Ruolo campus: accesso limitato a /campus, landing dedicata

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/lib/auth.ts

@@ -5,7 +5,7 @@ import { randomBytes } from 'node:crypto';
 export const SESSION_COOKIE = 'session';
 const SESSION_DAYS = 7;
 
-export type Role = 'admin' | 'superuser' | 'user';
+export type Role = 'admin' | 'superuser' | 'user' | 'campus';
 
 export function hashPassword(plain: string): string {
   return bcrypt.hashSync(plain, 12);
@@ -58,6 +58,7 @@ const RULES: [RegExp, Role[]][] = [
   [/^\/api\/admin\/users(\/|$)/, ['admin']],
   [/^\/admin\/content(\/|$)/, ['admin', 'superuser']],
   [/^\/api\/admin\/content(\/|$)/, ['admin', 'superuser']],
+  [/^\/campus(\/|$)/, ['admin', 'campus']],
 ];
 
 export function canAccessAdminPath(role: string, pathname: string): boolean {
@@ -65,6 +66,8 @@ export function canAccessAdminPath(role: string, pathname: string): boolean {
   for (const [re, roles] of RULES) {
     if (re.test(pathname)) return roles.includes(role as Role);
   }
+  // campus vede solo la sua sezione (coperta da RULES) e il logout
+  if (role === 'campus') return pathname === '/admin/logout';
   return true; // blog, upload, logout, showtags: tutti i loggati
 }
 
@@ -105,10 +108,11 @@ export function randomPassword(): string {
 }
 
 export function isRole(v: unknown): v is Role {
-  return v === 'admin' || v === 'superuser' || v === 'user';
+  return v === 'admin' || v === 'superuser' || v === 'user' || v === 'campus';
 }
 
 export function landingFor(role: string): string {
   if (role === 'superuser') return '/admin/content';
+  if (role === 'campus') return '/campus';
   return '/admin';
 }