checks, add radio view/edit slugs with migration 0015, and expand the operations contract tests.

Co-authored-by: Cursor <[email protected]>

src/actions/admin-radio-extra.ts

@@ -1,7 +1,8 @@
 "use server";
 
 import { revalidatePath } from "next/cache";
-import { requireStaff } from "@/lib/admin/guard";
+import { requirePermission } from "@/lib/admin/guard";
+import { PERMS } from "@/lib/permissions";
 import { prisma } from "@/lib/prisma";
 import { siteSettings } from "@/lib/services/site-settings";
 
@@ -36,7 +37,7 @@ function bool(raw: FormDataEntryValue | null): boolean {
  * siteSettings cache so the public radio pages pick the change up immediately.
  */
 export async function saveRadioSetting(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermission(PERMS.RADIO_EDIT);
 	const key = str(formData.get("key")).trim().slice(0, 255);
 	const value = str(formData.get("value"));
 	const comment = str(formData.get("comment")).trim().slice(0, 255);
@@ -61,7 +62,7 @@ export async function saveRadioSetting(formData: FormData): Promise<void> {
  * only touch those (and never wipe unrelated settings).
  */
 export async function saveRadioSettings(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermission(PERMS.RADIO_EDIT);
 	const keysRaw = str(formData.get("__keys"));
 	const keys = keysRaw
 		.split(",")
@@ -90,7 +91,7 @@ export async function saveRadioSettings(formData: FormData): Promise<void> {
 // ── Radio banners CRUD (radio_banners) ─────────────────────────────────────
 
 export async function createRadioBanner(formData: FormData): Promise<void> {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.RADIO_EDIT);
 	const imagePath = str(formData.get("imagePath")).trim().slice(0, 255);
 	if (!imagePath) return;
 
@@ -123,7 +124,7 @@ export async function createRadioBanner(formData: FormData): Promise<void> {
 }
 
 export async function updateRadioBanner(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermission(PERMS.RADIO_EDIT);
 	const id = parseId(formData.get("id"));
 	if (id === null) return;
 
@@ -156,7 +157,7 @@ export async function updateRadioBanner(formData: FormData): Promise<void> {
 }
 
 export async function deleteRadioBanner(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermission(PERMS.RADIO_EDIT);
 	const id = parseId(formData.get("id"));
 	if (id === null) return;
 	try {
@@ -170,7 +171,7 @@ export async function deleteRadioBanner(formData: FormData): Promise<void> {
 // ── Radio ranks CRUD (radio_ranks) ─────────────────────────────────────────
 
 export async function createRadioRank(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermission(PERMS.RADIO_EDIT);
 	const name = str(formData.get("name")).trim().slice(0, 255);
 	if (!name) return;
 
@@ -197,7 +198,7 @@ export async function createRadioRank(formData: FormData): Promise<void> {
 }
 
 export async function updateRadioRank(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermission(PERMS.RADIO_EDIT);
 	const id = parseId(formData.get("id"));
 	if (id === null) return;
 
@@ -225,7 +226,7 @@ export async function updateRadioRank(formData: FormData): Promise<void> {
 }
 
 export async function deleteRadioRank(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermission(PERMS.RADIO_EDIT);
 	const id = parseId(formData.get("id"));
 	if (id === null) return;
 	try {