Extend fine-grained ACL to settings, content, shop, and radio.

Gate pages and mutations on module PERMS instead of dashboard-only staff checks, add radio view/edit slugs with migration 0015, and expand the operations contract tests.

Co-authored-by: Cursor <[email protected]>

src/lib/admin-operations-contract.test.ts

@@ -19,6 +19,13 @@ const ROUTES: Array<[string, string]> = [
 	["online", "PERMS.USERS_VIEW"],
 	["commandocentrum", "PERMS.RCON_EXECUTE"],
 	["users/edit/[id]", "PERMS.USERS_EDIT"],
+	["settings", "PERMS.SETTINGS_VIEW"],
+	["theme", "PERMS.SETTINGS_VIEW"],
+	["emulator", "PERMS.SETTINGS_VIEW"],
+	["bans", "PERMS.BANS_VIEW"],
+	["wordfilter", "PERMS.WORDFILTER_VIEW"],
+	["articles", "PERMS.NEWS_VIEW"],
+	["shop", "PERMS.SHOP_VIEW"],
 ];
 
 describe("admin operations route contract", () => {
@@ -28,6 +35,12 @@ describe("admin operations route contract", () => {
 		expect(readFileSync(path, "utf8"), path).toContain(permission);
 	});
 
+	it("guards radio section via layout", () => {
+		const path = "src/app/admin/radio/layout.tsx";
+		expect(existsSync(path), path).toBe(true);
+		expect(readFileSync(path, "utf8"), path).toContain("PERMS.RADIO_VIEW");
+	});
+
 	it.each([
 		["analytics/export", "PERMS.ANALYTICS_EXPORT"],
 		["devops/health", "PERMS.DEVOPS_VIEW"],
@@ -55,4 +68,19 @@ describe("admin operations route contract", () => {
 		expect(source).toContain("PERMS.RCON_EXECUTE");
 		expect(source).not.toContain("requireStaff()");
 	});
+
+	it.each([
+		["admin-settings.ts", "PERMS.SETTINGS_EDIT"],
+		["admin-theme.ts", "PERMS.SETTINGS_EDIT"],
+		["admin-emulator.ts", "PERMS.SETTINGS_EDIT"],
+		["admin-bans.ts", "PERMS.USERS_BAN"],
+		["admin-wordfilter.ts", "PERMS.WORDFILTER_EDIT"],
+		["admin-articles.ts", "PERMS.NEWS_EDIT"],
+		["admin-shop.ts", "PERMS.SHOP_EDIT"],
+		["admin-radio-autodj.ts", "PERMS.RADIO_EDIT"],
+	])("guards %s mutations with %s", (file, permission) => {
+		const source = readFileSync(`src/actions/${file}`, "utf8");
+		expect(source).toContain(permission);
+		expect(source).not.toMatch(/await requireStaff\(\)/);
+	});
 });