Finish fine-grained ACL across remaining admin pages and actions.

Replace leftover requireStaff gates with module PERMS, drop hardcoded room rank thresholds, and expand contract tests so admin mutations cannot regress to dashboard-only checks.

Co-authored-by: Cursor <[email protected]>

src/actions/catalog-items.ts

@@ -1,7 +1,8 @@
 "use server";
 
 import { revalidatePath } from "next/cache";
-import { requireStaff } from "@/lib/admin/guard";
+import { requirePermission } from "@/lib/admin/guard";
+import { PERMS } from "@/lib/permissions";
 import { prisma } from "@/lib/prisma";
 import { rcon } from "@/lib/services/rcon";
 import { logStaffActivity } from "@/lib/services/staff-activity";
@@ -23,7 +24,7 @@ export async function createCatalogItem(data: {
 	haveOffer: "0" | "1";
 	clubOnly: "0" | "1";
 }) {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.CATALOG_EDIT);
 	const created = await prisma.catalogItems.create({ data });
 	await rcon.updateCatalog();
 	await logStaffActivity({
@@ -38,7 +39,7 @@ export async function createCatalogItem(data: {
 }
 
 export async function deleteCatalogItems({ ids }: { ids: number[] }) {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.CATALOG_EDIT);
 	await prisma.catalogItems.deleteMany({ where: { id: { in: ids } } });
 	await rcon.updateCatalog();
 	await logStaffActivity({
@@ -58,7 +59,7 @@ export async function moveCatalogItems({
 	ids: number[];
 	targetPageId: number;
 }) {
-	await requireStaff();
+	await requirePermission(PERMS.CATALOG_EDIT);
 	await prisma.catalogItems.updateMany({
 		where: { id: { in: ids } },
 		data: { pageId: targetPageId },
@@ -73,7 +74,7 @@ export async function reorderCatalogItems({
 }: {
 	orders: Array<{ id: number; orderNumber: number }>;
 }) {
-	await requireStaff();
+	await requirePermission(PERMS.CATALOG_EDIT);
 	for (const { id, orderNumber } of orders) {
 		await prisma.catalogItems.update({ where: { id }, data: { orderNumber } });
 	}
@@ -91,7 +92,7 @@ export async function updateCatalogItem({
 	catalogFields: Record<string, unknown>;
 	baseItem?: { id: number; fields: Record<string, unknown> };
 }) {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.CATALOG_EDIT);
 	await prisma.catalogItems.update({
 		where: { id },
 		data: catalogFields as any,
@@ -119,7 +120,7 @@ export async function translateCatalogItems({
 }: {
 	items: Array<{ id: number; publicName: string; description: string }>;
 }) {
-	await requireStaff();
+	await requirePermission(PERMS.CATALOG_EDIT);
 	let namesUpdated = 0;
 	let descriptionsUpdated = 0;
 	let furniDataUpdated = 0;