Finish fine-grained ACL across remaining admin pages and actions.

Replace leftover requireStaff gates with module PERMS, drop hardcoded room rank thresholds, and expand contract tests so admin mutations cannot regress to dashboard-only checks.

Co-authored-by: Cursor <[email protected]>

src/actions/bulk-users.ts

@@ -1,6 +1,7 @@
 "use server";
 
-import { requireStaff } from "@/lib/admin/guard";
+import { requirePermission } from "@/lib/admin/guard";
+import { PERMS } from "@/lib/permissions";
 import { prisma } from "@/lib/prisma";
 import type { ActionResult } from "@/lib/safe-action-shared";
 import { rcon } from "@/lib/services/rcon";
@@ -11,7 +12,7 @@ export async function bulkUnban({
 }: {
 	userIds: number[];
 }): Promise<ActionResult<{ unbanned: number; total: number }>> {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.USERS_EDIT);
 	const result = await prisma.ban.deleteMany({
 		where: { userId: { in: userIds } },
 	});
@@ -36,7 +37,7 @@ export async function bulkBan({
 	reason: string;
 	duration: number;
 }): Promise<ActionResult<{ banned: number }>> {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.USERS_EDIT);
 	const now = Math.floor(Date.now() / 1000);
 	let banned = 0;
 
@@ -84,7 +85,7 @@ export async function bulkGiveCurrency({
 		failedIds: Array<{ userId: number; reason: string }>;
 	}>
 > {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.USERS_EDIT);
 	let given = 0;
 	const failedIds: Array<{ userId: number; reason: string }> = [];
 
@@ -142,7 +143,7 @@ export async function bulkGiveBadge({
 		failedIds: Array<{ userId: number; reason: string }>;
 	}>
 > {
-	const staff = await requireStaff();
+	const staff = await requirePermission(PERMS.USERS_EDIT);
 	let given = 0;
 	const failedIds: Array<{ userId: number; reason: string }> = [];