Enforce roleId checks on all admin page actions

src/routes/(protected)/admin/license-keys/+page.server.ts

@@ -1,6 +1,7 @@
 import type { PageServerLoad } from './$types';
 import { prisma } from '$lib/db';
 import { sendMail } from '$lib/server/resend';
+import { isStaff } from '$lib/server/roles';
 import { error } from '@sveltejs/kit';
 
 function generateLicenseKey(): string {
@@ -18,7 +19,7 @@ export const load: PageServerLoad = async () => {
 
 export const actions = {
 	createKey: async ({ request, locals }) => {
-		if (!locals.user) throw error(401, 'Unauthorized');
+		if (!isStaff(locals)) throw error(403, 'Not authorized');
 
 		const formData = await request.formData();
 		const email = formData.get('email')?.toString()?.trim().toLowerCase();
@@ -60,7 +61,7 @@ export const actions = {
 		return { success: true, action: 'createKey' };
 	},
 	replace: async ({ request, locals }) => {
-		if (!locals.user) throw error(401, 'Unauthorized');
+		if (!isStaff(locals)) throw error(403, 'Not authorized');
 
 		const formData = await request.formData();
 		const keyId = formData.get('id')?.toString();