@commonpub/layer 0.29.0 → 0.30.0

package/pages/contests/create.vue

@@ -8,6 +8,7 @@ const { extract: extractError } = useApiError();
 const saving = ref(false);
 
 const title = ref('');
+const subheading = ref('');
 const description = ref('');
 const rules = ref('');
 const bannerUrl = ref('');
@@ -90,6 +91,7 @@ async function handleCreate(): Promise<void> {
       method: 'POST',
       body: {
         title: title.value,
+        subheading: subheading.value || undefined,
         description: description.value || undefined,
         rules: rules.value || undefined,
         bannerUrl: bannerUrl.value || undefined,
@@ -103,13 +105,13 @@ async function handleCreate(): Promise<void> {
         eligibleContentTypes: eligibleContentTypes.value.length ? eligibleContentTypes.value : undefined,
         maxEntriesPerUser: maxEntriesPerUser.value && maxEntriesPerUser.value > 0 ? maxEntriesPerUser.value : undefined,
         prizes: prizes.value
-          .filter(p => p.title.trim())
+          .filter(p => p.title.trim() || p.description.trim() || p.category.trim() || (typeof p.place === 'number' && p.place > 0))
           .map(p => ({
             place: typeof p.place === 'number' && Number.isFinite(p.place) && p.place > 0 ? p.place : undefined,
             category: p.category.trim() || undefined,
-            title: p.title,
-            description: p.description || undefined,
-            value: p.value || undefined,
+            title: p.title.trim() || undefined,
+            description: p.description.trim() || undefined,
+            value: p.value.trim() || undefined,
           })),
         judgingCriteria: criteria.value
           .filter(c => c.label.trim())
@@ -129,10 +131,13 @@ async function handleCreate(): Promise<void> {
   }
 }
 
-function prizeLabel(prize: Prize, idx: number): string {
+function prizeLabel(prize: Prize): string {
   if (prize.category.trim()) return prize.category;
-  const labels = ['1st', '2nd', '3rd', '4th', '5th', '6th'];
-  return `${labels[idx] || `${idx + 1}th`} Place`;
+  if (prize.place && prize.place > 0) {
+    const labels = ['1st', '2nd', '3rd', '4th', '5th', '6th'];
+    return `${labels[prize.place - 1] || `${prize.place}th`} Place`;
+  }
+  return 'Prize';
 }
 </script>
 
@@ -149,17 +154,23 @@ function prizeLabel(prize: Prize, idx: number): string {
           <label for="contest-title" class="cpub-form-label">Title</label>
           <input id="contest-title" v-model="title" type="text" class="cpub-form-input" required placeholder="Maker Challenge 2026" />
         </div>
+        <div class="cpub-form-field">
+          <label for="contest-subheading" class="cpub-form-label">Subheading</label>
+          <input id="contest-subheading" v-model="subheading" type="text" maxlength="300" class="cpub-form-input" placeholder="One-line tagline shown in the contest header" />
+          <p class="cpub-form-hint">Short plain-text tagline shown under the title in the hero. The Description below is the full body.</p>
+        </div>
         <div class="cpub-form-field">
           <label for="contest-desc" class="cpub-form-label">Description</label>
-          <textarea id="contest-desc" v-model="description" class="cpub-form-textarea" rows="3" placeholder="Describe your contest..." />
+          <textarea id="contest-desc" v-model="description" class="cpub-form-textarea" rows="4" placeholder="Describe your contest. Supports Markdown — # headings, - lists, **bold**, [links](url)…" />
+          <p class="cpub-form-hint">Supports Markdown (headings, lists, bold, links) and inline HTML. Shown formatted on the contest page.</p>
         </div>
         <div class="cpub-form-field">
           <label for="contest-rules" class="cpub-form-label">Rules</label>
-          <textarea id="contest-rules" v-model="rules" class="cpub-form-textarea" rows="4" placeholder="Contest rules and requirements (one per line)..." />
+          <textarea id="contest-rules" v-model="rules" class="cpub-form-textarea" rows="6" placeholder="Contest rules and requirements. Supports Markdown — one rule per line, or full Markdown." />
+          <p class="cpub-form-hint">Supports Markdown. Plain one-rule-per-line text is rendered as a numbered list.</p>
         </div>
         <div class="cpub-form-field">
-          <label for="contest-banner" class="cpub-form-label">Banner Image URL</label>
-          <input id="contest-banner" v-model="bannerUrl" type="url" class="cpub-form-input" placeholder="https://..." />
+          <ImageUpload v-model="bannerUrl" purpose="banner" label="Banner Image" hint="Wide image shown across the top of the contest page (~4:1)." />
         </div>
       </section>
 
@@ -274,11 +285,11 @@ function prizeLabel(prize: Prize, idx: number): string {
           </button>
         </div>
 
-        <p class="cpub-form-hint">Use <strong>place</strong> for ranked prizes (1st/2nd/3rd) or a <strong>category</strong> for themed awards (e.g. "Best in Show").</p>
+        <p class="cpub-form-hint">Every field is optional. Use <strong>place</strong> for ranked prizes (1st/2nd/3rd), a <strong>category</strong> for themed awards (e.g. "Best in Show"), or just a <strong>description</strong>. Cash value is optional.</p>
         <div v-for="(prize, idx) in prizes" :key="idx" class="cpub-prize-card">
           <div class="cpub-prize-header">
             <span class="cpub-prize-place">
-              <i class="fa-solid fa-trophy"></i> {{ prizeLabel(prize, idx) }}
+              <i class="fa-solid fa-trophy"></i> {{ prizeLabel(prize) }}
             </span>
             <button v-if="prizes.length > 1" type="button" class="cpub-delete-btn" aria-label="Remove prize" @click="removePrize(idx)">
               <i class="fa-solid fa-xmark"></i>

package/pages/events/[slug]/index.vue

@@ -126,7 +126,7 @@ const typeIcon = computed(() => {
         </div>
 
         <div v-if="event.description" class="cpub-event-description">
-          {{ event.description }}
+          <CpubMarkdown :source="event.description" />
         </div>
 
         <div class="cpub-event-organizer">

package/pages/notifications.vue

@@ -27,6 +27,14 @@ async function deleteNotification(id: string): Promise<void> {
   await $fetch(`/api/notifications/${id}`, { method: 'DELETE' });
   refresh();
 }
+
+// Fired when a row is clicked/navigated — mark it read so the unread highlight
+// + nav badge clear. Fire-and-forget: navigation proceeds regardless.
+function onNotificationRead(id: string): void {
+  $fetch('/api/notifications/read', { method: 'POST', body: { notificationId: id } })
+    .then(() => refresh())
+    .catch(() => {});
+}
 </script>
 
 <template>
@@ -59,6 +67,7 @@ async function deleteNotification(id: string): Promise<void> {
         v-for="n in filteredNotifications"
         :key="n.id"
         :notification="n"
+        @read="onNotificationRead"
       />
       <div v-if="!filteredNotifications.length" class="cpub-empty-state">
         <div class="cpub-empty-state-icon"><i class="fa-solid fa-bell-slash"></i></div>

package/server/api/admin/api-keys/[id]/usage.get.ts

@@ -6,7 +6,7 @@ const querySchema = z.object({
 });
 
 export default defineEventHandler(async (event) => {
-  requireAdmin(event);
+  requirePermission(event, 'apikeys.manage');
   const id = getRouterParam(event, 'id');
   if (!id) throw createError({ statusCode: 400, statusMessage: 'Missing id' });
   const parsed = querySchema.safeParse(getQuery(event));

package/server/api/admin/api-keys/[id].delete.ts

@@ -1,7 +1,7 @@
 import { revokeApiKey, createAuditEntry } from '@commonpub/server';
 
 export default defineEventHandler(async (event) => {
-  const user = requireAdmin(event);
+  const user = requirePermission(event, 'apikeys.manage');
   const id = getRouterParam(event, 'id');
   if (!id) throw createError({ statusCode: 400, statusMessage: 'Missing id' });
   const db = useDB();

package/server/api/admin/api-keys/index.get.ts

@@ -1,7 +1,7 @@
 import { listApiKeys } from '@commonpub/server';
 
 export default defineEventHandler(async (event) => {
-  requireAdmin(event);
+  requirePermission(event, 'apikeys.manage');
   const query = getQuery(event);
   const includeRevoked = query.includeRevoked === 'true' || query.includeRevoked === '1';
   const db = useDB();

package/server/api/admin/api-keys/index.post.ts

@@ -14,7 +14,7 @@ import { createApiKeySchema } from '@commonpub/schema';
  * land in the metadata column.
  */
 export default defineEventHandler(async (event) => {
-  const user = requireAdmin(event);
+  const user = requirePermission(event, 'apikeys.manage');
   const body = await readBody(event);
   const parsed = createApiKeySchema.safeParse(body);
   if (!parsed.success) {

package/server/api/admin/audit.get.ts

@@ -9,7 +9,7 @@ const auditQuerySchema = z.object({
 
 export default defineEventHandler(async (event): Promise<PaginatedResponse<AuditLogItem>> => {
   requireFeature('admin');
-  requireAdmin(event);
+  requirePermission(event, 'audit.read');
   const db = useDB();
   const filters = parseQueryParams(event, auditQuerySchema);
 

package/server/api/admin/categories/[id].delete.ts

@@ -5,7 +5,7 @@ import { deleteContentCategory } from '@commonpub/server';
  * Delete a content category (admin only). System categories cannot be deleted.
  */
 export default defineEventHandler(async (event) => {
-  requireAdmin(event);
+  requirePermission(event, 'categories.manage');
   const db = useDB();
   const { id } = parseParams(event, { id: 'uuid' });
 

package/server/api/admin/categories/[id].patch.ts

@@ -6,7 +6,7 @@ import { updateContentCategorySchema } from '@commonpub/schema';
  * Update a content category (admin only).
  */
 export default defineEventHandler(async (event) => {
-  requireAdmin(event);
+  requirePermission(event, 'categories.manage');
   const db = useDB();
   const { id } = parseParams(event, { id: 'uuid' });
   const body = await parseBody(event, updateContentCategorySchema);

package/server/api/admin/categories/index.get.ts

@@ -5,7 +5,7 @@ import { listContentCategories } from '@commonpub/server';
  * List all content categories (admin).
  */
 export default defineEventHandler(async (event) => {
-  requireAdmin(event);
+  requirePermission(event, 'categories.manage');
   const db = useDB();
   return listContentCategories(db);
 });

package/server/api/admin/categories/index.post.ts

@@ -6,7 +6,7 @@ import { createContentCategorySchema } from '@commonpub/schema';
  * Create a new content category (admin only).
  */
 export default defineEventHandler(async (event) => {
-  requireAdmin(event);
+  requirePermission(event, 'categories.manage');
   const db = useDB();
   const body = await parseBody(event, createContentCategorySchema);
   return createContentCategory(db, body);

package/server/api/admin/content/[id].delete.ts

@@ -2,7 +2,7 @@ import { removeContent, removeFederatedContent } from '@commonpub/server';
 
 export default defineEventHandler(async (event): Promise<void> => {
   requireFeature('admin');
-  const admin = requireAdmin(event);
+  const admin = requirePermission(event, 'content.moderate');
   const db = useDB();
   const { id } = parseParams(event, { id: 'uuid' });
 

package/server/api/admin/content/[id].patch.ts

@@ -7,7 +7,7 @@ import { z } from 'zod';
  * Update admin-managed content fields (featured, editorial, category).
  */
 export default defineEventHandler(async (event) => {
-  requireAdmin(event);
+  requirePermission(event, 'content.editorial');
 
   const { id: contentId } = parseParams(event, { id: 'uuid' });
   const body = await parseBody(event, z.object({

package/server/api/admin/content/bulk-editorial.post.ts

@@ -7,7 +7,7 @@ import { z } from 'zod';
  * Bulk update editorial status on multiple content items (admin only).
  */
 export default defineEventHandler(async (event) => {
-  requireAdmin(event);
+  requirePermission(event, 'content.editorial');
 
   const body = await parseBody(event, z.object({
     ids: z.array(z.string().uuid()).min(1).max(100),

package/server/api/admin/features/index.get.ts

@@ -6,7 +6,7 @@ import type { FeatureFlags } from '@commonpub/config';
  * Returns current feature flags with metadata about defaults vs overrides.
  */
 export default defineEventHandler(async (event) => {
-  requireAdmin(event);
+  requirePermission(event, 'settings.manage');
 
   const db = useDB();
   const config = useConfig();

package/server/api/admin/features/index.put.ts

@@ -15,7 +15,7 @@ const updateFeaturesSchema = z.object({
  * To remove an override, omit the key from overrides.
  */
 export default defineEventHandler(async (event) => {
-  const user = requireAdmin(event);
+  const user = requirePermission(event, 'settings.manage');
 
   const body = await parseBody(event, updateFeaturesSchema);
   const db = useDB();

package/server/api/admin/federation/activity.get.ts

@@ -5,7 +5,7 @@ const VALID_STATUSES = ['pending', 'delivered', 'failed', 'processed'] as const;
 
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
   const db = useDB();
 
   const query = getQuery(event);

package/server/api/admin/federation/clients.get.ts

@@ -2,7 +2,7 @@ import { listOAuthClients } from '@commonpub/server';
 
 export default defineEventHandler(async (event) => {
   requireFeature('federation');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
   const db = useDB();
 
   return listOAuthClients(db);

package/server/api/admin/federation/clients.post.ts

@@ -8,7 +8,7 @@ const registerSchema = z.object({
 
 export default defineEventHandler(async (event) => {
   requireFeature('federation');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
   const db = useDB();
   const { instanceDomain, redirectUris } = await parseBody(event, registerSchema);
 

package/server/api/admin/federation/hub-mirrors/[id]/backfill.post.ts

@@ -3,7 +3,7 @@ import { backfillHubFromOutbox, fetchRemoteHubFollowers, repairFederatedHubPostA
 export default defineEventHandler(async (event) => {
   requireFeature('federation');
   requireFeature('federateHubs');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
 
   const db = useDB();
   const config = useConfig();

package/server/api/admin/federation/hub-mirrors/index.get.ts

@@ -3,7 +3,7 @@ import { listFederatedHubs } from '@commonpub/server';
 export default defineEventHandler(async (event) => {
   requireFeature('federation');
   requireFeature('federateHubs');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
 
   const db = useDB();
   return listFederatedHubs(db);

package/server/api/admin/federation/hub-mirrors/index.post.ts

@@ -8,7 +8,7 @@ const bodySchema = z.object({
 export default defineEventHandler(async (event) => {
   requireFeature('federation');
   requireFeature('federateHubs');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
 
   const db = useDB();
   const config = useConfig();

package/server/api/admin/federation/mirrors/[id]/backfill.post.ts

@@ -11,7 +11,7 @@ function extractDomain(url: string): string {
  * Admin only.
  */
 export default defineEventHandler(async (event) => {
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
 
   const config = useConfig();
   if (!config.features.federation) {

package/server/api/admin/federation/mirrors/[id].delete.ts

@@ -2,7 +2,7 @@ import { cancelMirror } from '@commonpub/server';
 
 export default defineEventHandler(async (event) => {
   requireFeature('federation');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
   const db = useDB();
   const { id } = parseParams(event, { id: 'uuid' });
 

package/server/api/admin/federation/mirrors/[id].get.ts

@@ -2,7 +2,7 @@ import { getMirror } from '@commonpub/server';
 
 export default defineEventHandler(async (event) => {
   requireFeature('federation');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
   const db = useDB();
   const { id } = parseParams(event, { id: 'uuid' });
 

package/server/api/admin/federation/mirrors/[id].put.ts

@@ -7,7 +7,7 @@ const updateMirrorSchema = z.object({
 
 export default defineEventHandler(async (event) => {
   requireFeature('federation');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
   const db = useDB();
   const { id } = parseParams(event, { id: 'uuid' });
   const { action } = await parseBody(event, updateMirrorSchema);

package/server/api/admin/federation/mirrors/index.get.ts

@@ -2,7 +2,7 @@ import { listMirrors } from '@commonpub/server';
 
 export default defineEventHandler(async (event) => {
   requireFeature('federation');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
   const db = useDB();
 
   return listMirrors(db);

package/server/api/admin/federation/mirrors/index.post.ts

@@ -11,7 +11,7 @@ const createMirrorSchema = z.object({
 
 export default defineEventHandler(async (event) => {
   requireFeature('federation');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
   const db = useDB();
   const input = await parseBody(event, createMirrorSchema);
 

package/server/api/admin/federation/pending.get.ts

@@ -8,7 +8,7 @@ import { activities } from '@commonpub/schema';
  */
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
   const db = useDB();
 
   const pending = await db

package/server/api/admin/federation/refederate.post.ts

@@ -18,7 +18,7 @@ export default defineEventHandler(async (event) => {
   if (cliSecret && cliSecret === runtimeConfig.authSecret) {
     // Authorized via shared secret
   } else {
-    requireAdmin(event);
+    requirePermission(event, 'federation.manage');
   }
 
   const config = useConfig();

package/server/api/admin/federation/repair-types.post.ts

@@ -7,7 +7,7 @@ import { repairFederatedContentTypes } from '@commonpub/server';
  */
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
   const db = useDB();
 
   return repairFederatedContentTypes(db);

package/server/api/admin/federation/retry.post.ts

@@ -12,7 +12,7 @@ const retrySchema = z.object({
  * Optionally filter by activity ID.
  */
 export default defineEventHandler(async (event) => {
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
 
   const config = useConfig();
   if (!config.features.federation) {

package/server/api/admin/federation/stats.get.ts

@@ -3,7 +3,7 @@ import { activities, followRelationships } from '@commonpub/schema';
 
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
   const db = useDB();
 
   const [inbound, outbound, pending, failed, followers, following] = await Promise.all([

package/server/api/admin/federation/trusted-instances.delete.ts

@@ -7,7 +7,7 @@ const removeSchema = z.object({
 
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
   const db = useDB();
   const { domain } = await parseBody(event, removeSchema);
 

package/server/api/admin/federation/trusted-instances.get.ts

@@ -2,7 +2,7 @@ import { getStoredTrustedInstances } from '@commonpub/server';
 
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
   const db = useDB();
   const config = useConfig();
 

package/server/api/admin/federation/trusted-instances.post.ts

@@ -7,7 +7,7 @@ const addSchema = z.object({
 
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
-  requireAdmin(event);
+  requirePermission(event, 'federation.manage');
   const db = useDB();
   const { domain } = await parseBody(event, addSchema);
 

package/server/api/admin/homepage/sections.get.ts

@@ -5,7 +5,7 @@ import { getHomepageSections } from '@commonpub/server';
  * Returns homepage sections for admin editing.
  */
 export default defineEventHandler(async (event) => {
-  requireAdmin(event);
+  requirePermission(event, 'layout.manage');
   const db = useDB();
   return getHomepageSections(db);
 });

package/server/api/admin/homepage/sections.put.ts

@@ -34,7 +34,7 @@ const updateSectionsSchema = z.object({
  * Save homepage section configuration.
  */
 export default defineEventHandler(async (event) => {
-  const user = requireAdmin(event);
+  const user = requirePermission(event, 'layout.manage');
   const db = useDB();
   const body = await parseBody(event, updateSectionsSchema);
 

package/server/api/admin/layouts/[id]/publish.post.ts

@@ -14,7 +14,7 @@ import { invalidateLayoutsByRouteCache } from '../../../../utils/layoutCache';
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
   requireFeature('layoutEngine');
-  const admin = requireAdmin(event);
+  const admin = requirePermission(event, 'layout.manage');
   const db = useDB();
 
   const id = getRouterParam(event, 'id');

package/server/api/admin/layouts/[id]/versions/[versionId]/revert.post.ts

@@ -15,7 +15,7 @@ import { invalidateLayoutsByRouteCache } from '../../../../../../utils/layoutCac
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
   requireFeature('layoutEngine');
-  const admin = requireAdmin(event);
+  const admin = requirePermission(event, 'layout.manage');
   const db = useDB();
 
   const id = getRouterParam(event, 'id');

package/server/api/admin/layouts/[id]/versions/index.get.ts

@@ -12,7 +12,7 @@ import { getLayoutById, listLayoutVersions } from '@commonpub/server';
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
   requireFeature('layoutEngine');
-  requireAdmin(event);
+  requirePermission(event, 'layout.manage');
   const db = useDB();
 
   const id = getRouterParam(event, 'id');

package/server/api/admin/layouts/[id].delete.ts

@@ -15,7 +15,7 @@ import { invalidateLayoutsByRouteCache } from '../../../utils/layoutCache';
 export default defineEventHandler(async (event): Promise<{ ok: true; id: string }> => {
   requireFeature('admin');
   requireFeature('layoutEngine');
-  const admin = requireAdmin(event);
+  const admin = requirePermission(event, 'layout.manage');
   const db = useDB();
 
   const id = getRouterParam(event, 'id');

package/server/api/admin/layouts/[id].get.ts

@@ -11,7 +11,7 @@ import { getLayoutById } from '@commonpub/server';
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
   requireFeature('layoutEngine');
-  requireAdmin(event);
+  requirePermission(event, 'layout.manage');
 
   const id = getRouterParam(event, 'id');
   if (!id) {

package/server/api/admin/layouts/[id].put.ts

@@ -27,7 +27,7 @@ import { validateSectionConfigs } from '../../../utils/validateSectionConfigs';
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
   requireFeature('layoutEngine');
-  const admin = requireAdmin(event);
+  const admin = requirePermission(event, 'layout.manage');
   const db = useDB();
 
   const id = getRouterParam(event, 'id');

package/server/api/admin/layouts/index.get.ts

@@ -12,7 +12,7 @@ import { listLayouts } from '@commonpub/server';
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
   requireFeature('layoutEngine');
-  requireAdmin(event);
+  requirePermission(event, 'layout.manage');
 
   const db = useDB();
   const query = getQuery(event) as { scope?: string };

package/server/api/admin/layouts/index.post.ts

@@ -19,7 +19,7 @@ import { validateSectionConfigs } from '../../../utils/validateSectionConfigs';
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
   requireFeature('layoutEngine');
-  const admin = requireAdmin(event);
+  const admin = requirePermission(event, 'layout.manage');
   const db = useDB();
 
   const body = await parseBody(event, layoutCreateSchema);

package/server/api/admin/layouts/migrate-homepage.post.ts

@@ -38,7 +38,7 @@ const bodySchema = z.object({
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
   requireFeature('layoutEngine');
-  const admin = requireAdmin(event);
+  const admin = requirePermission(event, 'layout.manage');
 
   const body = await readBody(event).catch(() => ({}));
   const { force } = bodySchema.parse(body ?? {});

package/server/api/admin/layouts/seed-homepage.post.ts

@@ -24,7 +24,7 @@ import { invalidateLayoutsByRouteCache } from '../../../utils/layoutCache';
 export default defineEventHandler(async (event) => {
   requireFeature('admin');
   requireFeature('layoutEngine');
-  const admin = requireAdmin(event);
+  const admin = requirePermission(event, 'layout.manage');
   const db = useDB();
 
   const result = await seedHomepageLayout(db, { adminId: admin.id });

package/server/api/admin/navigation/items.get.ts

@@ -5,7 +5,7 @@ import { getNavItems } from '@commonpub/server';
  * Returns navigation items for admin editing.
  */
 export default defineEventHandler(async (event) => {
-  requireAdmin(event);
+  requirePermission(event, 'navigation.manage');
   const db = useDB();
   return getNavItems(db);
 });

package/server/api/admin/navigation/items.put.ts

@@ -26,7 +26,7 @@ const updateNavSchema = z.object({
  * Save navigation item configuration.
  */
 export default defineEventHandler(async (event) => {
-  const user = requireAdmin(event);
+  const user = requirePermission(event, 'navigation.manage');
   const db = useDB();
   const body = await parseBody(event, updateNavSchema);