Remco/EpicNext-Cms
2
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

Finish fine-grained ACL across remaining admin pages and actions.

Browse Source 
Replace leftover requireStaff gates with module PERMS, drop hardcoded room rank thresholds, and expand contract tests so admin mutations cannot regress to dashboard-only checks.

Co-authored-by: Cursor <[email protected]>
This commit is contained in:
simoleo89
2026-07-15 20:15:22 +02:00
co-authored by Cursor
parent 3c8a8ff888
commit 0e89d03940
63 changed files with 420 additions and 163 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/actions/admin-ads.ts
+5 -4
View File
@@ -2,7 +2,8 @@
import { revalidatePath } from "next/cache";
import { redirect } from "next/navigation";
import { requireStaff } from "@/lib/admin/guard";
import { requirePermission } from "@/lib/admin/guard";
import { PERMS } from "@/lib/permissions";
import { formPositiveBigInt } from "@/lib/form-data";
import { prisma } from "@/lib/prisma";
import { logStaffActivity } from "@/lib/services/staff-activity";
@@ -11,7 +12,7 @@ import { logStaffActivity } from "@/lib/services/staff-activity";
// table; it only stores an image URL rendered in the site layout/widgets.
export async function createAd(formData: FormData): Promise<void> {
const staff = await requireStaff();
const staff = await requirePermission(PERMS.PAGES_EDIT);
const image = String(formData.get("image") ?? "")
.normalize("NFC")
.trim()
@@ -39,7 +40,7 @@ export async function createAd(formData: FormData): Promise<void> {
}
export async function updateAd(formData: FormData): Promise<void> {
const staff = await requireStaff();
const staff = await requirePermission(PERMS.PAGES_EDIT);
const raw = String(formData.get("id") ?? "").normalize("NFC");
if (!/^\d+$/.test(raw)) return;
const id = BigInt(raw);
@@ -70,7 +71,7 @@ export async function updateAd(formData: FormData): Promise<void> {
}
export async function deleteAd(formData: FormData): Promise<void> {
const staff = await requireStaff();
const staff = await requirePermission(PERMS.PAGES_EDIT);
const id = formPositiveBigInt(formData, "id");
if (!id) return;