Extend fine-grained ACL to settings, content, shop, and radio.

Gate pages and mutations on module PERMS instead of dashboard-only staff checks, add radio view/edit slugs with migration 0015, and expand the operations contract tests.

Co-authored-by: Cursor <[email protected]>

src/app/admin/articles/[id]/page.tsx

@@ -1,9 +1,10 @@
 import { Newspaper } from "lucide-react";
 import Link from "next/link";
-import { notFound } from "next/navigation";
+import { notFound, redirect } from "next/navigation";
 import { getTranslations } from "next-intl/server";
 import { deleteArticle, updateArticle } from "@/actions/admin-articles";
 import { ArticleForm } from "@/components/admin/article-form";
+import { canAccess, getAdminContext, PERMS } from "@/lib/permissions";
 import { prisma } from "@/lib/prisma";
 
 export const dynamic = "force-dynamic";
@@ -15,6 +16,11 @@ export default async function EditArticle({
 	params: Promise<{ id: string }>;
 	searchParams: Promise<{ error?: string }>;
 }) {
+	const { session, permissions } = await getAdminContext();
+	if (!canAccess(permissions, PERMS.NEWS_VIEW, session.user.rank)) {
+		redirect("/admin");
+	}
+
 	const { id } = await params;
 	const { error } = await searchParams;
 	const t = await getTranslations("pages.admin.articles");

src/app/admin/articles/new/page.tsx

@@ -1,14 +1,21 @@
 import { Newspaper } from "lucide-react";
 import Link from "next/link";
+import { redirect } from "next/navigation";
 import { getTranslations } from "next-intl/server";
 import { createArticle } from "@/actions/admin-articles";
 import { ArticleForm } from "@/components/admin/article-form";
+import { canAccess, getAdminContext, PERMS } from "@/lib/permissions";
 
 export default async function NewArticle({
 	searchParams,
 }: {
 	searchParams: Promise<{ error?: string }>;
 }) {
+	const { session, permissions } = await getAdminContext();
+	if (!canAccess(permissions, PERMS.NEWS_EDIT, session.user.rank)) {
+		redirect("/admin");
+	}
+
 	const { error } = await searchParams;
 	const t = await getTranslations("pages.admin.articles");
 

src/app/admin/articles/page.tsx

@@ -1,8 +1,10 @@
 import { Newspaper } from "lucide-react";
 import Link from "next/link";
+import { redirect } from "next/navigation";
 import { getTranslations } from "next-intl/server";
 import { deleteArticle } from "@/actions/admin-articles";
 import { StatusCard } from "@/components/admin/dashboard";
+import { canAccess, getAdminContext, PERMS } from "@/lib/permissions";
 import { prisma } from "@/lib/prisma";
 
 export const dynamic = "force-dynamic";
@@ -12,6 +14,11 @@ export default async function AdminArticles({
 }: {
 	searchParams: Promise<{ error?: string }>;
 }) {
+	const { session, permissions } = await getAdminContext();
+	if (!canAccess(permissions, PERMS.NEWS_VIEW, session.user.rank)) {
+		redirect("/admin");
+	}
+
 	const { error } = await searchParams;
 	const t = await getTranslations("pages.admin.articles");
 	const articles = await prisma.websiteArticles