Harden CMS security and theme contrast

src/lib/admin/guard.ts

@@ -1,6 +1,8 @@
 import { redirect } from "next/navigation";
 import { isStaff } from "@/lib/admin/is-staff";
+import { resolveStaffUser } from "@/lib/admin/staff-user";
 import { auth } from "@/lib/auth";
+import { prisma } from "@/lib/prisma";
 import { siteSettings } from "@/lib/services/site-settings";
 import { clientIp, rateLimit } from "@/lib/rate-limit";
 
@@ -25,12 +27,14 @@ export async function requireStaff(): Promise<StaffUser> {
   const session = await auth();
   if (!session?.user?.id) redirect("/login");
   const minRank = await getMinStaffRank();
-  if (!isStaff(session.user.rank, minRank)) redirect("/");
-  return {
-    id: Number(session.user.id),
-    rank: session.user.rank,
-    username: session.user.name ?? "",
-  };
+  const staff = await resolveStaffUser(session.user.id, minRank, (id) =>
+    prisma.user.findUnique({
+      where: { id },
+      select: { id: true, rank: true, username: true },
+    }),
+  );
+  if (!staff) redirect("/");
+  return staff;
 }
 
 /**