frontend phase 15

client/src/constants/roles.ts

@@ -13,3 +13,19 @@ export const APP_ROLES = {
 export type AppRole = (typeof APP_ROLES)[keyof typeof APP_ROLES];
 
 export const DEFAULT_ROLE: AppRole = APP_ROLES.CUSTOMER;
+
+/**
+ * The server's **fine-grained** admin sub-role codes (b2 `AdminRole` / b15 RBAC). The coarse
+ * `AppRole` collapses all of these to the single ADMIN shell (`toAppRoles`), but the f15 backoffice
+ * needs the fine grain to gate individual consoles (a `support` admin can't run a payout, a
+ * `moderation` admin can't refund). Kept aligned with the auth contract enum — note it is
+ * `moderation`, not `moderator`. Stored raw on the session (`SessionUser.roleCodes`) and read by
+ * `useAdminCapabilities()`.
+ */
+export const ADMIN_ROLE_CODES = ['super_admin', 'admin', 'support', 'finance', 'moderation'] as const;
+
+export type AdminRoleCode = (typeof ADMIN_ROLE_CODES)[number];
+
+export function isAdminRoleCode(code: string): code is AdminRoleCode {
+  return (ADMIN_ROLE_CODES as readonly string[]).includes(code);
+}