feat(storage): split storage permissions and rework manage-storage UI

Deposits/withdrawals of stock (economy-mutating) are now superuser-only, while moving items around (transfer/place/collect) stays open to logistics-qualified users; seed roles updated to match. ManageStorageDialog reworked alongside its toolbar/button/view wrappers, and the structure page wires up the new permission split.

src/app/(frontend)/logistics/structures/[id]/page.tsx

@@ -21,6 +21,7 @@ import { pluralize } from "@/lib/utils";
 import type { LaborClassificationOption, StructureStaffingOption } from "@/lib/base";
 import { currencyConfigFromGameRules } from "@/lib/banking";
 import { hasLogisticsQualification } from "@/utils/access-control/hasLogisticsQualification";
+import { isSuperuser } from "@/utils/access-control/hasPermission";
 import {
   ArrowLeftIcon,
   BoxIcon,
@@ -183,6 +184,8 @@ export default async function StructureDetailPage({ params }: StructureDetailPag
     };
   });
   const canManage = await hasLogisticsQualification(payload, user);
+  const canManageStorage = await isSuperuser(payload, user);
+  const canTransferStorage = canManageStorage || canManage;
 
   const classificationsRes = await payload.find({
     collection: "labor-classifications",
@@ -307,7 +310,13 @@ export default async function StructureDetailPage({ params }: StructureDetailPag
                 {structure.faction.name}
               </span>
             )}
-            {user && <ManageStorageButton structureId={structure.id} />}
+            {user && (
+              <ManageStorageButton
+                structureId={structure.id}
+                canManage={canManageStorage}
+                canTransfer={canTransferStorage}
+              />
+            )}
           </div>
         </div>
       </header>
@@ -413,7 +422,11 @@ export default async function StructureDetailPage({ params }: StructureDetailPag
         currencyConfig={currencyConfig}
       />
 
-      <StructureStorageView structure={structure} />
+      <StructureStorageView
+        structure={structure}
+        canMutate={canManageStorage}
+        canArrange={canTransferStorage}
+      />
 
       <StorageRules
         allowedStorage={structureType.allowedStorage}

src/app/(frontend)/logistics/structures/actions.ts

@@ -3,7 +3,8 @@
 import config from "@payload-config";
 import { getPayload } from "payload";
 import { GameStructure, Resource, Structure } from "@/payload-types";
-import { hasPermission } from "@/utils/access-control/hasPermission";
+import { isSuperuser } from "@/utils/access-control/hasPermission";
+import { hasLogisticsQualification } from "@/utils/access-control/hasLogisticsQualification";
 import { emitGameEvent } from "@/utils/event-log/emit";
 import { EventTypes } from "@/utils/event-log/eventTypes";
 import { checkStorageDeposit, storageViolationMessage } from "@/lib/storageRules";
@@ -14,6 +15,19 @@ interface ActionResult {
   data?: GameStructure;
 }
 
+type PayloadClient = Awaited<ReturnType<typeof getPayload>>;
+type AuthedUser = Awaited<ReturnType<typeof authenticate>>["user"];
+
+// SECURITY: creates/destroys stored items, overriding economy/production — superusers only
+async function canManageStorage(payload: PayloadClient, user: AuthedUser): Promise<boolean> {
+  return isSuperuser(payload, user);
+}
+
+// SECURITY: conserves quantities (moves items around) — logistics personnel + superusers
+async function canHandleStorage(payload: PayloadClient, user: AuthedUser): Promise<boolean> {
+  return (await isSuperuser(payload, user)) || (await hasLogisticsQualification(payload, user));
+}
+
 async function authenticate() {
   const payloadConfig = await config;
   const payload = await getPayload({ config: payloadConfig });
@@ -74,13 +88,30 @@ export async function addResource(
 ): Promise<ActionResult> {
   try {
     const { payload, user } = await authenticate();
-    if (!(await hasPermission(payload, user, "structures:update"))) {
+    if (!(await canManageStorage(payload, user))) {
       return {
         success: false,
-        error: "Insufficient permissions. User, Admin, or Developer role required.",
+        error: "Only superusers may deposit resources into structures.",
       };
     }
+    return await addResourceInternal(payload, user, structureId, resourceId, amount);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Unknown error";
+    if (message === "Unauthorized") {
+      return { success: false, error: "You must be logged in." };
+    }
+    return { success: false, error: message };
+  }
+}
 
+async function addResourceInternal(
+  payload: PayloadClient,
+  user: AuthedUser,
+  structureId: number,
+  resourceId: number,
+  amount: number,
+): Promise<ActionResult> {
+  try {
     if (amount <= 0) {
       return { success: false, error: "Amount must be greater than zero." };
     }
@@ -264,13 +295,30 @@ export async function removeResource(
 ): Promise<ActionResult> {
   try {
     const { payload, user } = await authenticate();
-    if (!(await hasPermission(payload, user, "structures:update"))) {
+    if (!(await canManageStorage(payload, user))) {
       return {
         success: false,
-        error: "Insufficient permissions. Admin or Developer role required for withdrawal.",
+        error: "Only superusers may withdraw resources from structures.",
       };
     }
+    return await removeResourceInternal(payload, user, structureId, resourceId, amount);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Unknown error";
+    if (message === "Unauthorized") {
+      return { success: false, error: "You must be logged in." };
+    }
+    return { success: false, error: message };
+  }
+}
 
+async function removeResourceInternal(
+  payload: PayloadClient,
+  user: AuthedUser,
+  structureId: number,
+  resourceId: number,
+  amount: number,
+): Promise<ActionResult> {
+  try {
     if (amount <= 0) {
       return { success: false, error: "Amount must be greater than zero." };
     }
@@ -373,10 +421,10 @@ export async function transferResource(
 ): Promise<ActionResult> {
   try {
     const { payload, user } = await authenticate();
-    if (!(await hasPermission(payload, user, "structures:update"))) {
+    if (!(await canHandleStorage(payload, user))) {
       return {
         success: false,
-        error: "Insufficient permissions. User, Admin, or Developer role required for transfer.",
+        error: "Logistics personnel or superuser role required for transfers.",
       };
     }
 
@@ -464,17 +512,23 @@ export async function transferResource(
       };
     }
 
-    // Remove from source
+    // Remove from source (unguarded internal — gate already applied above)
-    const removeResult = await removeResource(fromStructureId, resourceId, amount);
+    const removeResult = await removeResourceInternal(
+      payload,
+      user,
+      fromStructureId,
+      resourceId,
+      amount,
+    );
     if (!removeResult.success) {
       return removeResult;
     }
 
     // Add to destination
-    const addResult = await addResource(toStructureId, resourceId, amount);
+    const addResult = await addResourceInternal(payload, user, toStructureId, resourceId, amount);
     if (!addResult.success) {
       // Rollback: re-add to source
-      await addResource(fromStructureId, resourceId, amount);
+      await addResourceInternal(payload, user, fromStructureId, resourceId, amount);
       return { success: false, error: `Transfer failed at destination: ${addResult.error}` };
     }
 
@@ -524,10 +578,10 @@ export async function placeResourceOnGrid(
 ): Promise<GridActionResult> {
   try {
     const { payload, user } = await authenticate();
-    if (!(await hasPermission(payload, user, "structures:update"))) {
+    if (!(await canManageStorage(payload, user))) {
       return {
         success: false,
-        error: "Insufficient permissions. Admin or Developer role required for placement.",
+        error: "Only superusers may place resources on the storage grid.",
       };
     }
 
@@ -641,10 +695,10 @@ export async function moveGridItem(
 ): Promise<GridActionResult> {
   try {
     const { payload, user } = await authenticate();
-    if (!(await hasPermission(payload, user, "structures:update"))) {
+    if (!(await canHandleStorage(payload, user))) {
       return {
         success: false,
-        error: "Insufficient permissions. User, Admin, or Developer role required.",
+        error: "Logistics personnel or superuser role required.",
       };
     }
     const structure = await getStructure(payload, structureId);
@@ -730,10 +784,10 @@ export async function mergeGridStacks(
 ): Promise<GridActionResult> {
   try {
     const { payload, user } = await authenticate();
-    if (!(await hasPermission(payload, user, "structures:update"))) {
+    if (!(await canHandleStorage(payload, user))) {
       return {
         success: false,
-        error: "Insufficient permissions. User, Admin, or Developer role required.",
+        error: "Logistics personnel or superuser role required.",
       };
     }
     const structure = await getStructure(payload, structureId);
@@ -812,10 +866,10 @@ export async function rotateGridItem(
 ): Promise<GridActionResult> {
   try {
     const { payload, user } = await authenticate();
-    if (!(await hasPermission(payload, user, "structures:update"))) {
+    if (!(await canHandleStorage(payload, user))) {
       return {
         success: false,
-        error: "Insufficient permissions. User, Admin, or Developer role required.",
+        error: "Logistics personnel or superuser role required.",
       };
     }
     const structure = await getStructure(payload, structureId);
@@ -899,10 +953,10 @@ export async function removeGridItem(
 ): Promise<GridActionResult> {
   try {
     const { payload, user } = await authenticate();
-    if (!(await hasPermission(payload, user, "structures:update"))) {
+    if (!(await canManageStorage(payload, user))) {
       return {
         success: false,
-        error: "Insufficient permissions. Admin or Developer role required for removal.",
+        error: "Only superusers may remove items from the storage grid.",
       };
     }
     const structure = await getStructure(payload, structureId);
@@ -953,10 +1007,10 @@ export async function splitGridStack(
 ): Promise<GridActionResult> {
   try {
     const { payload, user } = await authenticate();
-    if (!(await hasPermission(payload, user, "structures:update"))) {
+    if (!(await canHandleStorage(payload, user))) {
       return {
         success: false,
-        error: "Insufficient permissions. User, Admin, or Developer role required.",
+        error: "Logistics personnel or superuser role required.",
       };
     }
 
@@ -1061,8 +1115,8 @@ export async function splitGridStack(
 export async function retrieveFromVoid(structureId: number): Promise<GridActionResult> {
   try {
     const { payload, user } = await authenticate();
-    if (!(await hasPermission(payload, user, "structures:update"))) {
+    if (!(await canHandleStorage(payload, user))) {
-      return { success: false, error: "Insufficient permissions." };
+      return { success: false, error: "Logistics personnel or superuser role required." };
     }
     const structure = await getStructure(payload, structureId);
     const gridW = structure.type.xSize ?? 0;
@@ -1159,10 +1213,10 @@ export async function retrieveFromVoid(structureId: number): Promise<GridActionR
 export async function autoArrangeGrid(structureId: number): Promise<GridActionResult> {
   try {
     const { payload, user } = await authenticate();
-    if (!(await hasPermission(payload, user, "structures:update"))) {
+    if (!(await canHandleStorage(payload, user))) {
       return {
         success: false,
-        error: "Insufficient permissions. User, Admin, or Developer role required.",
+        error: "Logistics personnel or superuser role required.",
       };
     }
     const structure = await getStructure(payload, structureId);

src/components/frontend/storage/GridToolbar.tsx

@@ -24,6 +24,10 @@ interface GridToolbarProps {
   onRotate: (entryId: string) => Promise<void>;
   onRemove: (entryId: string) => Promise<void>;
   onSplit: (entryId: string, amount: number) => Promise<void>;
+  /** Rearranging/rotating/splitting conserves quantities — logistics personnel or superuser. */
+  canArrange?: boolean;
+  /** Removing grid items destroys stored stock — superuser only. */
+  canMutate?: boolean;
 }
 
 export function GridToolbar({
@@ -37,6 +41,8 @@ export function GridToolbar({
   onRotate,
   onRemove,
   onSplit,
+  canArrange = false,
+  canMutate = false,
 }: GridToolbarProps) {
   const occupancy = getGridOccupancy(storedResources, gridWidth, gridHeight);
   const res = selectedItem ? (selectedItem.resource as Resource) : null;
@@ -50,10 +56,12 @@ export function GridToolbar({
     <div className="flex flex-col gap-3">
       <div className="flex items-center justify-between">
         <div className="flex items-center gap-2">
+          {canArrange && (
             <Button variant="outline" size="sm" onClick={onAutoArrange}>
               <ShuffleIcon className="size-3.5 mr-1" />
               Auto-Arrange
             </Button>
+          )}
         </div>
 
         <div className="flex items-center gap-1">
@@ -86,12 +94,12 @@ export function GridToolbar({
             </div>
           </div>
           <div className="flex items-center gap-1">
-            {res.rotatable !== false && (
+            {canArrange && res.rotatable !== false && (
               <Button variant="outline" size="sm" onClick={() => onRotate(selectedItem.id)}>
                 <RotateCwIcon className="size-3.5" />
               </Button>
             )}
-            {res.stackable && selectedItem.amount > 1 && (
+            {canArrange && res.stackable && selectedItem.amount > 1 && (
               <Button
                 variant="outline"
                 size="sm"
@@ -101,9 +109,11 @@ export function GridToolbar({
                 <ScissorsIcon className="size-3.5" />
               </Button>
             )}
+            {canMutate && (
               <Button variant="outline" size="sm" onClick={() => onRemove(selectedItem.id)}>
                 <TrashIcon className="size-3.5" />
               </Button>
+            )}
           </div>
         </div>
       )}

src/components/frontend/storage/ManageStorageButton.tsx

@@ -7,18 +7,32 @@ import { ManageStorageDialog } from "@/components/frontend/storage/ManageStorage
 
 interface ManageStorageButtonProps {
   structureId: number;
+  canManage: boolean;
+  canTransfer: boolean;
 }
 
-export function ManageStorageButton({ structureId }: ManageStorageButtonProps) {
+export function ManageStorageButton({
+  structureId,
+  canManage,
+  canTransfer,
+}: ManageStorageButtonProps) {
   const [open, setOpen] = useState(false);
 
+  if (!canManage && !canTransfer) return null;
+
   return (
     <>
       <Button variant="outline" size="sm" onClick={() => setOpen(true)}>
         <SettingsIcon className="size-3.5 mr-1.5" />
         Manage
       </Button>
-      <ManageStorageDialog structureId={structureId} open={open} onOpenChange={setOpen} />
+      <ManageStorageDialog
+        structureId={structureId}
+        open={open}
+        onOpenChange={setOpen}
+        canManage={canManage}
+        canTransfer={canTransfer}
+      />
     </>
   );
 }

src/components/frontend/storage/ManageStorageDialog.tsx

@@ -46,9 +46,17 @@ interface ManageStorageDialogProps {
   structureId: number;
   open: boolean;
   onOpenChange: (open: boolean) => void;
+  canManage: boolean;
+  canTransfer: boolean;
 }
 
-export function ManageStorageDialog({ structureId, open, onOpenChange }: ManageStorageDialogProps) {
+export function ManageStorageDialog({
+  structureId,
+  open,
+  onOpenChange,
+  canManage,
+  canTransfer,
+}: ManageStorageDialogProps) {
   const [structure, setStructure] = useState<(GameStructure & { type: Structure }) | null>(null);
   const [allStructures, setAllStructures] = useState<(GameStructure & { type: Structure })[]>([]);
   const [allResources, setAllResources] = useState<Resource[]>([]);
@@ -641,22 +649,38 @@ export function ManageStorageDialog({ structureId, open, onOpenChange }: ManageS
                 </div>
               </div>
             )}
-            <Tabs defaultValue="deposit" className="w-full">
+            <Tabs defaultValue={canManage ? "deposit" : "transfer"} className="w-full">
-              <TabsList className="grid w-full grid-cols-3">
+              <TabsList
+                className={cn(
+                  "grid w-full",
+                  canManage && canTransfer
+                    ? "grid-cols-3"
+                    : canManage
+                      ? "grid-cols-2"
+                      : "grid-cols-1",
+                )}
+              >
+                {canManage && (
                   <TabsTrigger value="deposit" className="flex items-center gap-1.5">
                     <ArrowDownToLineIcon className="size-3.5" />
                     Deposit
                   </TabsTrigger>
+                )}
+                {canManage && (
                   <TabsTrigger value="withdraw" className="flex items-center gap-1.5">
                     <ArrowUpFromLineIcon className="size-3.5" />
                     Withdraw
                   </TabsTrigger>
+                )}
+                {canTransfer && (
                   <TabsTrigger value="transfer" className="flex items-center gap-1.5">
                     <ArrowRightLeftIcon className="size-3.5" />
                     Transfer
                   </TabsTrigger>
+                )}
               </TabsList>
 
+              {canManage && (
                 <TabsContent value="deposit" className="flex flex-col gap-4 pt-4">
                   <div className="flex flex-col gap-2">
                     <Label>Resource</Label>
@@ -699,7 +723,9 @@ export function ManageStorageDialog({ structureId, open, onOpenChange }: ManageS
                       min="1"
                       max={getDepositMax()}
                       value={depositAmount}
-                    onChange={(e) => setDepositAmount(clampAmount(e.target.value, getDepositMax()))}
+                      onChange={(e) =>
+                        setDepositAmount(clampAmount(e.target.value, getDepositMax()))
+                      }
                     />
                     {getDepositLimitInfoFor(depositResourceId) !== undefined && (
                       <span className="text-xs text-muted-foreground">
@@ -722,7 +748,9 @@ export function ManageStorageDialog({ structureId, open, onOpenChange }: ManageS
                     Deposit
                   </Button>
                 </TabsContent>
+              )}
 
+              {canManage && (
                 <TabsContent value="withdraw" className="flex flex-col gap-4 pt-4">
                   <div className="flex flex-col gap-2">
                     <Label>Resource</Label>
@@ -783,7 +811,9 @@ export function ManageStorageDialog({ structureId, open, onOpenChange }: ManageS
                     Withdraw
                   </Button>
                 </TabsContent>
+              )}
 
+              {canTransfer && (
                 <TabsContent value="transfer" className="flex flex-col gap-4 pt-4">
                   <div className="flex flex-col gap-2">
                     <Label>Destination</Label>
@@ -900,6 +930,7 @@ export function ManageStorageDialog({ structureId, open, onOpenChange }: ManageS
                     Transfer
                   </Button>
                 </TabsContent>
+              )}
             </Tabs>
           </>
         )}

src/components/frontend/storage/StructureStorageView.tsx

@@ -45,9 +45,17 @@ function getResourceIcon(type: Resource["type"]) {
 
 interface StructureStorageViewProps {
   structure: GameStructure & { type: Structure };
+  /** Rearranging/rotating/splitting conserves quantities — logistics personnel or superuser. */
+  canArrange?: boolean;
+  /** Removing grid items / withdrawing destroys stored stock — superuser only. */
+  canMutate?: boolean;
 }
 
-export function StructureStorageView({ structure }: StructureStorageViewProps) {
+export function StructureStorageView({
+  structure,
+  canArrange = false,
+  canMutate = false,
+}: StructureStorageViewProps) {
   const router = useRouter();
   const [viewMode, setViewMode] = useState<"grid" | "list">("grid");
   const [selectedItem, setSelectedItem] = useState<GridItem | null>(null);
@@ -80,64 +88,72 @@ export function StructureStorageView({ structure }: StructureStorageViewProps) {
 
   const handleMoveItem = useCallback(
     async (entryId: string, gridX: number, gridY: number, rotated?: boolean) => {
+      if (!canArrange) return;
       const result = await moveGridItem(structure.id, entryId, gridX, gridY, rotated);
       if (result.success) refresh();
     },
-    [structure.id, refresh],
+    [structure.id, refresh, canArrange],
   );
 
   const handleMergeStacks = useCallback(
     async (sourceId: string, targetId: string) => {
+      if (!canArrange) return;
       const result = await mergeGridStacks(structure.id, sourceId, targetId);
       if (result.success) refresh();
     },
-    [structure.id, refresh],
+    [structure.id, refresh, canArrange],
   );
 
   const handleRotateItem = useCallback(
     async (entryId: string) => {
+      if (!canArrange) return;
       const result = await rotateGridItem(structure.id, entryId);
       if (result.success) refresh();
     },
-    [structure.id, refresh],
+    [structure.id, refresh, canArrange],
   );
 
   const handleRemoveItem = useCallback(
     async (entryId: string) => {
+      if (!canMutate) return;
       const result = await removeGridItem(structure.id, entryId);
       if (result.success) {
         setSelectedItem(null);
         refresh();
       }
     },
-    [structure.id, refresh],
+    [structure.id, refresh, canMutate],
   );
 
   const handleSplitStack = useCallback(
     async (entryId: string, amount: number) => {
+      if (!canArrange) return;
       const result = await splitGridStack(structure.id, entryId, amount);
       if (result.success) refresh();
     },
-    [structure.id, refresh],
+    [structure.id, refresh, canArrange],
   );
 
   const handleAutoArrange = useCallback(async () => {
+    if (!canArrange) return;
     const result = await autoArrangeGrid(structure.id);
     if (result.success) refresh();
-  }, [structure.id, refresh]);
+  }, [structure.id, refresh, canArrange]);
 
   const handleWithdrawFromVoid = useCallback(
     async (resourceId: number, amount: number) => {
+      if (!canMutate) return;
       const result = await removeResource(structure.id, resourceId, amount);
       if (result.success) refresh();
     },
-    [structure.id, refresh],
+    [structure.id, refresh, canMutate],
   );
 
   const handleRetrieveFromVoid = useCallback(async () => {
+    if (!canArrange) return;
     const result = await retrieveFromVoid(structure.id);
     if (result.success) refresh();
-  }, [structure.id, refresh]);
+  }, [structure.id, refresh, canArrange]);
 
   if (!hasGrid) {
     return (
@@ -179,6 +195,8 @@ export function StructureStorageView({ structure }: StructureStorageViewProps) {
         onRotate={handleRotateItem}
         onRemove={handleRemoveItem}
         onSplit={handleSplitStack}
+        canArrange={canArrange}
+        canMutate={canMutate}
       />
 
       {viewMode === "grid" ? (
@@ -213,6 +231,7 @@ export function StructureStorageView({ structure }: StructureStorageViewProps) {
                 {voidStorageItems.length} item{voidStorageItems.length !== 1 ? "s" : ""}: these no
                 longer fit in the grid.
               </span>
+              {canArrange && (
                 <button
                   type="button"
                   onClick={handleRetrieveFromVoid}
@@ -220,6 +239,7 @@ export function StructureStorageView({ structure }: StructureStorageViewProps) {
                 >
                   Retrieve All to Grid
                 </button>
+              )}
             </ItemDescription>
           </ItemHeader>
           <ItemContent>
@@ -262,6 +282,7 @@ export function StructureStorageView({ structure }: StructureStorageViewProps) {
                           {mass > 0 && `${mass.toLocaleString()} kg`}
                         </div>
                       </div>
+                      {canMutate && (
                         <button
                           type="button"
                           onClick={() => handleWithdrawFromVoid(entry.resourceId, entry.amount)}
@@ -270,6 +291,7 @@ export function StructureStorageView({ structure }: StructureStorageViewProps) {
                         >
                           Withdraw
                         </button>
+                      )}
                     </div>
                     {index < voidStorageItems.length - 1 && <ItemSeparator />}
                   </div>

src/tools/seed/seedRoles.ts

@@ -53,7 +53,6 @@ const USER_PERMISSIONS: Permission[] = [
   "shims:read",
   "shipments:create",
   "shipments:update",
-  "structures:update",
   "structures:delete",
 ];
 
@@ -87,6 +86,7 @@ const ADMIN_PERMISSIONS: Permission[] = [
     "discord:staff",
     "discord:announce",
     "structures:create",
+    "structures:update",
     ...ALL_COLLECTION_READS,
     ...ALL_ADMIN_PAGE_MANAGE,
   ]),