Extend fine-grained ACL to settings, content, shop, and radio.

Gate pages and mutations on module PERMS instead of dashboard-only staff checks, add radio view/edit slugs with migration 0015, and expand the operations contract tests.

Co-authored-by: Cursor <[email protected]>

src/actions/admin-theme.ts

@@ -2,7 +2,8 @@
 
 import { revalidatePath } from "next/cache";
 import { redirect } from "next/navigation";
-import { requireStaff } from "@/lib/admin/guard";
+import { requirePermission } from "@/lib/admin/guard";
+import { PERMS } from "@/lib/permissions";
 import { prisma } from "@/lib/prisma";
 import { siteSettings } from "@/lib/services/site-settings";
 import { logStaffActivity } from "@/lib/services/staff-activity";
@@ -30,7 +31,7 @@ async function writeSetting(key: string, value: string): Promise<void> {
 }
 
 export async function saveTheme(formData: FormData): Promise<void> {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.SETTINGS_EDIT);
 
 	try {
 		for (const mode of ["light", "dark"] as const) {
@@ -96,7 +97,7 @@ export async function saveTheme(formData: FormData): Promise<void> {
 }
 
 export async function applyPreset(formData: FormData): Promise<void> {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.SETTINGS_EDIT);
 	const name = String(formData.get("preset") ?? "").normalize("NFC");
 	// eslint-disable-next-line security/detect-object-injection -- guarded by null check below
 	const preset = PRESETS[name];
@@ -120,7 +121,7 @@ export async function applyPreset(formData: FormData): Promise<void> {
 }
 
 export async function saveCustomTheme(formData: FormData): Promise<void> {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.SETTINGS_EDIT);
 	const name = String(formData.get("name") ?? "")
 		.normalize("NFC")
 		.trim();
@@ -141,7 +142,7 @@ export async function saveCustomTheme(formData: FormData): Promise<void> {
 }
 
 export async function applyCustomTheme(formData: FormData): Promise<void> {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.SETTINGS_EDIT);
 	const id = String(formData.get("id") ?? "")
 		.normalize("NFC")
 		.trim();
@@ -167,7 +168,7 @@ export async function applyCustomTheme(formData: FormData): Promise<void> {
 }
 
 export async function renameCustomTheme(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermission(PERMS.SETTINGS_EDIT);
 	const id = String(formData.get("id") ?? "")
 		.normalize("NFC")
 		.trim();
@@ -186,7 +187,7 @@ export async function renameCustomTheme(formData: FormData): Promise<void> {
 }
 
 export async function deleteCustomTheme(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermission(PERMS.SETTINGS_EDIT);
 	const id = String(formData.get("id") ?? "")
 		.normalize("NFC")
 		.trim();