feat: gate destructive moderation endpoints to moderator+ role

lib/api/admin-comments.ts

@@ -6,16 +6,13 @@ import {
   user,
 } from "@/lib/db/schema"
 import { eq, desc, sql, and, ilike } from "drizzle-orm"
-import {
+import { requireModeratorOrAdmin } from "@/lib/auth/guard"
-  requireContributorOrAdmin,
-  requireAdmin,
-} from "@/lib/auth/guard"
 
 export const adminCommentRoutes = new Elysia({ prefix: "/admin", detail: { tags: ["Admin"] } })
   .get(
     "/comments",
     async ({ query, request, set }) => {
-      const guard = await requireContributorOrAdmin(request.headers)
+      const guard = await requireModeratorOrAdmin(request.headers)
       if (!guard.ok) {
         set.status = guard.status
         return { error: guard.error }
@@ -95,7 +92,7 @@ export const adminCommentRoutes = new Elysia({ prefix: "/admin", detail: { tags:
   .patch(
     "/comments/:id/remove",
     async ({ params, request, set }) => {
-      const guard = await requireAdmin(request.headers)
+      const guard = await requireModeratorOrAdmin(request.headers)
       if (!guard.ok) {
         set.status = guard.status
         return { error: guard.error }
@@ -130,7 +127,7 @@ export const adminCommentRoutes = new Elysia({ prefix: "/admin", detail: { tags:
   .patch(
     "/comments/:id/restore",
     async ({ params, request, set }) => {
-      const guard = await requireAdmin(request.headers)
+      const guard = await requireModeratorOrAdmin(request.headers)
       if (!guard.ok) {
         set.status = guard.status
         return { error: guard.error }

lib/api/admin-performance.ts

@@ -12,6 +12,7 @@ import { fuzzySearchTerm } from "@/lib/db/search"
 import {
   requireContributorOrAdmin,
   requireAdmin,
+  requireModeratorOrAdmin,
 } from "@/lib/auth/guard"
 
 export const adminPerformanceRoutes = new Elysia({ prefix: "/admin", detail: { tags: ["Admin"] } })
@@ -188,7 +189,7 @@ export const adminPerformanceRoutes = new Elysia({ prefix: "/admin", detail: { t
   .patch(
     "/performance/:id/remove",
     async ({ params, body, request, set }) => {
-      const guard = await requireAdmin(request.headers)
+      const guard = await requireModeratorOrAdmin(request.headers)
       if (!guard.ok) {
         set.status = guard.status
         return { error: guard.error }
@@ -229,7 +230,7 @@ export const adminPerformanceRoutes = new Elysia({ prefix: "/admin", detail: { t
   .delete(
     "/performance/:id/hard-delete",
     async ({ params, request, set }) => {
-      const guard = await requireAdmin(request.headers)
+      const guard = await requireModeratorOrAdmin(request.headers)
       if (!guard.ok) {
         set.status = guard.status
         return { error: guard.error }
@@ -259,7 +260,7 @@ export const adminPerformanceRoutes = new Elysia({ prefix: "/admin", detail: { t
   .patch(
     "/performance/:id/restore",
     async ({ params, request, set }) => {
-      const guard = await requireAdmin(request.headers)
+      const guard = await requireModeratorOrAdmin(request.headers)
       if (!guard.ok) {
         set.status = guard.status
         return { error: guard.error }

lib/api/admin-reports.ts

@@ -8,13 +8,13 @@ import {
   user,
 } from "@/lib/db/schema"
 import { eq, desc, sql, and, inArray } from "drizzle-orm"
-import { requireContributorOrAdmin } from "@/lib/auth/guard"
+import { requireModeratorOrAdmin } from "@/lib/auth/guard"
 
 export const adminReportRoutes = new Elysia({ prefix: "/admin", detail: { tags: ["Admin"] } })
   .get(
     "/reports",
     async ({ query, request, set }) => {
-      const guard = await requireContributorOrAdmin(request.headers)
+      const guard = await requireModeratorOrAdmin(request.headers)
       if (!guard.ok) {
         set.status = guard.status
         return { error: guard.error }
@@ -144,7 +144,7 @@ export const adminReportRoutes = new Elysia({ prefix: "/admin", detail: { tags:
   .patch(
     "/reports/:id/status",
     async ({ params, body, request, set }) => {
-      const guard = await requireContributorOrAdmin(request.headers)
+      const guard = await requireModeratorOrAdmin(request.headers)
       if (!guard.ok) {
         set.status = guard.status
         return { error: guard.error }

lib/api/community-suggestions.ts

@@ -2,7 +2,7 @@ import { Elysia, t } from "elysia"
 import { db } from "@/lib/db/index"
 import { communitySuggestions, games, user, suggestionStatusEnum } from "@/lib/db/schema"
 import { eq, and, desc, sql, ilike } from "drizzle-orm"
-import { requireAuth, requireContributorOrAdmin } from "@/lib/auth/guard"
+import { requireAuth, requireModeratorOrAdmin } from "@/lib/auth/guard"
 
 const DISCORD_WEBHOOK_URL = process.env.DISCORD_WEBHOOK_URL
 
@@ -65,7 +65,7 @@ export const communitySuggestionRoutes = new Elysia({
   .get(
     "/admin",
     async ({ query, request, set }) => {
-      const guard = await requireContributorOrAdmin(request.headers)
+      const guard = await requireModeratorOrAdmin(request.headers)
       if (!guard.ok) {
         set.status = guard.status
         return { error: guard.error }
@@ -247,7 +247,7 @@ export const communitySuggestionRoutes = new Elysia({
   .get(
     "/pending",
     async ({ request, set }) => {
-      const guard = await requireContributorOrAdmin(request.headers)
+      const guard = await requireModeratorOrAdmin(request.headers)
       if (!guard.ok) {
         set.status = guard.status
         return { error: guard.error }
@@ -280,7 +280,7 @@ export const communitySuggestionRoutes = new Elysia({
   .patch(
     "/:suggestionId/review",
     async ({ params, body, request, set }) => {
-      const guard = await requireContributorOrAdmin(request.headers)
+      const guard = await requireModeratorOrAdmin(request.headers)
       if (!guard.ok) {
         set.status = guard.status
         return { error: guard.error }