Add moderation permissions and durable player records

src/lib/server/auth/access.ts

@@ -1,4 +1,4 @@
-import type { UserRole } from '../../auth.js';
+import { canModerate, canReadModeration, type UserRole } from '../../auth.js';
 
 export type RoutePermission =
     | 'public'
@@ -7,6 +7,8 @@ export type RoutePermission =
     | 'viewer'
     | 'operator-read'
     | 'admin-read'
+    | 'moderation-read'
+    | 'moderation'
     | 'operator'
     | 'admin';
 
@@ -53,6 +55,9 @@ export function routePermission(routeId: string | null, method: string): RoutePe
     if (routeId === '/api/settings/retention/preview' && method === 'POST') return 'admin-read';
     if (within(routeId, '/api/auth')) return 'admin';
 
+    if (within(routeId, '/moderation') || within(routeId, '/api/moderation'))
+        return reading ? 'moderation-read' : 'moderation';
+
     if (
         within(routeId, '/api/users') ||
         within(routeId, '/settings') ||
@@ -94,11 +99,13 @@ export function routePermission(routeId: string | null, method: string): RoutePe
 
 /** A browser role never substitutes for a machine credential. */
 export function roleAllows(role: UserRole, permission: RoutePermission): boolean {
-    if (!['viewer', 'super_viewer', 'operator', 'admin'].includes(role)) return false;
+    if (!['viewer', 'super_viewer', 'operator', 'moderator', 'admin'].includes(role)) return false;
     if (permission === 'machine') return false;
     if (permission === 'public' || permission === 'authenticated' || permission === 'viewer')
         return true;
     if (permission === 'operator') return role === 'operator' || role === 'admin';
+    if (permission === 'moderation') return canModerate(role);
+    if (permission === 'moderation-read') return canReadModeration(role);
     if (permission === 'operator-read')
         return role === 'super_viewer' || role === 'operator' || role === 'admin';
     if (permission === 'admin-read') return role === 'super_viewer' || role === 'admin';