feat(admin): ACL repair, mod users, ticket clarity, ops online hub

Add Repair nav grants on permissions, /mod/users without email/IP, shared ticket queue banners, and shared online roster on CommandoCentrum.

Co-authored-by: Cursor <[email protected]>

src/lib/admin/guard.ts

@@ -70,6 +70,7 @@ export async function requireMod(): Promise<StaffUser> {
 		canAccess(permissions, PERMS.MOD_BANS_VIEW, session.user.rank) ||
 		canAccess(permissions, PERMS.MOD_TICKETS_VIEW, session.user.rank) ||
 		canAccess(permissions, PERMS.MOD_TEAM_VIEW, session.user.rank) ||
+		canAccess(permissions, PERMS.MOD_USERS_VIEW, session.user.rank) ||
 		canAccess(permissions, PERMS.TICKETS_VIEW, session.user.rank);
 	if (!ok) redirectSafe("/", "/");
 	return {

src/lib/admin/ops-online-users.ts

@@ -0,0 +1,35 @@
+import type { OnlineUser } from "@/components/admin/dashboard";
+import { prisma } from "@/lib/prisma";
+
+/** Shared online roster used by CommandoCentrum (and linked from other ops hubs). */
+export async function fetchOpsOnlineUsers(
+	limit = 40,
+): Promise<{ count: number; users: OnlineUser[] }> {
+	const [count, onlineUsersRaw] = await Promise.all([
+		prisma.user.count({ where: { online: "1" } }).catch(() => 0),
+		prisma.user
+			.findMany({
+				where: { online: "1" },
+				select: {
+					id: true,
+					username: true,
+					look: true,
+					lastOnline: true,
+				},
+				orderBy: { lastOnline: "desc" },
+				take: limit,
+			})
+			.catch(() => []),
+	]);
+
+	const users: OnlineUser[] = onlineUsersRaw.map((u) => ({
+		id: u.id,
+		username: u.username,
+		look: u.look,
+		roomId: null,
+		roomName: null,
+		lastActivity: u.lastOnline > 0 ? new Date(u.lastOnline * 1000) : new Date(),
+	}));
+
+	return { count, users };
+}