feat: Add staff permissions

.github/workflows/build-lint-test.yml

@@ -22,7 +22,7 @@ jobs:
       - uses: pnpm/action-setup@v4
         name: Install pnpm
         with:
-          version: 11.1.3
+          version: 11.9.0
 
       - name: Install Node.js
         uses: actions/setup-node@v4

.github/workflows/bump_publish.yml

@@ -52,7 +52,7 @@ jobs:
       - uses: pnpm/action-setup@v4
         name: Install pnpm
         with:
-          version: 11.1.3
+          version: 11.9.0
 
       - name: Install Node.js
         uses: actions/setup-node@v4

.gitignore

@@ -28,4 +28,6 @@ yarn-error.log*
 
 # Others
 /docker
-.vercel
+.vercel
+# next-agents-md
+.next-docs/

apps/api/src/locales/@vitnode/blog/en.json

@@ -66,5 +66,15 @@
         }
       }
     }
-  }
+  },
+  "@vitnode/blog:posts": "Posts",
+  "@vitnode/blog:posts:can_view": "View posts list",
+  "@vitnode/blog:posts:can_create": "Create posts",
+  "@vitnode/blog:posts:can_edit": "Edit posts",
+  "@vitnode/blog:posts:can_delete": "Delete posts",
+  "@vitnode/blog:categories": "Categories",
+  "@vitnode/blog:categories:can_view": "View categories list",
+  "@vitnode/blog:categories:can_create": "Create categories",
+  "@vitnode/blog:categories:can_edit": "Edit categories",
+  "@vitnode/blog:categories:can_delete": "Delete categories"
 }

apps/api/src/locales/@vitnode/core/en.json

@@ -1,4 +1,27 @@
 {
+  "@vitnode/core": {
+    "title": "Core"
+  },
+  "@vitnode/core:users": "Users",
+  "@vitnode/core:users:can_view": "View users list",
+  "@vitnode/core:users:can_create": "Create users",
+  "@vitnode/core:users:can_edit": "Edit users",
+  "@vitnode/core:users:can_edit_admin": "Edit users with administrator permission",
+  "@vitnode/core:roles": "Roles",
+  "@vitnode/core:roles:can_manage": "Manage roles",
+  "@vitnode/core:debug": "Debug Panel",
+  "@vitnode/core:debug:can_view": "View debug panel",
+  "@vitnode/core:debug:can_clear_cache": "Clear cache",
+  "@vitnode/core:staff_moderators": "Staff: Moderators",
+  "@vitnode/core:staff_moderators:can_view": "View moderators list",
+  "@vitnode/core:staff_moderators:can_create": "Create moderators",
+  "@vitnode/core:staff_moderators:can_edit": "Edit moderator permissions",
+  "@vitnode/core:staff_moderators:can_delete": "Remove moderators",
+  "@vitnode/core:staff_admins": "Staff: Administrators",
+  "@vitnode/core:staff_admins:can_view": "View administrators list",
+  "@vitnode/core:staff_admins:can_create": "Create administrators",
+  "@vitnode/core:staff_admins:can_edit": "Edit administrator permissions",
+  "@vitnode/core:staff_admins:can_delete": "Remove administrators",
   "core": {
     "global": {
       "close": "Close",
@@ -230,8 +253,12 @@
         "users": {
           "title": "Users",
           "list": "User List",
-          "roles": "Roles",
-          "staff": "Staff"
+          "roles": "Roles"
+        },
+        "staff": {
+          "title": "Staff",
+          "moderators": "Moderators",
+          "admins": "Administrators"
         },
         "user_bar": {
           "home_page": "Home Page",
@@ -362,22 +389,88 @@
     "staff": {
       "title": "Staff",
       "desc": "Manage the staff of your application.",
+      "protected": "Protected",
+      "self": "You cannot edit your own permissions",
+      "delete": {
+        "title": "Remove staff member?",
+        "desc": "This revokes the assigned staff access. This action cannot be undone.",
+        "confirm": "Yes, remove",
+        "success": "Staff member removed."
+      },
       "tabs": {
         "moderators": "Moderators",
         "admins": "Administrators"
       },
       "table": {
         "role": "Role",
         "user": "User",
-        "updatedAt": "Updated At"
+        "permissions": "Permissions",
+        "unrestricted": "Unrestricted",
+        "restricted": "Restricted",
+        "updatedAt": "Updated At",
+        "edit": "Edit permissions"
+      },
+      "edit": {
+        "title": "Edit permissions",
+        "subject": "For",
+        "back": "Back",
+        "save": "Save changes",
+        "success": "Permissions updated successfully.",
+        "error": "Failed to update permissions.",
+        "protected": "This entry is protected and its permissions cannot be edited.",
+        "self": "You cannot edit your own staff permissions, including the entry for your main role.",
+        "no_permissions": "No plugins have declared staff permissions yet.",
+        "select_all": "Enable all",
+        "clear_all": "Disable all",
+        "search_plugins": "Search plugins",
+        "search_empty": "No plugins match your search.",
+        "granted": "{granted}/{total} granted",
+        "requires": "Requires {permission}",
+        "mode": {
+          "label": "Access level",
+          "unrestricted": {
+            "label": "Unrestricted",
+            "desc": "Grant every permission, including ones added later."
+          },
+          "restricted": {
+            "label": "Restricted",
+            "desc": "Choose exactly which permissions apply."
+          }
+        }
+      },
+      "create": {
+        "admins": "Add administrator",
+        "moderators": "Add moderator",
+        "desc": "Grant staff access to a role or a specific user.",
+        "button": "Add member",
+        "back": "Back",
+        "assign_to": "Assign to",
+        "tabs": {
+          "role": "Role",
+          "role_desc": "Grant staff access to everyone with a role.",
+          "user": "User",
+          "user_desc": "Grant staff access to a single person."
+        },
+        "select_role": "Select a role",
+        "search_user": "Search by name or email",
+        "submit": "Add member",
+        "success": "Staff member added.",
+        "error": "Failed to add staff member.",
+        "already_exists": "This role or user is already a staff member."
       },
       "moderators": {
+        "title": "Moderators",
+        "desc": "Manage the moderators of your application.",
+        "create": "Add Moderator",
         "noResults": {
           "title": "No moderators found",
           "description": "Assign a role or user to grant moderator permissions."
         }
       },
       "admins": {
+        "title": "Administrators",
+        "desc": "Manage the administrators of your application.",
+        "create": "Add Administrator",
         "noResults": {
           "title": "No administrators found",
           "description": "Assign a role or user to grant administrator permissions."

apps/docs/content/docs/dev/plugins/admin-page.mdx

@@ -147,6 +147,42 @@ export const blogPlugin = () => {
 };
 ```
 
+#### Gate by permission
+
+To hide a navigation item from admins who lack a [staff permission](/docs/dev/working-with-users/staff-permissions), add a `permission`. It takes `{ module, permission }` — the `plugin` is inferred from your plugin, so you only reference the module and permission id you declared in `permissionStaff`:
+
+```tsx title="plugins/{plugin_name}/src/plugin.tsx"
+import { buildPlugin } from '@vitnode/core/lib/plugin';
+import { ListIcon } from 'lucide-react';
+import { configPlugin } from './config';
+
+export const blogPlugin = () => {
+  return buildPlugin({
+    ...configPlugin,
+    admin: {
+      nav: [
+        {
+          id: 'categories',
+          href: '/admin/blog/categories',
+          icon: <ListIcon />,
+          // [!code ++]
+          permission: { module: 'categories', permission: 'can_view' },
+        },
+      ],
+    },
+  });
+};
+```
+
+The same `permission` field works on nested `items`. A parent item disappears once all of its children are hidden, and items without a `permission` are always shown.
+
+<Callout type="warn">
+  Hiding a nav item only hides the link — it does not protect the route. Guard
+  the page itself and the underlying API too. See [Staff
+  Permissions](/docs/dev/working-with-users/staff-permissions) for the full
+  pattern.
+</Callout>
+
 </Step>
 <Step>
 

apps/docs/content/docs/dev/working-with-users/meta.json

@@ -2,5 +2,5 @@
   "title": "Working with Users",
   "description": "Learn how to manage users and roles in VitNode with our comprehensive guide.",
   "icon": "Users",
-  "pages": ["users", "roles", "..."]
+  "pages": ["users", "roles", "staff-permissions", "..."]
 }