refactor(housekeeping): reuse request capability context

src/lib/admin/guard.test.ts

@@ -1,9 +1,14 @@
 // @ts-nocheck
 import { beforeEach, describe, expect, it, vi } from "vitest";
+import {
+	anyCapability,
+	type HousekeepingCapabilityContext,
+} from "@/features/housekeeping/foundation/contracts";
 import { redirectSafe } from "@/lib/foundation/security";
 import { canAccess, getAdminContext } from "@/lib/permissions";
 import { clientIp, rateLimit } from "@/lib/rate-limit";
 import {
+	requireHousekeepingCapability,
 	requireMod,
 	requireModPermission,
 	requirePermission,
@@ -70,6 +75,23 @@ describe("requirePermission", () => {
 	});
 });
 
+describe("requireHousekeepingCapability", () => {
+	it("reuses an already-created capability context without reloading permissions", async () => {
+		const context: HousekeepingCapabilityContext = {
+			actor: { id: 1, username: "admin", rank: 0 },
+			isSuperAdmin: false,
+			has: (slug) => slug === "admin.users.view",
+			hasAny: (...slugs) => slugs.includes("admin.users.view"),
+			hasAll: (...slugs) => slugs.every((slug) => slug === "admin.users.view"),
+		};
+
+		await expect(
+			requireHousekeepingCapability(anyCapability("admin.users.view"), context),
+		).resolves.toBe(context);
+		expect(getAdminContext).not.toHaveBeenCalled();
+	});
+});
+
 describe("requireMod", () => {
 	it("allows with MOD_DASHBOARD", async () => {
 		vi.mocked(getAdminContext).mockResolvedValue({