diff --git a/src/lib/auth.ts b/src/lib/auth.ts
index ed02c90..21f8138 100644
--- a/src/lib/auth.ts
+++ b/src/lib/auth.ts
@@ -5,7 +5,7 @@ import { randomBytes } from 'node:crypto';
 export const SESSION_COOKIE = 'session';
 const SESSION_DAYS = 7;
 
-export type Role = 'admin' | 'superuser' | 'user';
+export type Role = 'admin' | 'superuser' | 'user' | 'campus';
 
 export function hashPassword(plain: string): string {
   return bcrypt.hashSync(plain, 12);
@@ -58,6 +58,7 @@ const RULES: [RegExp, Role[]][] = [
   [/^\/api\/admin\/users(\/|$)/, ['admin']],
   [/^\/admin\/content(\/|$)/, ['admin', 'superuser']],
   [/^\/api\/admin\/content(\/|$)/, ['admin', 'superuser']],
+  [/^\/campus(\/|$)/, ['admin', 'campus']],
 ];
 
 export function canAccessAdminPath(role: string, pathname: string): boolean {
@@ -65,6 +66,8 @@ export function canAccessAdminPath(role: string, pathname: string): boolean {
   for (const [re, roles] of RULES) {
     if (re.test(pathname)) return roles.includes(role as Role);
   }
+  // campus vede solo la sua sezione (coperta da RULES) e il logout
+  if (role === 'campus') return pathname === '/admin/logout';
   return true; // blog, upload, logout, showtags: tutti i loggati
 }
 
@@ -105,10 +108,11 @@ export function randomPassword(): string {
 }
 
 export function isRole(v: unknown): v is Role {
-  return v === 'admin' || v === 'superuser' || v === 'user';
+  return v === 'admin' || v === 'superuser' || v === 'user' || v === 'campus';
 }
 
 export function landingFor(role: string): string {
   if (role === 'superuser') return '/admin/content';
+  if (role === 'campus') return '/campus';
   return '/admin';
 }
diff --git a/src/middleware.ts b/src/middleware.ts
index c8c53b5..64fe691 100644
--- a/src/middleware.ts
+++ b/src/middleware.ts
@@ -6,7 +6,8 @@ export const onRequest = defineMiddleware((context, next) => {
   const { pathname } = context.url;
   const isProtected =
     (pathname.startsWith('/admin') && pathname !== '/admin/login') ||
-    pathname.startsWith('/api/admin');
+    pathname.startsWith('/api/admin') ||
+    pathname.startsWith('/campus');
   if (!isProtected) return next();
 
   const token = context.cookies.get(SESSION_COOKIE)?.value;
diff --git a/src/pages/admin/users.astro b/src/pages/admin/users.astro
index e88c746..8e4d6cb 100644
--- a/src/pages/admin/users.astro
+++ b/src/pages/admin/users.astro
@@ -16,6 +16,7 @@ const me = Astro.locals.user!;
     <select class="afield" name="role">
       <option value="user">user</option>
       <option value="superuser">superuser</option>
+      <option value="campus">campus</option>
       <option value="admin">admin</option>
     </select>
     <button class="abtn" type="submit">Crea</button>
@@ -31,7 +32,7 @@ const me = Astro.locals.user!;
           <td>{u.username}{u.id === me.id && ' (tu)'}</td>
           <td>
             <select class="role-sel" data-id={u.id}>
-              {['user', 'superuser', 'admin'].map((r) => <option value={r} selected={u.role === r}>{r}</option>)}
+              {['user', 'superuser', 'campus', 'admin'].map((r) => <option value={r} selected={u.role === r}>{r}</option>)}
             </select>
           </td>
           <td>
diff --git a/tests/auth-campus.test.ts b/tests/auth-campus.test.ts
new file mode 100644
index 0000000..6ccbbac
--- /dev/null
+++ b/tests/auth-campus.test.ts
@@ -0,0 +1,50 @@
+import { describe, it, expect, beforeEach } from 'vitest';
+import type Database from 'better-sqlite3';
+import { createDb } from '../src/lib/db';
+import { createUser, login, getSessionUser, canAccessAdminPath, landingFor, isRole } from '../src/lib/auth';
+
+let db: Database.Database;
+beforeEach(() => { db = createDb(':memory:'); });
+
+describe('ruolo campus', () => {
+  it('createUser accetta campus e getSessionUser lo ritorna', () => {
+    createUser(db, 'c', 'segreta123', 'campus');
+    expect(getSessionUser(db, login(db, 'c', 'segreta123')!)).toMatchObject({ role: 'campus' });
+  });
+
+  it('isRole valida campus', () => {
+    expect(isRole('campus')).toBe(true);
+  });
+
+  it('landingFor porta campus alla sezione campus', () => {
+    expect(landingFor('campus')).toBe('/campus');
+  });
+});
+
+describe('canAccessAdminPath con campus', () => {
+  it('campus: sezione campus e logout sì, resto del pannello no', () => {
+    expect(canAccessAdminPath('campus', '/campus')).toBe(true);
+    expect(canAccessAdminPath('campus', '/campus/')).toBe(true);
+    expect(canAccessAdminPath('campus', '/campus/corso-base/lezione-01')).toBe(true);
+    expect(canAccessAdminPath('campus', '/campus/assets/slide/x.png')).toBe(true);
+    expect(canAccessAdminPath('campus', '/admin/logout')).toBe(true);
+    expect(canAccessAdminPath('campus', '/admin')).toBe(false);
+    expect(canAccessAdminPath('campus', '/admin/new')).toBe(false);
+    expect(canAccessAdminPath('campus', '/admin/content')).toBe(false);
+    expect(canAccessAdminPath('campus', '/admin/users')).toBe(false);
+    expect(canAccessAdminPath('campus', '/api/admin/posts')).toBe(false);
+    expect(canAccessAdminPath('campus', '/api/admin/upload')).toBe(false);
+  });
+
+  it('admin accede alla sezione campus', () => {
+    expect(canAccessAdminPath('admin', '/campus')).toBe(true);
+    expect(canAccessAdminPath('admin', '/campus/corso-base')).toBe(true);
+  });
+
+  it('superuser e user non accedono alla sezione campus', () => {
+    expect(canAccessAdminPath('superuser', '/campus')).toBe(false);
+    expect(canAccessAdminPath('superuser', '/campus/corso-base')).toBe(false);
+    expect(canAccessAdminPath('user', '/campus')).toBe(false);
+    expect(canAccessAdminPath('user', '/campus/assets/slide/x.png')).toBe(false);
+  });
+});