@acms-subir/core 0.3.12 → 0.3.13

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @acms-subir/core
 
+## 0.3.13
+
+### Patch Changes
+
+- 0cea2b7: Team → Roles: owners choose what each role can do, with Save, Discard, Review and Restore defaults. Defaults keep today's access; administrators can now invite people (to roles below their own). Permissions apply on everyone's next request in the web admin and the editor app, and every save is recorded. Adds migration 51.
+
 ## 0.3.12
 
 ### Patch Changes

package/cli/migrations.generated.mjs

@@ -229,6 +229,20 @@ var PLACES_MIGRATION = { version: 43, statements: [
   `ALTER TABLE resources ADD COLUMN place_id TEXT NOT NULL DEFAULT ''`
 ] };
 
+// src/lib/permissions/migration.ts
+var ROLES_MIGRATION = {
+  version: 51,
+  statements: [
+    `CREATE TABLE role_policy (id INTEGER PRIMARY KEY CHECK (id = 1), overrides TEXT NOT NULL DEFAULT '{}', revision INTEGER NOT NULL DEFAULT 0,
+      updated_by TEXT NOT NULL DEFAULT '', updated_at INTEGER NOT NULL DEFAULT 0)`,
+    `INSERT INTO role_policy (id) VALUES (1)`,
+    `CREATE TABLE role_policy_log (id TEXT PRIMARY KEY, revision INTEGER NOT NULL, actor TEXT NOT NULL, changes TEXT NOT NULL, created_at INTEGER NOT NULL)`,
+    `CREATE INDEX role_policy_log_created ON role_policy_log(created_at)`,
+    `ALTER TABLE auth_invitations ADD COLUMN invited_by TEXT NOT NULL DEFAULT ''`,
+    `ALTER TABLE email_tokens ADD COLUMN invited_by TEXT NOT NULL DEFAULT ''`
+  ]
+};
+
 // src/lib/repo/migrations.ts
 var CONTENT_VERSION_COLUMNS = {
   settings: [
@@ -968,7 +982,8 @@ var MIGRATIONS = [
     `CREATE TABLE backup_state (id INTEGER PRIMARY KEY CHECK (id = 1), last_at INTEGER NOT NULL DEFAULT 0, lease_until INTEGER NOT NULL DEFAULT 0,
       last_key TEXT NOT NULL DEFAULT '', last_error TEXT NOT NULL DEFAULT '', failed_at INTEGER NOT NULL DEFAULT 0)`,
     `INSERT INTO backup_state (id) VALUES (1)`
-  ] }
+  ] },
+  ROLES_MIGRATION
 ];
 var LATEST_VERSION = MIGRATIONS[MIGRATIONS.length - 1].version;
 

package/integration.mjs

@@ -77,8 +77,10 @@ const ROUTES = [
   ['/admin/import', 'admin/import.astro'],
   ['/admin/tags', 'admin/tags.astro'],
   ['/admin/users', 'admin/users.astro'],
+  ['/admin/roles', 'admin/roles.astro'],
   // API
   ['/api/backup', 'api/backup.ts'],
+  ['/api/roles', 'api/roles.ts'],
   ['/api/drafts', 'api/drafts.ts'],
   ['/api/ai/settings', 'api/ai/settings.ts'],
   ['/api/ai/test', 'api/ai/test.ts'],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acms-subir/core",
-  "version": "0.3.12",
+  "version": "0.3.13",
   "publishConfig": {
     "access": "public"
   },

package/src/actions/index.ts

@@ -8,6 +8,8 @@ import type { ActionAPIContext } from 'astro:actions';
 import { getRepo } from '../lib/repo';
 import { getMediaStore } from '../lib/media/store';
 import { validateRequestSession } from '../lib/auth/request';
+import { accessFor } from '../lib/permissions/access';
+import { deniedMessage, type Permission } from '../lib/permissions/catalog';
 import { DocTranslations, LinkKind, parseConfig, slugify, widgetTypes, type WidgetType } from '../lib/schema';
 import { env } from '../lib/env';
 import { CONTENT, collectionUrl } from '../lib/content';
@@ -54,6 +56,13 @@ async function requireAdmin(ctx: ActionAPIContext) {
     throw new ActionError({ code: 'UNAUTHORIZED', message: 'Not signed in.' });
   }
 }
+// …and that their role grants the permission (Team → Roles)
+async function requireCan(ctx: ActionAPIContext, permission: Permission) {
+  const access = await accessFor(ctx.request, ctx.cookies, await getRepo(ctx.locals));
+  if (!access) throw new ActionError({ code: 'UNAUTHORIZED', message: 'Not signed in.' });
+  if (!access.can(permission)) throw new ActionError({ code: 'FORBIDDEN', message: deniedMessage(permission) });
+  return access;
+}
 
 function decodeEntities(s: string): string {
   return s
@@ -101,6 +110,11 @@ function asActionError(error: unknown): never {
   throw error;
 }
 const hooksFor = (ctx: ActionAPIContext): SaveHooks => ({ url: ctx.url, locals: ctx.locals, onRedirect: invalidateRedirectCache });
+// content saves also carry whether this person may change what's live
+async function publishHooks(ctx: ActionAPIContext): Promise<SaveHooks> {
+  const access = await accessFor(ctx.request, ctx.cookies, await getRepo(ctx.locals));
+  return { ...hooksFor(ctx), canPublish: access?.can('content.publish') ?? false };
+}
 
 async function importEvents(
   repo: Awaited<ReturnType<typeof getRepo>>,
@@ -146,7 +160,7 @@ export const server = {
     saveTemplate: defineAction({
       input: z.object({ name: z.string().trim().min(1).max(120), definition: z.any(), purpose: z.enum(['event', 'general']) }),
       handler: async (input, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'forms.manage');
         const parsed = FormDefinition.safeParse(input.definition);
         if (!parsed.success) throw new ActionError({ code: 'BAD_REQUEST', message: parsed.error.issues[0]?.message || 'Invalid form.' });
         const repo = await getRepo(ctx.locals);
@@ -160,7 +174,7 @@ export const server = {
     save: defineAction({
       input: z.object({ id: z.string(), revision: z.number().int(), name: z.string().trim().min(1).max(120), definition: z.any(), op: z.enum(['save', 'publish', 'archive']) }),
       handler: async (input, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'forms.manage');
         const parsed = FormDefinition.safeParse(input.definition);
         if (!parsed.success) throw new ActionError({ code: 'BAD_REQUEST', message: parsed.error.issues[0]?.message || 'Invalid form.' });
         const repo = await getRepo(ctx.locals);
@@ -179,7 +193,7 @@ export const server = {
     useTemplate: defineAction({
       input: z.object({ id: z.string(), name: z.string().trim().min(1).max(120).optional() }),
       handler: async (input, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'forms.manage');
         const repo = await getRepo(ctx.locals);
         const source = await repo.forms.get(input.id);
         if (!source || source.kind !== 'template' || source.purpose !== 'general') throw new ActionError({ code: 'NOT_FOUND', message: 'Template not found.' });
@@ -215,9 +229,9 @@ export const server = {
         scheduledAt: nullableTs.optional(),
       }),
       handler: async ({ id, ...data }, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'content.edit');
         const repo = await getRepo(ctx.locals);
-        try { return { post: await savePost(repo, id, data, hooksFor(ctx)) }; } catch (e) { asActionError(e); }
+        try { return { post: await savePost(repo, id, data, await publishHooks(ctx)) }; } catch (e) { asActionError(e); }
       },
     }),
     // Update button: copy the pending draft onto the live columns. The
@@ -226,15 +240,15 @@ export const server = {
     applyUpdate: defineAction({
       input: z.object({ id: z.string() }),
       handler: async ({ id }, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'content.publish');
         const repo = await getRepo(ctx.locals);
-        try { return { post: await applyPostUpdate(repo, id, hooksFor(ctx)) }; } catch (e) { asActionError(e); }
+        try { return { post: await applyPostUpdate(repo, id, await publishHooks(ctx)) }; } catch (e) { asActionError(e); }
       },
     }),
     discardChanges: defineAction({
       input: z.object({ id: z.string() }),
       handler: async ({ id }, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'content.edit');
         const repo = await getRepo(ctx.locals);
         await repo.discardPostDraft(id);
         const post = await repo.getPost(id);
@@ -245,7 +259,7 @@ export const server = {
     delete: defineAction({
       input: z.object({ id: z.string() }),
       handler: async ({ id }, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'content.delete');
         const repo = await getRepo(ctx.locals);
         await repo.deletePost(id);
         return { ok: true };
@@ -271,7 +285,7 @@ export const server = {
         blocks: z.array(BlockInput).optional(),
       }),
       handler: async ({ id, blocks, ...data }, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'content.edit');
         const repo = await getRepo(ctx.locals);
         const cleanBlocks =
           blocks === undefined
@@ -279,21 +293,21 @@ export const server = {
             : blocks
                 .filter((b) => widgetTypes.includes(b.type as WidgetType))
                 .map((b) => ({ ...b, type: b.type as WidgetType, config: parseConfig(b.type as WidgetType, b.config) as Record<string, unknown> }));
-        try { return { page: await savePage(repo, id, data, cleanBlocks, hooksFor(ctx)) }; } catch (e) { asActionError(e); }
+        try { return { page: await savePage(repo, id, data, cleanBlocks, await publishHooks(ctx)) }; } catch (e) { asActionError(e); }
       },
     }),
     applyUpdate: defineAction({
       input: z.object({ id: z.string() }),
       handler: async ({ id }, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'content.publish');
         const repo = await getRepo(ctx.locals);
-        try { return { page: await applyPageUpdate(repo, id, hooksFor(ctx)) }; } catch (e) { asActionError(e); }
+        try { return { page: await applyPageUpdate(repo, id, await publishHooks(ctx)) }; } catch (e) { asActionError(e); }
       },
     }),
     discardChanges: defineAction({
       input: z.object({ id: z.string() }),
       handler: async ({ id }, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'content.edit');
         const repo = await getRepo(ctx.locals);
         await repo.discardPageDraft(id);
         const page = await repo.getPage(id);
@@ -304,7 +318,7 @@ export const server = {
     delete: defineAction({
       input: z.object({ id: z.string() }),
       handler: async ({ id }, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'content.delete');
         const repo = await getRepo(ctx.locals);
         await repo.deletePage(id);
         return { ok: true };
@@ -324,7 +338,7 @@ export const server = {
     updateAlt: defineAction({
       input: z.object({ id: z.string(), alt: z.string() }),
       handler: async ({ id, alt }, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'media.upload');
         const repo = await getRepo(ctx.locals);
         await repo.updateMedia(id, { alt });
         return { ok: true };
@@ -333,7 +347,7 @@ export const server = {
     delete: defineAction({
       input: z.object({ id: z.string() }),
       handler: async ({ id }, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'media.delete');
         const repo = await getRepo(ctx.locals);
         const media = await repo.getMedia(id);
         if (media) {
@@ -358,7 +372,7 @@ export const server = {
         meta: z.record(z.any()).default({}),
       }),
       handler: async (data, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'site.links');
         const repo = await getRepo(ctx.locals);
         return { link: await repo.createLink(data) };
       },
@@ -373,7 +387,7 @@ export const server = {
         meta: z.record(z.any()).optional(),
       }),
       handler: async ({ id, ...data }, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'site.links');
         const repo = await getRepo(ctx.locals);
         await repo.updateLink(id, data);
         return { ok: true };
@@ -382,7 +396,7 @@ export const server = {
     reorder: defineAction({
       input: z.object({ ids: z.array(z.string()) }),
       handler: async ({ ids }, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'site.links');
         const repo = await getRepo(ctx.locals);
         await repo.reorderLinks(ids);
         return { ok: true };
@@ -391,7 +405,7 @@ export const server = {
     delete: defineAction({
       input: z.object({ id: z.string() }),
       handler: async ({ id }, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'site.links');
         const repo = await getRepo(ctx.locals);
         await repo.deleteLink(id);
         return { ok: true };
@@ -412,7 +426,7 @@ export const server = {
         })),
       }),
       handler: async ({ items }, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'site.navigation');
         const repo = await getRepo(ctx.locals);
         await repo.saveDesignDraft({ navItems: items });
         const changes = await designChanges(repo);
@@ -427,7 +441,7 @@ export const server = {
         area: z.enum(['header', 'footer', 'social']).default('header'),
       }),
       handler: async (data, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'site.navigation');
         const repo = await getRepo(ctx.locals);
         return { item: await repo.createNavItem(data) };
       },
@@ -440,7 +454,7 @@ export const server = {
         area: z.enum(['header', 'footer', 'social']).optional(),
       }),
       handler: async ({ id, ...data }, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'site.navigation');
         const repo = await getRepo(ctx.locals);
         await repo.updateNavItem(id, data);
         return { ok: true };
@@ -449,7 +463,7 @@ export const server = {
     reorder: defineAction({
       input: z.object({ ids: z.array(z.string()) }),
       handler: async ({ ids }, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'site.navigation');
         const repo = await getRepo(ctx.locals);
         await repo.reorderNavItems(ids);
         return { ok: true };
@@ -458,7 +472,7 @@ export const server = {
     delete: defineAction({
       input: z.object({ id: z.string() }),
       handler: async ({ id }, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'site.navigation');
         const repo = await getRepo(ctx.locals);
         await repo.deleteNavItem(id);
         return { ok: true };
@@ -487,7 +501,11 @@ export const server = {
       // unknown keys are an error, not silently dropped
       }).strict(),
       handler: async (data, ctx) => {
-        await requireAdmin(ctx);
+        // each field belongs to the screen that edits it
+        const needs = new Set<Permission>(Object.keys(data).map((k): Permission =>
+          k.startsWith('links') ? 'site.links' : ['siteTitle', 'tagline', 'footerText', 'timezone', 'locale'].includes(k) ? 'site.settings' : 'site.design'));
+        if (!needs.size) await requireAdmin(ctx);
+        for (const permission of needs) await requireCan(ctx, permission);
         const repo = await getRepo(ctx.locals);
         await repo.updateSettings({ ...data, ...(data.locale ? { locale: Intl.getCanonicalLocales(data.locale)[0] } : {}) });
         return { ok: true };
@@ -506,7 +524,7 @@ export const server = {
         siteCover: z.string().optional(),
       }),
       handler: async (data, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'site.design');
         const repo = await getRepo(ctx.locals);
         await repo.saveDesignDraft(data);
         // edits that land back on the live design leave nothing to publish
@@ -526,7 +544,7 @@ export const server = {
     revertDesignChange: defineAction({
       input: z.object({ key: z.string() }),
       handler: async ({ key }, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'site.design');
         const repo = await getRepo(ctx.locals);
         const [settings, nav] = await Promise.all([repo.getSettings(), repo.listNavItems()]);
         if (settings.draftDesign) await repo.setDesignDraft(revertDesignChange(settings, nav, settings.draftDesign, key));
@@ -537,8 +555,7 @@ export const server = {
     applyDesign: defineAction({
       input: z.object({}),
       handler: async (_input, ctx) => {
-        const userId = await validateRequestSession(ctx.request, ctx.cookies, ctx.locals);
-        if (!userId) throw new ActionError({ code: 'UNAUTHORIZED', message: 'Not signed in.' });
+        const { userId } = await requireCan(ctx, 'site.design');
         const repo = await getRepo(ctx.locals);
         const changes = await designChanges(repo);
         const author = (await repo.listUsers()).find((u) => u.id === userId)?.name ?? 'Admin';
@@ -557,7 +574,7 @@ export const server = {
     discardDesign: defineAction({
       input: z.object({}),
       handler: async (_input, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'site.design');
         const repo = await getRepo(ctx.locals);
         await repo.discardDesignDraft();
         return { ok: true };
@@ -582,7 +599,7 @@ export const server = {
     restoreDesignVersion: defineAction({
       input: z.object({ id: z.string() }),
       handler: async ({ id }, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'site.design');
         const repo = await getRepo(ctx.locals);
         const v = await repo.getDesignVersion(id);
         if (!v) throw new ActionError({ code: 'NOT_FOUND', message: 'That version no longer exists.' });
@@ -597,7 +614,7 @@ export const server = {
     createShareLink: defineAction({
       input: z.object({ days: z.number().int().min(1).max(30).default(7) }),
       handler: async ({ days }, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'site.design');
         const repo = await getRepo(ctx.locals);
         const settings = await repo.getSettings();
         if (!settings.draftDesign) throw new ActionError({ code: 'BAD_REQUEST', message: 'There are no draft changes to share.' });
@@ -612,7 +629,7 @@ export const server = {
     revokeShareLinks: defineAction({
       input: z.object({}),
       handler: async (_input, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'site.design');
         const repo = await getRepo(ctx.locals);
         const settings = await repo.getSettings();
         if (settings.draftDesign) await repo.saveDesignDraft({ shareEpoch: crypto.randomUUID() });
@@ -699,7 +716,7 @@ export const server = {
     create: defineAction({
       input: z.object({ name: z.string().min(1).max(80), contentJson: z.string().min(2) }),
       handler: async ({ name, contentJson }, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'content.edit');
         // must be a JSON array of ProseMirror nodes — reject anything else
         // before it can break the editor on re-insert
         let parsed: unknown;
@@ -714,7 +731,7 @@ export const server = {
     delete: defineAction({
       input: z.object({ id: z.string() }),
       handler: async ({ id }, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'content.edit');
         const repo = await getRepo(ctx.locals);
         await repo.deleteSnippet(id);
         return { ok: true };
@@ -920,7 +937,7 @@ export const server = {
         applyToLinks: z.boolean().optional(),
       }),
       handler: async ({ applyToLinks, ...patch }, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'schedule.manage');
         const repo = await getRepo(ctx.locals);
         const settings = await repo.getSettings();
         if (patch.defaultCalendarId) {
@@ -976,23 +993,23 @@ export const server = {
         scheduledAt: nullableTs.optional(),
       }),
       handler: async ({ id, ...data }, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'content.edit');
         const repo = await getRepo(ctx.locals);
-        try { return { event: await saveEvent(repo, id, data, hooksFor(ctx)) }; } catch (e) { asActionError(e); }
+        try { return { event: await saveEvent(repo, id, data, await publishHooks(ctx)) }; } catch (e) { asActionError(e); }
       },
     }),
     applyUpdate: defineAction({
       input: z.object({ id: z.string() }),
       handler: async ({ id }, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'content.publish');
         const repo = await getRepo(ctx.locals);
-        try { return { event: await applyEventUpdate(repo, id, hooksFor(ctx)) }; } catch (e) { asActionError(e); }
+        try { return { event: await applyEventUpdate(repo, id, await publishHooks(ctx)) }; } catch (e) { asActionError(e); }
       },
     }),
     discardChanges: defineAction({
       input: z.object({ id: z.string() }),
       handler: async ({ id }, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'content.edit');
         const repo = await getRepo(ctx.locals);
         await repo.discardEventDraft(id);
         return { event: await repo.getEvent(id) };
@@ -1001,7 +1018,7 @@ export const server = {
     delete: defineAction({
       input: z.object({ id: z.string() }),
       handler: async ({ id }, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'content.delete');
         const repo = await getRepo(ctx.locals);
         const before = await repo.getEvent(id);
         await repo.deleteEvent(id);
@@ -1070,7 +1087,7 @@ export const server = {
     cancelBookingsForEvent: defineAction({
       input: z.object({ ids: z.array(z.string()).min(1).max(100), message: z.string().max(2000).default('') }),
       handler: async ({ ids, message }, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'schedule.bookings');
         const repo = await getRepo(ctx.locals);
         const settings = await repo.getSettings();
         const opts = { origin: siteOrigin(settings, ctx.url), locals: ctx.locals, waitUntil: waitUntilFrom(ctx.locals) };
@@ -1097,9 +1114,9 @@ export const server = {
         roomIds: z.array(z.string()).max(50).default([]),
       }),
       handler: async (input, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'content.edit');
         const repo = await getRepo(ctx.locals);
-        try { const e = await quickCreate(repo, input, hooksFor(ctx)); return { id: e.id, status: e.status }; } catch (e) { asActionError(e); }
+        try { const e = await quickCreate(repo, input, await publishHooks(ctx)); return { id: e.id, status: e.status }; } catch (e) { asActionError(e); }
       },
     }),
     // Schedule: drag to another day. `occurrence` + mode 'one' moves a single
@@ -1107,10 +1124,10 @@ export const server = {
     move: defineAction({
       input: z.object({ id: z.string(), days: z.number().int(), mode: z.enum(['series', 'one']).default('series'), occurrence: z.string().max(20).default('') }),
       handler: async ({ id, days, mode, occurrence }, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'content.edit');
         const repo = await getRepo(ctx.locals);
         try {
-          const r = mode === 'one' ? await moveOccurrence(repo, id, occurrence, days, hooksFor(ctx)) : await moveSeries(repo, id, days, hooksFor(ctx));
+          const r = mode === 'one' ? await moveOccurrence(repo, id, occurrence, days, await publishHooks(ctx)) : await moveSeries(repo, id, days, await publishHooks(ctx));
           return { id: r.event.id, undo: r.undo };
         } catch (e) { asActionError(e); }
       },
@@ -1121,15 +1138,15 @@ export const server = {
         z.object({ kind: z.literal('split'), id: z.string(), seriesId: z.string(), occurrence: z.string().max(20) }),
       ]),
       handler: async (undo, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'content.edit');
         const repo = await getRepo(ctx.locals);
-        try { await undoMove(repo, undo, hooksFor(ctx)); return { ok: true }; } catch (e) { asActionError(e); }
+        try { await undoMove(repo, undo, await publishHooks(ctx)); return { ok: true }; } catch (e) { asActionError(e); }
       },
     }),
     duplicate: defineAction({
       input: z.object({ id: z.string() }),
       handler: async ({ id }, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'content.edit');
         const repo = await getRepo(ctx.locals);
         try { return { id: (await duplicateEvent(repo, id)).id }; } catch (e) { asActionError(e); }
       },
@@ -1163,7 +1180,7 @@ export const server = {
         calendarId: z.string().optional(),
       }),
       handler: async ({ format, text, url, calendarId }, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'content.edit');
         const repo = await getRepo(ctx.locals);
         const settings = await repo.getSettings();
         if (calendarId && !(await repo.getCalendar(calendarId))) throw new ActionError({ code: 'BAD_REQUEST', message: 'Unknown calendar.' });
@@ -1211,7 +1228,7 @@ export const server = {
         visibility: z.enum(['public', 'unlisted', 'private']).optional(),
       }),
       handler: async ({ id, ...data }, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'schedule.manage');
         const repo = await getRepo(ctx.locals);
         try { return { calendar: await saveCalendar(repo, id, data) }; }
         catch (e) {
@@ -1223,7 +1240,7 @@ export const server = {
     reorder: defineAction({
       input: z.object({ ids: z.array(z.string()) }),
       handler: async ({ ids }, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'schedule.manage');
         await (await getRepo(ctx.locals)).reorderCalendars(ids);
         return { ok: true };
       },
@@ -1231,7 +1248,7 @@ export const server = {
     rotateToken: defineAction({
       input: z.object({ id: z.string() }),
       handler: async ({ id }, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'schedule.manage');
         const repo = await getRepo(ctx.locals);
         const bytes = crypto.getRandomValues(new Uint8Array(18));
         const token = btoa(String.fromCharCode(...bytes)).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
@@ -1242,7 +1259,7 @@ export const server = {
     delete: defineAction({
       input: z.object({ id: z.string() }),
       handler: async ({ id }, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'schedule.manage');
         await (await getRepo(ctx.locals)).deleteCalendar(id);
         return { ok: true };
       },
@@ -1295,7 +1312,7 @@ export const server = {
         isDefault: z.boolean().default(false),
       }),
       handler: async (input, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'schedule.manage');
         const repo = await getRepo(ctx.locals);
         try { return await savePlace(repo, input, mapsCtx(ctx)); } catch (e) { asActionError(e); }
       },
@@ -1303,7 +1320,7 @@ export const server = {
     delete: defineAction({
       input: z.object({ id: z.string().max(100) }),
       handler: async ({ id }, ctx) => {
-        await requireAdmin(ctx);
+        await requireCan(ctx, 'schedule.manage');
         await (await getRepo(ctx.locals)).deletePlace(id);
         return { ok: true };
       },