Finish fine-grained ACL across remaining admin pages and actions.

Replace leftover requireStaff gates with module PERMS, drop hardcoded room rank thresholds, and expand contract tests so admin mutations cannot regress to dashboard-only checks. Co-authored-by: Cursor <[email protected]>
2026-07-15 20:15:22 +02:00
parent 3c8a8ff888
commit 0e89d03940
63 changed files with 420 additions and 163 deletions
@@ -84,7 +84,7 @@ export default async function RoomFurniPage({
 					ownerUsername: room.owner?.username ?? room.ownerName,
 				}}
 				items={rows}
-				canEdit={session.user.rank >= 4}
+				canEdit={canAccess(permissions, PERMS.ROOMS_EDIT, session.user.rank)}
 			/>
 		</div>
 	);