Enforce roleId checks on all admin page actions

src/routes/(protected)/admin/solfeggio-frequencies/+page.server.ts

@@ -1,5 +1,6 @@
 import type { PageServerLoad } from './$types';
 import { prisma } from '$lib/db';
+import { isAdmin, isStaff } from '$lib/server/roles';
 import { superValidate } from 'sveltekit-superforms/server';
 import { zod4 } from 'sveltekit-superforms/adapters';
 import { z } from 'zod';
@@ -16,7 +17,11 @@ export const load: PageServerLoad = async () => {
 };
 
 export const actions = {
-	upsert: async ({ request }) => {
+	upsert: async ({ request, locals }) => {
+		if (!isStaff(locals)) {
+			return { success: false, action: 'upsert', error: 'Not authorized' };
+		}
+
 		const formData = await request.formData();
 		const form = await superValidate(formData, zod4(SolfeggioSchema));
 		if (!form.valid) {
@@ -48,7 +53,11 @@ export const actions = {
 
 		return { success: true, action: 'upsert' };
 	},
-	delete: async ({ request }) => {
+	delete: async ({ request, locals }) => {
+		if (!isAdmin(locals)) {
+			return { success: false, error: 'Not authorized' };
+		}
+
 		const formData = await request.formData();
 		const rawId = formData.get('id')?.toString();
 		if (!rawId) return { success: false, error: 'Missing id' };