Finish fine-grained ACL across remaining admin pages and actions.

Replace leftover requireStaff gates with module PERMS, drop hardcoded room rank thresholds, and expand contract tests so admin mutations cannot regress to dashboard-only checks.

Co-authored-by: Cursor <[email protected]>

src/actions/admin-users.ts

@@ -1,7 +1,8 @@
 "use server";
 
 import { revalidatePath } from "next/cache";
-import { requireStaff, requireStaffRateLimited } from "@/lib/admin/guard";
+import { requirePermission, requirePermissionRateLimited } from "@/lib/admin/guard";
+import { PERMS } from "@/lib/permissions";
 import { prisma } from "@/lib/prisma";
 import { rcon } from "@/lib/services/rcon";
 import { type CurrencyName, sendCurrency } from "@/lib/services/send-currency";
@@ -15,7 +16,7 @@ const CURRENCIES: ReadonlySet<string> = new Set([
 ]);
 
 export async function giveCurrency(formData: FormData): Promise<void> {
-	const staff = await requireStaffRateLimited();
+	const staff = await requirePermissionRateLimited(PERMS.USERS_EDIT);
 	const userId = Number(formData.get("userId"));
 	const type = String(formData.get("type"));
 	const amount = Number(formData.get("amount"));
@@ -38,7 +39,7 @@ export async function giveCurrency(formData: FormData): Promise<void> {
 }
 
 export async function setMotto(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermission(PERMS.USERS_EDIT);
 	const userId = Number(formData.get("userId"));
 	const motto = String(formData.get("motto") ?? "")
 		.normalize("NFC")
@@ -51,7 +52,7 @@ export async function setMotto(formData: FormData): Promise<void> {
 }
 
 export async function setRank(formData: FormData): Promise<void> {
-	const staff = await requireStaffRateLimited();
+	const staff = await requirePermissionRateLimited(PERMS.USERS_EDIT);
 	const userId = Number(formData.get("userId"));
 	const rank = Number(formData.get("rank"));
 	if (userId > 0 && rank > 0) {
@@ -69,7 +70,7 @@ export async function setRank(formData: FormData): Promise<void> {
 }
 
 export async function alertUser(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermission(PERMS.USERS_EDIT);
 	const userId = Number(formData.get("userId"));
 	const message = String(formData.get("message") ?? "")
 		.normalize("NFC")
@@ -78,7 +79,7 @@ export async function alertUser(formData: FormData): Promise<void> {
 }
 
 export async function disconnectUser(formData: FormData): Promise<void> {
-	await requireStaff();
+	await requirePermission(PERMS.USERS_EDIT);
 	const userId = Number(formData.get("userId"));
 	const username = String(formData.get("username") ?? "").normalize("NFC");
 	if (userId > 0) await rcon.disconnectUser(userId, username);