Extend fine-grained ACL to settings, content, shop, and radio.

Gate pages and mutations on module PERMS instead of dashboard-only staff checks, add radio view/edit slugs with migration 0015, and expand the operations contract tests.

Co-authored-by: Cursor <[email protected]>

src/app/admin/articles/[id]/page.tsx

@@ -1,9 +1,10 @@
 import { Newspaper } from "lucide-react";
 import Link from "next/link";
-import { notFound } from "next/navigation";
+import { notFound, redirect } from "next/navigation";
 import { getTranslations } from "next-intl/server";
 import { deleteArticle, updateArticle } from "@/actions/admin-articles";
 import { ArticleForm } from "@/components/admin/article-form";
+import { canAccess, getAdminContext, PERMS } from "@/lib/permissions";
 import { prisma } from "@/lib/prisma";
 
 export const dynamic = "force-dynamic";
@@ -15,6 +16,11 @@ export default async function EditArticle({
 	params: Promise<{ id: string }>;
 	searchParams: Promise<{ error?: string }>;
 }) {
+	const { session, permissions } = await getAdminContext();
+	if (!canAccess(permissions, PERMS.NEWS_VIEW, session.user.rank)) {
+		redirect("/admin");
+	}
+
 	const { id } = await params;
 	const { error } = await searchParams;
 	const t = await getTranslations("pages.admin.articles");

src/app/admin/articles/new/page.tsx

@@ -1,14 +1,21 @@
 import { Newspaper } from "lucide-react";
 import Link from "next/link";
+import { redirect } from "next/navigation";
 import { getTranslations } from "next-intl/server";
 import { createArticle } from "@/actions/admin-articles";
 import { ArticleForm } from "@/components/admin/article-form";
+import { canAccess, getAdminContext, PERMS } from "@/lib/permissions";
 
 export default async function NewArticle({
 	searchParams,
 }: {
 	searchParams: Promise<{ error?: string }>;
 }) {
+	const { session, permissions } = await getAdminContext();
+	if (!canAccess(permissions, PERMS.NEWS_EDIT, session.user.rank)) {
+		redirect("/admin");
+	}
+
 	const { error } = await searchParams;
 	const t = await getTranslations("pages.admin.articles");
 

src/app/admin/articles/page.tsx

@@ -1,8 +1,10 @@
 import { Newspaper } from "lucide-react";
 import Link from "next/link";
+import { redirect } from "next/navigation";
 import { getTranslations } from "next-intl/server";
 import { deleteArticle } from "@/actions/admin-articles";
 import { StatusCard } from "@/components/admin/dashboard";
+import { canAccess, getAdminContext, PERMS } from "@/lib/permissions";
 import { prisma } from "@/lib/prisma";
 
 export const dynamic = "force-dynamic";
@@ -12,6 +14,11 @@ export default async function AdminArticles({
 }: {
 	searchParams: Promise<{ error?: string }>;
 }) {
+	const { session, permissions } = await getAdminContext();
+	if (!canAccess(permissions, PERMS.NEWS_VIEW, session.user.rank)) {
+		redirect("/admin");
+	}
+
 	const { error } = await searchParams;
 	const t = await getTranslations("pages.admin.articles");
 	const articles = await prisma.websiteArticles

src/app/admin/bans/page.tsx

@@ -1,7 +1,9 @@
 import { Ban } from "lucide-react";
+import { redirect } from "next/navigation";
 import { getTranslations } from "next-intl/server";
 import { createBan, liftBan } from "@/actions/admin-bans";
 import { StatusCard } from "@/components/admin/dashboard";
+import { canAccess, getAdminContext, PERMS } from "@/lib/permissions";
 import { prisma } from "@/lib/prisma";
 
 export const dynamic = "force-dynamic";
@@ -11,6 +13,11 @@ function fromUnix(ts: number): string {
 }
 
 export default async function AdminBans() {
+	const { session, permissions } = await getAdminContext();
+	if (!canAccess(permissions, PERMS.BANS_VIEW, session.user.rank)) {
+		redirect("/admin");
+	}
+
 	const t = await getTranslations("pages.admin.bans");
 	const now = Math.floor(Date.now() / 1000);
 	let bans: Awaited<ReturnType<typeof prisma.ban.findMany>> = [];

src/app/admin/emulator/page.tsx

@@ -1,9 +1,11 @@
+import { redirect } from "next/navigation";
 import { getTranslations } from "next-intl/server";
 import {
 	updateEmulatorSetting,
 	updateEmulatorText,
 } from "@/actions/admin-emulator";
 import { StatusCard } from "@/components/admin/dashboard";
+import { canAccess, getAdminContext, PERMS } from "@/lib/permissions";
 import { prisma } from "@/lib/prisma";
 
 export const dynamic = "force-dynamic";
@@ -11,6 +13,11 @@ export const dynamic = "force-dynamic";
 const TEXTS_LIMIT = 300;
 
 export default async function AdminEmulator() {
+	const { session, permissions } = await getAdminContext();
+	if (!canAccess(permissions, PERMS.SETTINGS_VIEW, session.user.rank)) {
+		redirect("/admin");
+	}
+
 	const t = await getTranslations("pages.admin.emulator");
 
 	let settings: { key: string; value: string }[] = [];

src/app/admin/radio/embed/page.tsx

@@ -2,7 +2,6 @@ import { Code } from "lucide-react";
 import Link from "next/link";
 import { getTranslations } from "next-intl/server";
 import { StatusCard } from "@/components/admin/dashboard";
-import { requireStaff } from "@/lib/admin/guard";
 import { siteSettings } from "@/lib/services/site-settings";
 import { EmbedSnippet } from "./embed-snippet";
 
@@ -11,8 +10,6 @@ export const dynamic = "force-dynamic";
 export const metadata = { title: "Radio Embed" };
 
 export default async function AdminRadioEmbedPage() {
-	await requireStaff();
-
 	const t = await getTranslations("pages.admin.radio");
 
 	let streamUrl = "";

src/app/admin/radio/layout.tsx

@@ -0,0 +1,15 @@
+import { redirect } from "next/navigation";
+import { canAccess, getAdminContext, PERMS } from "@/lib/permissions";
+
+export default async function RadioAdminLayout({
+	children,
+}: {
+	children: React.ReactNode;
+}) {
+	const { session, permissions } = await getAdminContext();
+	if (!canAccess(permissions, PERMS.RADIO_VIEW, session.user.rank)) {
+		redirect("/admin");
+	}
+
+	return children;
+}

src/app/admin/radio/monitoring/page.tsx

@@ -2,7 +2,6 @@ import { Radio } from "lucide-react";
 import Link from "next/link";
 import { getTranslations } from "next-intl/server";
 import { DiagnosticRow, StatusCard } from "@/components/admin/dashboard";
-import { requireStaff } from "@/lib/admin/guard";
 import { siteSettings } from "@/lib/services/site-settings";
 
 export const dynamic = "force-dynamic";
@@ -166,8 +165,6 @@ function shortUrl(url: string): string {
 }
 
 export default async function AdminRadioMonitoringPage() {
-	await requireStaff();
-
 	const t = await getTranslations("pages.admin.radio");
 
 	let nowPlayingUrl: string | null = null;

src/app/admin/settings/page.tsx

@@ -1,14 +1,21 @@
+import { redirect } from "next/navigation";
 import { getTranslations } from "next-intl/server";
 import {
 	createSetting,
 	deleteSetting,
 	updateSetting,
 } from "@/actions/admin-settings";
+import { canAccess, getAdminContext, PERMS } from "@/lib/permissions";
 import { prisma } from "@/lib/prisma";
 
 export const dynamic = "force-dynamic";
 
 export default async function AdminSettings() {
+	const { session, permissions } = await getAdminContext();
+	if (!canAccess(permissions, PERMS.SETTINGS_VIEW, session.user.rank)) {
+		redirect("/admin");
+	}
+
 	const t = await getTranslations("pages.admin.settings");
 
 	let settings: Awaited<ReturnType<typeof prisma.websiteSetting.findMany>> = [];

src/app/admin/shop/[id]/page.tsx

@@ -1,8 +1,9 @@
 import { Package } from "lucide-react";
 import Link from "next/link";
-import { notFound } from "next/navigation";
+import { notFound, redirect } from "next/navigation";
 import { getTranslations } from "next-intl/server";
 import { deleteShopArticle, updateShopArticle } from "@/actions/admin-shop";
+import { canAccess, getAdminContext, PERMS } from "@/lib/permissions";
 import { prisma } from "@/lib/prisma";
 
 export const dynamic = "force-dynamic";
@@ -12,6 +13,11 @@ export default async function EditShopArticle({
 }: {
 	params: Promise<{ id: string }>;
 }) {
+	const { session, permissions } = await getAdminContext();
+	if (!canAccess(permissions, PERMS.SHOP_VIEW, session.user.rank)) {
+		redirect("/admin");
+	}
+
 	const t = await getTranslations("pages.admin.shop");
 
 	const { id } = await params;

src/app/admin/shop/new/page.tsx

@@ -1,9 +1,16 @@
 import { Package } from "lucide-react";
 import Link from "next/link";
+import { redirect } from "next/navigation";
 import { getTranslations } from "next-intl/server";
 import { createShopArticle } from "@/actions/admin-shop";
+import { canAccess, getAdminContext, PERMS } from "@/lib/permissions";
 
 export default async function NewShopArticle() {
+	const { session, permissions } = await getAdminContext();
+	if (!canAccess(permissions, PERMS.SHOP_EDIT, session.user.rank)) {
+		redirect("/admin");
+	}
+
 	const t = await getTranslations("pages.admin.shop");
 
 	return (

src/app/admin/shop/page.tsx

@@ -1,6 +1,8 @@
 import Link from "next/link";
+import { redirect } from "next/navigation";
 import { getTranslations } from "next-intl/server";
 import { StatusCard } from "@/components/admin/dashboard";
+import { canAccess, getAdminContext, PERMS } from "@/lib/permissions";
 import { prisma } from "@/lib/prisma";
 
 export const dynamic = "force-dynamic";
@@ -25,6 +27,11 @@ function statusState(
 }
 
 export default async function AdminShop() {
+	const { session, permissions } = await getAdminContext();
+	if (!canAccess(permissions, PERMS.SHOP_VIEW, session.user.rank)) {
+		redirect("/admin");
+	}
+
 	const t = await getTranslations("pages.admin.shop");
 
 	let packages: Awaited<

src/app/admin/theme/page.tsx

@@ -1,3 +1,4 @@
+import { redirect } from "next/navigation";
 import { getTranslations } from "next-intl/server";
 import {
 	applyCustomTheme,
@@ -7,6 +8,7 @@ import {
 	saveTheme,
 } from "@/actions/admin-theme";
 import { RenameTheme } from "@/components/admin/theme/rename-theme";
+import { canAccess, getAdminContext, PERMS } from "@/lib/permissions";
 import { siteSettings } from "@/lib/services/site-settings";
 import { listCustomThemes } from "@/lib/theme-custom-store";
 import { FONTS, PRESETS } from "@/lib/theme-presets";
@@ -317,6 +319,11 @@ export default async function AdminTheme({
 		deletedTheme?: string;
 	}>;
 }) {
+	const { session, permissions } = await getAdminContext();
+	if (!canAccess(permissions, PERMS.SETTINGS_VIEW, session.user.rank)) {
+		redirect("/admin");
+	}
+
 	const t = await getTranslations("pages.admin.theme");
 
 	const sp = await searchParams;

src/app/admin/wordfilter/page.tsx

@@ -1,7 +1,9 @@
 import { Filter } from "lucide-react";
+import { redirect } from "next/navigation";
 import { getTranslations } from "next-intl/server";
 import { addWord, deleteWord } from "@/actions/admin-wordfilter";
 import { StatusCard } from "@/components/admin/dashboard";
+import { canAccess, getAdminContext, PERMS } from "@/lib/permissions";
 import { prisma } from "@/lib/prisma";
 
 export const dynamic = "force-dynamic";
@@ -9,6 +11,11 @@ export const dynamic = "force-dynamic";
 type WordRow = { id: bigint; word: string };
 
 export default async function AdminWordFilter() {
+	const { session, permissions } = await getAdminContext();
+	if (!canAccess(permissions, PERMS.WORDFILTER_VIEW, session.user.rank)) {
+		redirect("/admin");
+	}
+
 	const t = await getTranslations("pages.admin.wordfilter");
 
 	let words: WordRow[] = [];