fix: authorize super admins by dynamic highest rank

src/lib/admin/authorization-policy.ts

@@ -0,0 +1,22 @@
+export interface AuthorizationActor { id: number; username: string; rank: number }
+export type AuthorizationDenialReason = "invalid_rank" | "permission_denied" | "no_ranks";
+export type AuthorizationDecision =
+  | { allowed: true; superAdmin: boolean }
+  | { allowed: false; reason: AuthorizationDenialReason };
+
+export function isDynamicSuperAdmin(rank: number, highestRank: number | null): boolean {
+  return Number.isInteger(rank) && rank > 0 && highestRank !== null && rank === highestRank;
+}
+
+export function decideAuthorization(input: {
+  actor: AuthorizationActor;
+  highestRank: number | null;
+  permission?: string;
+  hasPermission: boolean;
+}): AuthorizationDecision {
+  if (!Number.isInteger(input.actor.rank) || input.actor.rank <= 0) return { allowed: false, reason: "invalid_rank" };
+  if (input.highestRank === null) return { allowed: false, reason: "no_ranks" };
+  if (isDynamicSuperAdmin(input.actor.rank, input.highestRank)) return { allowed: true, superAdmin: true };
+  if (!input.permission || input.hasPermission) return { allowed: true, superAdmin: false };
+  return { allowed: false, reason: "permission_denied" };
+}