feat(admin): add audited Refine staging console

frontend/tests/admin-auth.test.ts

@@ -0,0 +1,49 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { authorizeAdminAccess } from "../src/lib/admin/auth-policy.ts";
+import type { IdentityUser } from "../src/modules/identity/contracts.ts";
+
+function user(role: string[]): IdentityUser {
+  return {
+    id: "11111111-1111-4111-8111-111111111111",
+    email: "admin@example.com",
+    emailVerified: true,
+    name: "Admin",
+    image: null,
+    role,
+  };
+}
+
+test("anonymous admin access is 401", () => {
+  assert.deepEqual(authorizeAdminAccess(null, "read"), {
+    allowed: false,
+    status: 401,
+  });
+});
+
+test("viewer may read but may not write", () => {
+  assert.deepEqual(authorizeAdminAccess(user(["user", "viewer"]), "read"), {
+    allowed: true,
+    role: "viewer",
+  });
+  assert.deepEqual(authorizeAdminAccess(user(["viewer"]), "write"), {
+    allowed: false,
+    status: 403,
+  });
+});
+
+test("admin may read and write while unprivileged users are 403", () => {
+  assert.deepEqual(authorizeAdminAccess(user(["admin"]), "read"), {
+    allowed: true,
+    role: "admin",
+  });
+  assert.deepEqual(authorizeAdminAccess(user(["admin"]), "write"), {
+    allowed: true,
+    role: "admin",
+  });
+  assert.deepEqual(authorizeAdminAccess(user(["user"]), "read"), {
+    allowed: false,
+    status: 403,
+  });
+});