@7365admin1/core 3.53.1 → 3.53.3

package/dist/index.js

@@ -6246,6 +6246,7 @@ __export(src_exports, {
   resolveHidPhysicalCardValue: () => resolveHidPhysicalCardValue,
   resolveInviteActor: () => resolveInviteActor,
   resolveSiteTimezone: () => resolveSiteTimezone,
+  resolveStaffRole: () => resolveStaffRole,
   robotSchema: () => robotSchema,
   rtspUrl: () => rtspUrl,
   schema: () => schema,
@@ -10926,39 +10927,28 @@ var import_mongodb15 = require("mongodb");
 var import_node_server_utils15 = require("@7365admin1/node-server-utils");
 var import_mongodb14 = require("mongodb");
 var LIVE_ROLE = { status: { $ne: "deleted" } };
-async function isSuperAdmin(userId) {
+async function resolveStaffRole(userId) {
   const id = userId?.toString() ?? "";
   if (!id || !import_mongodb14.ObjectId.isValid(id))
-    return false;
+    return null;
   const db2 = import_node_server_utils15.useAtlas.getDb();
   if (!db2)
-    return false;
+    return null;
   const member = await db2.collection("members").findOne({
     user: new import_mongodb14.ObjectId(id),
     type: "admin",
     status: { $ne: "deleted" }
   });
   if (!member?.role || !import_mongodb14.ObjectId.isValid(member.role.toString()))
-    return false;
+    return null;
   const role = await db2.collection("roles").findOne({ _id: new import_mongodb14.ObjectId(member.role.toString()), ...LIVE_ROLE });
-  return role?.type === "admin";
+  return role?.type === "admin" ? role : null;
+}
+async function isSuperAdmin(userId) {
+  return await resolveStaffRole(userId) !== null;
 }
 async function isPlatformOwner(userId) {
-  const id = userId?.toString() ?? "";
-  if (!id || !import_mongodb14.ObjectId.isValid(id))
-    return false;
-  const db2 = import_node_server_utils15.useAtlas.getDb();
-  if (!db2)
-    return false;
-  const member = await db2.collection("members").findOne({
-    user: new import_mongodb14.ObjectId(id),
-    type: "admin",
-    status: { $ne: "deleted" }
-  });
-  if (!member?.role || !import_mongodb14.ObjectId.isValid(member.role.toString()))
-    return false;
-  const role = await db2.collection("roles").findOne({ _id: new import_mongodb14.ObjectId(member.role.toString()), ...LIVE_ROLE });
-  return role?.type === "admin" && role?.default === true;
+  return (await resolveStaffRole(userId))?.default === true;
 }
 
 // src/utils/org-suspension.util.ts
@@ -16836,6 +16826,8 @@ var MFile = class {
     this.size = value.size ?? 0;
     this.status = value.status ?? "draft";
     this.createdAt = value.createdAt ?? (/* @__PURE__ */ new Date()).toISOString();
+    if (value.createdBy)
+      this.createdBy = value.createdBy.toString();
   }
 };
 
@@ -18659,32 +18651,127 @@ function usePersonRepo() {
 
 // src/utils/console-authz.util.ts
 var import_node_server_utils42 = require("@7365admin1/node-server-utils");
+
+// src/utils/console-permission.util.ts
+var CONSOLE_PERMISSIONS = Object.freeze({
+  organizations: Object.freeze([
+    "see-all-organizations",
+    "see-organization-details"
+  ]),
+  "promo-codes": Object.freeze([
+    "create-promo-code",
+    "see-promo-code-details",
+    "edit-promo-code-details",
+    "change-promo-code-status",
+    "delete-promo-code"
+  ]),
+  users: Object.freeze(["see-all-users", "see-user-details"]),
+  invitations: Object.freeze([
+    "create-invitation",
+    "view-invitations",
+    "cancel-invitation"
+  ]),
+  subscriptions: Object.freeze([
+    "see-all-subscriptions",
+    "see-subscription-details",
+    "manage-subscription"
+  ]),
+  "sp-approvals": Object.freeze([
+    "see-all-sp-approvals",
+    "approve-sp",
+    "reject-sp",
+    "delete-sp-approval"
+  ]),
+  "marketplace-vendors": Object.freeze([
+    "see-all-marketplace-vendors",
+    "see-marketplace-vendor-details"
+  ]),
+  "platform-terms": Object.freeze([
+    "see-platform-terms",
+    "edit-platform-terms"
+  ]),
+  "activity-history": Object.freeze(["see-activity-history"]),
+  members: Object.freeze([
+    "view-members",
+    "assign-member-role",
+    "suspend-member",
+    "activate-member",
+    "delete-member"
+  ]),
+  "roles-and-permissions": Object.freeze([
+    "add-role",
+    "see-all-roles",
+    "see-role-details",
+    "update-role",
+    "delete-role"
+  ])
+});
+var RESOURCE_SPELLINGS = Object.freeze({
+  "roles-and-permissions": Object.freeze([
+    "roles-and-permissions",
+    "roles"
+  ]),
+  roles: Object.freeze(["roles", "roles-and-permissions"])
+});
+function consoleSpellings(resource, action) {
+  const resources = RESOURCE_SPELLINGS[resource] ?? [resource];
+  return resources.map((name) => `${name}:${action}`);
+}
+function consoleRoleAllowsAll(held) {
+  if (!Array.isArray(held) || held.length === 0)
+    return true;
+  return held.includes("*");
+}
+function consoleRoleAllows(held, resource, action) {
+  if (consoleRoleAllowsAll(held))
+    return true;
+  const actions = CONSOLE_PERMISSIONS[resource];
+  if (!actions?.length)
+    return false;
+  const wanted = action ? actions.includes(action) ? [action] : [] : actions;
+  return wanted.some(
+    (name) => consoleSpellings(resource, name).some(
+      (spelling) => held.includes(spelling)
+    )
+  );
+}
+
+// src/utils/console-authz.util.ts
 function callerId(req) {
   const user = req.user;
   return user?.user?.toString?.() || user?._id?.toString?.() || "";
 }
-async function requirePlatformStaff(req) {
+async function requirePlatformStaff(req, grant) {
   const id = callerId(req);
-  if (!id || !await isSuperAdmin(id)) {
+  const role = id ? await resolveStaffRole(id) : null;
+  if (!role) {
+    throw new import_node_server_utils42.UnauthorizedError("Not authorized.");
+  }
+  if (grant && !consoleRoleAllows(role.permissions, grant.resource, grant.action)) {
     throw new import_node_server_utils42.UnauthorizedError("Not authorized.");
   }
   return id;
 }
-async function requireSelfOrPlatformStaff(req, userId) {
+async function requireConsolePermission(req, resource, action) {
+  return await requirePlatformStaff(req, { resource, action });
+}
+async function requireSelfOrPlatformStaff(req, userId, grant) {
   const id = callerId(req);
   const target = userId?.toString() ?? "";
   if (id && target && target === id)
     return id;
-  return await requirePlatformStaff(req);
+  return await requirePlatformStaff(req, grant);
 }
 async function requireOrgAccess(req, orgId) {
   return await requireOrgReach(req, orgId);
 }
-async function requirePlatformOwner(req) {
+async function requirePlatformOwner(req, grant) {
   const id = callerId(req);
   if (!id || !await isPlatformOwner(id)) {
     throw new import_node_server_utils42.UnauthorizedError("Not authorized.");
   }
+  if (grant)
+    await requirePlatformStaff(req, grant);
   return id;
 }
 async function requireOrgReach(req, orgId) {
@@ -18711,10 +18798,10 @@ async function requireInviteReach(req, org, app) {
   if (org)
     await requireOrgReach(req, org);
 }
-async function requireUserFieldWrite(req, userId, field) {
+async function requireUserFieldWrite(req, userId, field, grant) {
   if (field === "email")
-    return await requirePlatformStaff(req);
-  return await requireSelfOrPlatformStaff(req, userId);
+    return await requirePlatformStaff(req, grant);
+  return await requireSelfOrPlatformStaff(req, userId, grant);
 }
 
 // src/utils/user-response.util.ts
@@ -18754,7 +18841,7 @@ function useUserController() {
       return;
     }
     try {
-      await requireSelfOrPlatformStaff(req, _id);
+      await requireSelfOrPlatformStaff(req, _id, { resource: "users", action: "see-user-details" });
       const user = await _getById(_id);
       res.json(user);
       return;
@@ -18839,7 +18926,7 @@ function useUserController() {
     const page = parseInt(req.query.page ?? "1");
     const status = req.query.status ?? "active";
     try {
-      await requirePlatformStaff(req);
+      await requireConsolePermission(req, "users", "see-all-users");
       const data = await _getUsers({ search, page, status });
       res.json(data);
       return;
@@ -18934,7 +19021,7 @@ function useUserController() {
       return;
     }
     try {
-      await requireSelfOrPlatformStaff(req, _id);
+      await requireSelfOrPlatformStaff(req, _id, { resource: "users" });
       const message = await _updateBirthday({ _id, ...payload });
       res.json({ message });
       return;
@@ -18976,7 +19063,7 @@ function useUserController() {
       return;
     }
     try {
-      await requireUserFieldWrite(req, _id, payload.field);
+      await requireUserFieldWrite(req, _id, payload.field, { resource: "users" });
       let message;
       if (payload.field === "plateNumber") {
         message = await updatePlateNumberByUserId(
@@ -19018,7 +19105,7 @@ function useUserController() {
     const newPassword = req.body.newPassword ?? "";
     const passwordConfirmation = req.body.passwordConfirmation ?? "";
     try {
-      await requireSelfOrPlatformStaff(req, _id);
+      await requireSelfOrPlatformStaff(req, _id, { resource: "users" });
       await _updatePasswordById(
         _id,
         currentPassword,
@@ -19118,7 +19205,7 @@ function useRoleService() {
 async function requireRoleOrg(req, org) {
   const orgId = org?.toString() ?? "";
   if (!orgId) {
-    await requirePlatformStaff(req);
+    await requireConsolePermission(req, "roles-and-permissions");
     return;
   }
   await requireOrgAccess(req, orgId);
@@ -19160,7 +19247,7 @@ function useRoleController() {
     }
     try {
       if (payload.type === PLATFORM_STAFF_ROLE_TYPE) {
-        await requirePlatformStaff(req);
+        await requireConsolePermission(req, "roles-and-permissions", "add-role");
       }
       if (payload.org) {
         await requireOrgReach(req, payload.org);
@@ -22532,13 +22619,14 @@ function useFileService() {
     bucket: SPACES_BUCKET,
     forcePathStyle: true
   });
-  async function createFile(value, folder = "default") {
+  async function createFile(value, folder = "default", createdBy) {
     const session = import_node_server_utils51.useAtlas.getClient()?.startSession();
     session?.startTransaction();
     const file = {
       name: value.originalname,
       size: value.size ?? (value.buffer ? value.buffer.length : 0),
-      createdAt: (/* @__PURE__ */ new Date()).toISOString()
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      ...createdBy ? { createdBy } : {}
     };
     try {
       const id = await _createFile(file, session);
@@ -26748,7 +26836,7 @@ async function entitledSites(req) {
 async function requireMemberOrg(req, org) {
   const orgId = org?.toString() ?? "";
   if (!orgId) {
-    await requirePlatformStaff(req);
+    await requireConsolePermission(req, "members");
     return;
   }
   await requireOrgAccess(req, orgId);
@@ -26795,7 +26883,7 @@ function useMemberController() {
       return;
     }
     try {
-      await requireSelfOrPlatformStaff(req, userId);
+      await requireSelfOrPlatformStaff(req, userId, { resource: "members", action: "view-members" });
       const data = await _getByUserId(userId);
       res.json(data);
       return;
@@ -26845,7 +26933,7 @@ function useMemberController() {
     const user = req.params.id;
     const type = req.params.type;
     try {
-      await requireSelfOrPlatformStaff(req, user);
+      await requireSelfOrPlatformStaff(req, user, { resource: "members", action: "view-members" });
       const data = await _getByUserIdType(user, type);
       res.json(data);
       return;
@@ -26891,11 +26979,11 @@ function useMemberController() {
     }
     try {
       if (type === "admin") {
-        await requirePlatformStaff(req);
+        await requireConsolePermission(req, "members", "view-members");
       } else if (org) {
         await requireOrgAccess(req, org);
       } else if (user && user !== callerId(req)) {
-        await requirePlatformStaff(req);
+        await requireConsolePermission(req, "users", "see-all-users");
       }
       const items = await _getAll({
         search,
@@ -27090,7 +27178,7 @@ function useMemberController() {
     const type = req.params.type;
     const org = req.query.org;
     try {
-      await requireSelfOrPlatformStaff(req, user);
+      await requireSelfOrPlatformStaff(req, user, { resource: "members", action: "view-members" });
       const data = await _getByUserIdTypeOrg(
         user,
         type,
@@ -27624,6 +27712,49 @@ function useVerificationController() {
 // src/controllers/file.controller.ts
 var import_node_server_utils59 = require("@7365admin1/node-server-utils");
 var import_joi27 = __toESM(require("joi"));
+
+// src/utils/file-owner.util.ts
+function fileOwnerId(file) {
+  return file?.createdBy?.toString?.() ?? "";
+}
+function mayDeleteFile(params) {
+  if (!params.ownerId)
+    return true;
+  if (!params.callerId)
+    return false;
+  if (params.callerId === params.ownerId)
+    return true;
+  if (params.callerIsSuperAdmin)
+    return true;
+  const ownerOrgs = new Set((params.ownerOrgIds ?? []).map(String));
+  return (params.callerOrgIds ?? []).some((org) => ownerOrgs.has(String(org)));
+}
+
+// src/controllers/file.controller.ts
+async function requireFileDelete(req, file) {
+  const ownerId = fileOwnerId(file);
+  if (!ownerId)
+    return;
+  const caller = callerId(req);
+  if (!caller)
+    throw new import_node_server_utils59.UnauthorizedError("Not authorized.");
+  if (caller === ownerId)
+    return;
+  const [me, owner] = await Promise.all([
+    resolveInviteActor(caller),
+    resolveInviteActor(ownerId)
+  ]);
+  if (mayDeleteFile({
+    ownerId,
+    callerId: caller,
+    callerIsSuperAdmin: me.isSuperAdmin,
+    callerOrgIds: me.orgIds,
+    ownerOrgIds: owner.orgIds
+  })) {
+    return;
+  }
+  throw new import_node_server_utils59.UnauthorizedError("Not authorized.");
+}
 function useFileController() {
   const { createFile, deleteFile: _deleteFile } = useFileService();
   const { getFileById: _getFileById } = useFileRepo();
@@ -27633,7 +27764,7 @@ function useFileController() {
       return;
     }
     try {
-      const id = await createFile(req.file);
+      const id = await createFile(req.file, "default", callerId(req) || void 0);
       res.status(201).json({ message: "Successfully uploaded file", id });
       return;
     } catch (error) {
@@ -27652,6 +27783,7 @@ function useFileController() {
       return;
     }
     try {
+      await requireFileDelete(req, await _getFileById(_id));
       const message = await _deleteFile(_id);
       res.json({ message });
       return;
@@ -28881,7 +29013,7 @@ function useOrgController() {
       return;
     }
     try {
-      const createdBy = await requirePlatformStaff(req);
+      const createdBy = await requireConsolePermission(req, "organizations");
       await _add({ ...req.body, createdBy });
       res.status(201).json({ message: "Successfully created organization." });
       return;
@@ -28987,7 +29119,7 @@ function useOrgController() {
     const type = req.query.type ?? "";
     try {
       if (user !== callerId(req)) {
-        await requirePlatformStaff(req);
+        await requireConsolePermission(req, "organizations", "see-all-organizations");
       }
       const data = await getOrgsByMembership({
         search,
@@ -29014,7 +29146,7 @@ function useOrgController() {
       return;
     }
     try {
-      await requirePlatformStaff(req);
+      await requireConsolePermission(req, "organizations", "see-organization-details");
       const data = await _getByName(name);
       res.json(data);
       return;
@@ -29052,7 +29184,7 @@ function useOrgController() {
       return;
     }
     try {
-      await requirePlatformStaff(req);
+      await requireConsolePermission(req, "organizations", "see-organization-details");
       const data = await _getByEmail(email);
       if (!data) {
         next(new import_node_server_utils64.NotFoundError("Organization not found."));
@@ -29082,7 +29214,7 @@ function useOrgController() {
     try {
       const self = await _getUserById(callerId(req)).catch(() => null);
       if (!self?.email || self.email.toLowerCase() !== email.toLowerCase()) {
-        await requirePlatformStaff(req);
+        await requireConsolePermission(req, "organizations", "see-all-organizations");
       }
       const data = await _getOrgsByEmail(email);
       res.json(data);
@@ -29142,7 +29274,7 @@ function useOrgController() {
     const orgId = req.params.id;
     const { status } = req.body;
     try {
-      const ownerId = await requirePlatformOwner(req);
+      const ownerId = await requirePlatformOwner(req, { resource: "organizations" });
       await _updateStatusById(orgId, status);
       const subscription = await _getSubscriptionByOrgId(orgId);
       if (subscription) {
@@ -29213,7 +29345,7 @@ function useOrgControllerV2() {
     const nature = value.nature ?? "";
     const status = value.status;
     try {
-      await requirePlatformStaff(req);
+      await requireConsolePermission(req, "organizations", "see-all-organizations");
       const data = await _getAll({
         search,
         page,
@@ -29250,7 +29382,7 @@ function useOrgControllerV2() {
       return;
     }
     try {
-      await requirePlatformStaff(req);
+      await requireConsolePermission(req, "organizations", "see-all-organizations");
       const data = await _getOrganizationsWithSubscription({
         search: value.search ?? "",
         page: value.page ?? 1,
@@ -31712,7 +31844,7 @@ function useSubscriptionController() {
       return;
     }
     try {
-      await requirePlatformStaff(req);
+      await requireConsolePermission(req, "subscriptions", "manage-subscription");
       const id = await _add(payload);
       res.status(201).json({ message: "Successfully added subscription.", id });
       return;
@@ -31759,7 +31891,7 @@ function useSubscriptionController() {
     const page = parseInt(req.query.page ?? "1");
     const status = req.query.status ?? "active";
     try {
-      await requirePlatformStaff(req);
+      await requireConsolePermission(req, "subscriptions", "see-all-subscriptions");
       const data = await _getSubscriptions({ search, page, status });
       res.json(data);
       return;
@@ -31893,7 +32025,7 @@ function useSubscriptionController() {
   }
   async function createConsoleSubscription(req, res, next) {
     try {
-      const staffId = await requirePlatformStaff(req);
+      const staffId = await requireConsolePermission(req, "subscriptions", "manage-subscription");
       const form = await readConsoleForm(req);
       const existing = await _getByOrgId(form.orgId);
       if (existing && existing.status !== "ended") {
@@ -31939,7 +32071,7 @@ function useSubscriptionController() {
   }
   async function updateConsoleSubscription(req, res, next) {
     try {
-      const staffId = await requirePlatformStaff(req);
+      const staffId = await requireConsolePermission(req, "subscriptions", "manage-subscription");
       const form = await readConsoleForm(req);
       const existing = await _getByOrgId(form.orgId);
       if (!existing?._id) {
@@ -31979,7 +32111,7 @@ function useSubscriptionController() {
   }
   async function getConsoleSubscription(req, res, next) {
     try {
-      await requirePlatformStaff(req);
+      await requireConsolePermission(req, "subscriptions", "see-subscription-details");
       const orgId = req.params.id;
       if (!/^[0-9a-fA-F]{24}$/.test(orgId ?? "")) {
         throw new import_node_server_utils80.BadRequestError("That client could not be found.");
@@ -32048,7 +32180,7 @@ function useSubscriptionPlanController() {
       return;
     }
     try {
-      const staffId = await requirePlatformStaff(req);
+      const staffId = await requireConsolePermission(req, "subscriptions", "manage-subscription");
       const _id = await _add(req.body);
       const data = await _getById(_id);
       await recordConsoleAction({
@@ -32144,7 +32276,7 @@ function useSubscriptionPlanController() {
     }
     const id = req.params.id;
     try {
-      const staffId = await requirePlatformStaff(req);
+      const staffId = await requireConsolePermission(req, "subscriptions", "manage-subscription");
       const before = await _getById(id);
       await _update(id, req.body);
       const data = await _getById(id);
@@ -32176,7 +32308,7 @@ function useSubscriptionPlanController() {
     const id = req.params.id;
     const { status } = req.body;
     try {
-      const staffId = await requirePlatformStaff(req);
+      const staffId = await requireConsolePermission(req, "subscriptions", "manage-subscription");
       await _updateStatusById(id, status);
       const data = await _getById(id);
       await recordConsoleAction({
@@ -32317,7 +32449,7 @@ function usePromoCodeController() {
     payload.code = payload.code.trim().toUpperCase();
     payload.fixed_rate = parseInt(payload.fixed_rate ?? "0");
     try {
-      const staffId = await requirePlatformStaff(req);
+      const staffId = await requireConsolePermission(req, "promo-codes", "create-promo-code");
       const created = await _add(payload);
       await recordConsoleAction({
         action: "promo-code.created" /* PROMO_CODE_CREATED */,
@@ -32370,7 +32502,7 @@ function usePromoCodeController() {
       return;
     }
     try {
-      await requirePlatformStaff(req);
+      await requireConsolePermission(req, "promo-codes", "see-promo-code-details");
       const data = await _getById(_id);
       res.json(data);
       return;
@@ -32399,7 +32531,7 @@ function usePromoCodeController() {
     const limit = parseInt(req.query.limit ?? "10");
     const status = req.query.status ?? "active";
     try {
-      await requirePlatformStaff(req);
+      await requireConsolePermission(req, "promo-codes");
       const data = await _getPromoCodes({
         search,
         page,
@@ -32424,7 +32556,7 @@ function usePromoCodeController() {
       return;
     }
     try {
-      const staffId = await requirePlatformStaff(req);
+      const staffId = await requireConsolePermission(req, "promo-codes", "edit-promo-code-details");
       const before = await _getById(req.params.id);
       await _updateById(req.params.id, req.body);
       await recordConsoleAction({
@@ -32460,7 +32592,7 @@ function usePromoCodeController() {
       return;
     }
     try {
-      const staffId = await requirePlatformStaff(req);
+      const staffId = await requireConsolePermission(req, "promo-codes", "change-promo-code-status");
       await _updateStatusById(req.params.id, status.value.status);
       await recordConsoleAction({
         action: "promo-code.status-changed" /* PROMO_CODE_STATUS_CHANGED */,
@@ -32489,7 +32621,7 @@ function usePromoCodeController() {
       return;
     }
     try {
-      const staffId = await requirePlatformStaff(req);
+      const staffId = await requireConsolePermission(req, "promo-codes", "delete-promo-code");
       await _softDeleteById(req.params.id, staffId);
       await recordConsoleAction({
         action: "promo-code.removed" /* PROMO_CODE_REMOVED */,
@@ -86299,7 +86431,7 @@ function useUserControllerV2() {
       return;
     }
     try {
-      await requireSelfOrPlatformStaff(req, value);
+      await requireSelfOrPlatformStaff(req, value, { resource: "users", action: "see-user-details" });
       const user = await _getById(value);
       res.json(user);
       return;
@@ -86336,7 +86468,7 @@ function useUserControllerV2() {
     if (error)
       return rejectValidation(error, next);
     try {
-      await requirePlatformStaff(req);
+      await requireConsolePermission(req, "users", "see-all-users");
       const users = await _getUsers({
         search: value.search ?? "",
         page: value.page,
@@ -86461,7 +86593,7 @@ function useUserControllerV2() {
       return;
     }
     try {
-      await requireSelfOrPlatformStaff(req, _id);
+      await requireSelfOrPlatformStaff(req, _id, { resource: "users" });
       const message = await _updateBirthday({ _id, ...payload });
       res.json({ message });
       return;
@@ -86493,7 +86625,7 @@ function useUserControllerV2() {
       return;
     }
     try {
-      await requireUserFieldWrite(req, _id, payload.field);
+      await requireUserFieldWrite(req, _id, payload.field, { resource: "users" });
       const message = await _updateUserFieldById({ _id, ...payload });
       res.json({ message });
       return;
@@ -86524,7 +86656,7 @@ function useUserControllerV2() {
     const newPassword = req.body.newPassword ?? "";
     const passwordConfirmation = req.body.passwordConfirmation ?? "";
     try {
-      await requireSelfOrPlatformStaff(req, _id);
+      await requireSelfOrPlatformStaff(req, _id, { resource: "users" });
       await _updatePasswordById(
         _id,
         currentPassword,
@@ -86702,7 +86834,7 @@ function useRoleControllerV2() {
     }
     try {
       if (value.type === PLATFORM_STAFF_ROLE_TYPE) {
-        await requirePlatformStaff(req);
+        await requireConsolePermission(req, "roles-and-permissions", "add-role");
       }
       if (value.org) {
         await requireOrgReach(req, value.org);
@@ -91378,7 +91510,7 @@ function usePlatformTermsController() {
       return id;
     }
     if (staffMayRead) {
-      return await requirePlatformStaff(req);
+      return await requireConsolePermission(req, "platform-terms", "see-platform-terms");
     }
     throw new import_node_server_utils298.UnauthorizedError("Not authorized.");
   }
@@ -91470,7 +91602,7 @@ function usePlatformTermsController() {
       return;
     }
     try {
-      await requirePlatformStaff(req);
+      await requireConsolePermission(req, "platform-terms", "see-platform-terms");
       res.json(
         await _listAcceptance({
           version: value.version || null,
@@ -91502,7 +91634,7 @@ function usePlatformTermsController() {
       return;
     }
     try {
-      const staffId = await requirePlatformStaff(req);
+      const staffId = await requireConsolePermission(req, "platform-terms", "edit-platform-terms");
       const created = await _add({
         terms: value.terms,
         policies: value.policies,
@@ -91560,7 +91692,7 @@ function useConsoleAuditController() {
     }
     const to = value.to && value.to.length === 10 ? `${value.to}T23:59:59.999Z` : value.to;
     try {
-      await requirePlatformStaff(req);
+      await requireConsolePermission(req, "activity-history", "see-activity-history");
       res.json(
         await _list({
           org: value.org || "",
@@ -92223,6 +92355,7 @@ function useNotificationPreferenceController() {
   resolveHidPhysicalCardValue,
   resolveInviteActor,
   resolveSiteTimezone,
+  resolveStaffRole,
   robotSchema,
   rtspUrl,
   schema,