Make CMS pages permissions more granular.

app/pages/admin/index.vue

@@ -35,7 +35,7 @@ async function flushCache() {
   <div>
     <h1 class="text-3xl font-bold mb-6">Dashboard</h1>
 
-    <section v-if="hasPermission('pages.manage')" class="border border-(--ui-border) rounded-md p-4 max-w-xl">
+    <section v-if="hasPermission('pages.write')" class="border border-(--ui-border) rounded-md p-4 max-w-xl">
       <h2 class="text-lg font-semibold mb-1">CMS cache</h2>
       <p class="text-sm text-(--ui-text-muted) mb-3">
         Every edit auto-purges the pages it touches. Use this when you've

app/utils/permissions.ts

@@ -10,7 +10,8 @@ export const PERMISSIONS = [
   'roles.view',
   'roles.manage',
   'pages.view',
-  'pages.manage'
+  'pages.write',
+  'pages.publish'
 ] as const
 
 export type Permission = typeof PERMISSIONS[number]
@@ -43,9 +44,13 @@ export const PERMISSION_META: Record<string, { title: string; description: strin
     title: 'View CMS pages',
     description: 'See the CMS pages list and read existing translations.'
   },
-  'pages.manage': {
-    title: 'Manage CMS pages',
-    description: 'Create, edit, publish, translate, and delete CMS pages.'
+  'pages.write': {
+    title: 'Edit CMS pages',
+    description: 'Create, edit, translate, and delete CMS pages, categories, and assets.'
+  },
+  'pages.publish': {
+    title: 'Publish CMS pages',
+    description: 'Publish and unpublish CMS pages.'
   }
 }
 

server/api/admin/cache/flush.post.ts

@@ -11,7 +11,7 @@ import { logEvent } from '../../../utils/activity-logger'
 import { getAuthUser } from '../../../utils/auth'
 
 export default defineEventHandler(async (event) => {
-  await requirePermission(event, 'pages.manage')
+  await requirePermission(event, 'pages.write')
   const user = await getAuthUser(event)
   const count = await purgeAllCmsCache()
   logEvent({

server/api/admin/categories/[id].delete.ts

@@ -8,7 +8,7 @@ import { deleteCategory } from '../../../database/categories'
 import { logDelete } from '../../../utils/activity-logger'
 
 export default defineEventHandler(async (event) => {
-  await requirePermission(event, 'pages.manage')
+  await requirePermission(event, 'pages.write')
   const id = getRouterParam(event, 'id')
   if (!id) throw createError({ statusCode: 400, statusMessage: 'id is required' })
 

server/api/admin/categories/[id].patch.ts

@@ -32,7 +32,7 @@ function normalizeTranslations(
 }
 
 export default defineEventHandler(async (event) => {
-  await requirePermission(event, 'pages.manage')
+  await requirePermission(event, 'pages.write')
   const id = getRouterParam(event, 'id')
   if (!id) throw createError({ statusCode: 400, statusMessage: 'id is required' })
 

server/api/admin/categories/[id]/page-order.patch.ts

@@ -10,7 +10,7 @@ import { reorderCategoryPages, getCategoryPages, purgeSlugs } from '../../../../
 import { logUpdate } from '../../../../utils/activity-logger'
 
 export default defineEventHandler(async (event) => {
-  await requirePermission(event, 'pages.manage')
+  await requirePermission(event, 'pages.write')
   const id = getRouterParam(event, 'id')
   if (!id) throw createError({ statusCode: 400, statusMessage: 'id is required' })
 

server/api/admin/categories/index.post.ts

@@ -37,7 +37,7 @@ function normalizeTranslations(
 }
 
 export default defineEventHandler(async (event) => {
-  await requirePermission(event, 'pages.manage')
+  await requirePermission(event, 'pages.write')
   const body = await readBody<Body>(event)
 
   const slug = (body?.slug ?? '').trim().replace(/^\/+|\/+$/g, '')

server/api/admin/pages/[id].delete.ts

@@ -8,7 +8,7 @@ import { logDelete } from '../../../utils/activity-logger'
 import { purgeCmsPage, purgeCmsCategory } from '../../../utils/cmsCache'
 
 export default defineEventHandler(async (event) => {
-  await requirePermission(event, 'pages.manage')
+  await requirePermission(event, 'pages.write')
   const id = getRouterParam(event, 'id')
   if (!id) throw createError({ statusCode: 400, statusMessage: 'id is required' })
 

server/api/admin/pages/[id].patch.ts

@@ -11,7 +11,7 @@ import { logUpdate } from '../../../utils/activity-logger'
 import { purgeCmsPage } from '../../../utils/cmsCache'
 
 export default defineEventHandler(async (event) => {
-  await requirePermission(event, 'pages.manage')
+  await requirePermission(event, 'pages.write')
   const id = getRouterParam(event, 'id')
   if (!id) throw createError({ statusCode: 400, statusMessage: 'id is required' })
 

server/api/admin/pages/[id]/publish.post.ts

@@ -13,7 +13,7 @@ interface Body {
 }
 
 export default defineEventHandler(async (event) => {
-  await requirePermission(event, 'pages.manage')
+  await requirePermission(event, 'pages.publish')
   const id = getRouterParam(event, 'id')
   if (!id) throw createError({ statusCode: 400, statusMessage: 'id is required' })
 

server/api/admin/pages/[id]/translate.post.ts

@@ -20,7 +20,7 @@ interface Body {
 }
 
 export default defineEventHandler(async (event) => {
-  await requirePermission(event, 'pages.manage')
+  await requirePermission(event, 'pages.write')
   if (!isDeepLConfigured()) {
     throw createError({ statusCode: 500, statusMessage: 'DEEPL_API_KEY is not configured' })
   }

server/api/admin/pages/[id]/translations/[locale].put.ts

@@ -22,7 +22,7 @@ interface Body {
 }
 
 export default defineEventHandler(async (event) => {
-  await requirePermission(event, 'pages.manage')
+  await requirePermission(event, 'pages.write')
   const id = getRouterParam(event, 'id')
   const locale = getRouterParam(event, 'locale')
   if (!id) throw createError({ statusCode: 400, statusMessage: 'id is required' })

server/api/admin/pages/index.post.ts

@@ -9,7 +9,7 @@ import { logCreate } from '../../../utils/activity-logger'
 import { purgeCmsCategory } from '../../../utils/cmsCache'
 
 export default defineEventHandler(async (event) => {
-  await requirePermission(event, 'pages.manage')
+  await requirePermission(event, 'pages.write')
   const body = await readBody<{ slug?: string; category_id?: string | null; menu_order?: number }>(event)
 
   const slug = (body?.slug ?? '').trim().replace(/^\/+|\/+$/g, '')

server/api/admin/upload/image.post.ts

@@ -11,7 +11,7 @@ import { uploadToS3, validateImageType, validateFileSize } from '../../../utils/
 const MAX_IMAGE_MB = 10
 
 export default defineEventHandler(async (event) => {
-  await requirePermission(event, 'pages.manage')
+  await requirePermission(event, 'pages.write')
 
   const form = await readMultipartFormData(event)
   const file = form?.find(p => p.name === 'file')