fix(admin): P0 integrity — permanent bans, ACL sidebar, rank guards

Co-authored-by: Cursor <[email protected]>

src/app/api/admin/import/furni/upload/route.ts

@@ -5,7 +5,7 @@ import { logAudit } from "@/lib/services/audit";
 import { uploadSingleFurni } from "@/lib/services/upload-import";
 
 export const POST = withAdmin(
-	{ permission: PERMS.ASSETS_IMPORT },
+	{ permission: PERMS.ASSETS_IMPORT, maxBodyBytes: 52 * 1024 * 1024 },
 	async (request, ctx) => {
 		const formData = await request.formData();
 

src/app/api/admin/users/actions/route.ts

@@ -9,6 +9,7 @@ export const POST = withAdmin(
 	{ permission: PERMS.USERS_EDIT },
 	async (request, context) => {
 		const staffId = context.session.user.id;
+		const staffRank = context.session.user.rank;
 		const formData = await request.formData();
 		const userId = Number(formData.get("userId"));
 		const username = String(formData.get("username") || "");
@@ -23,13 +24,56 @@ export const POST = withAdmin(
 
 		if (action === "set_rank") {
 			const rank = Number(formData.get("rank") || "0");
-			if (!rank || rank < 0 || rank > 10) {
+			if (!Number.isInteger(rank) || rank < 1) {
 				return NextResponse.json(
 					{ success: false, message: "Invalid rank value" },
 					{ status: 400 },
 				);
 			}
 
+			const rankExists = await prisma.$queryRaw<{ id: number }[]>`
+				SELECT id FROM permission_ranks WHERE id = ${rank} LIMIT 1
+			`.catch(() => [] as { id: number }[]);
+			if (rankExists.length === 0) {
+				return NextResponse.json(
+					{ success: false, message: "Rank does not exist" },
+					{ status: 400 },
+				);
+			}
+
+			const target = await prisma.user.findUnique({
+				where: { id: userId },
+				select: { rank: true },
+			});
+			if (!target) {
+				return NextResponse.json(
+					{ success: false, message: "User not found" },
+					{ status: 404 },
+				);
+			}
+
+			const isSuper = context.permissions.isSuperAdmin;
+			if (!isSuper) {
+				if (target.rank >= staffRank) {
+					return NextResponse.json(
+						{
+							success: false,
+							message: "Cannot change rank of a user at or above your rank",
+						},
+						{ status: 403 },
+					);
+				}
+				if (rank >= staffRank) {
+					return NextResponse.json(
+						{
+							success: false,
+							message: "Cannot set a rank equal to or above your own",
+						},
+						{ status: 403 },
+					);
+				}
+			}
+
 			await prisma.user.update({ where: { id: userId }, data: { rank } });
 			await rcon.setRank(userId, rank);
 			await logStaffActivity({