Harden admin ACL on critical write paths.

Gate translations, RCON, and user mutations on SETTINGS_EDIT, RCON_EXECUTE, and USERS_EDIT instead of dashboard/rank checks; redirect the legacy user-edit URL to the guarded canonical page.

Co-authored-by: Cursor <[email protected]>

src/actions/translations.ts

@@ -9,6 +9,7 @@ import {
 	getClientTranslationFile,
 } from "@/lib/client-translation-files";
 import { patchJson5 } from "@/lib/json5-patch";
+import { PERMS } from "@/lib/permissions";
 import { adminAction } from "@/lib/safe-action";
 import { ActionError, actionOk } from "@/lib/safe-action-shared";
 
@@ -41,10 +42,8 @@ const saveTranslationsSchema = z.object({
 });
 
 export const saveTranslations = adminAction(
-	{ schema: saveTranslationsSchema },
+	{ permission: PERMS.SETTINGS_EDIT, schema: saveTranslationsSchema },
 	async (ctx) => {
-		if (ctx.session.user.rank < 7) throw new ActionError("Forbidden");
-
 		const filePath = path.join(
 			process.cwd(),
 			"messages",
@@ -68,10 +67,8 @@ const saveClientTranslationsSchema = z.object({
 });
 
 export const saveClientTranslations = adminAction(
-	{ schema: saveClientTranslationsSchema },
+	{ permission: PERMS.SETTINGS_EDIT, schema: saveClientTranslationsSchema },
 	async (ctx) => {
-		if (ctx.session.user.rank < 7) throw new ActionError("Forbidden");
-
 		const file = getClientTranslationFile(ctx.data.fileId);
 		if (!file) throw new ActionError("Unknown file");
 		if (file.readOnly) throw new ActionError("File is read-only");