fix: complete acl management

src/app/api/admin/permissions/roles/route.ts

@@ -0,0 +1,31 @@
+import { revalidateTag } from 'next/cache'
+import { NextResponse } from 'next/server'
+import { withAdmin } from '@/lib/api-handler'
+import { apiError } from '@/lib/api-response'
+import { PERMS } from '@/lib/permissions'
+import { prisma } from '@/lib/prisma'
+
+export const POST = withAdmin({ permission: PERMS.PERMISSIONS_MANAGE }, async (request) => {
+  const body = await request.json()
+  const slug = String(body.slug ?? '').trim().toLowerCase()
+  const title = String(body.title ?? '').trim()
+  if (!/^[a-z0-9._-]{2,64}$/.test(slug) || !title) return apiError('Valid slug and title required', 400)
+  const role = await prisma.aclRole.create({ data: { slug, title } })
+  revalidateTag('permissions', { expire: 0 })
+  return NextResponse.json({ role })
+})
+
+export const DELETE = withAdmin({ permission: PERMS.PERMISSIONS_MANAGE }, async (request) => {
+  const id = Number(request.nextUrl.searchParams.get('id'))
+  if (!Number.isInteger(id) || id <= 0) return apiError('Valid ID required', 400)
+  const role = await prisma.aclRole.findUnique({ where: { id }, select: { slug: true } })
+  if (!role) return apiError('Role not found', 404)
+  if (role.slug.startsWith('rank_')) return apiError('Rank roles must be managed through emulator ranks', 409)
+  await prisma.$transaction([
+    prisma.aclModelPermission.deleteMany({ where: { modelType: 'Role', modelId: id } }),
+    prisma.aclModelRole.deleteMany({ where: { roleId: id } }),
+    prisma.aclRole.delete({ where: { id } }),
+  ])
+  revalidateTag('permissions', { expire: 0 })
+  return NextResponse.json({ success: true })
+})