Harden admin ACL on critical write paths.

Gate translations, RCON, and user mutations on SETTINGS_EDIT, RCON_EXECUTE, and USERS_EDIT instead of dashboard/rank checks; redirect the legacy user-edit URL to the guarded canonical page.

Co-authored-by: Cursor <[email protected]>

src/lib/admin/guard.ts

@@ -22,6 +22,23 @@ export async function requireStaff(): Promise<StaffUser> {
 	};
 }
 
+/**
+ * Staff gate plus a specific ACL slug. Use for FormData server actions that
+ * must not stop at admin.dashboard alone (RCON, user edits, settings writes).
+ */
+export async function requirePermission(permission: string): Promise<StaffUser> {
+	const { session, permissions } = await getAdminContext();
+	if (!canAccess(permissions, PERMS.ADMIN_DASHBOARD, session.user.rank))
+		redirectSafe("/", "/");
+	if (!canAccess(permissions, permission, session.user.rank))
+		redirectSafe("/admin", "/admin");
+	return {
+		id: session.user.id,
+		rank: session.user.rank,
+		username: session.user.username,
+	};
+}
+
 export async function requireStaffRateLimited(): Promise<StaffUser> {
 	const staff = await requireStaff();
 	const ip = await clientIp();