auth/admin_actions.ts

Admin RPC action handlers — admin-only operations exposed on the JSON-RPC surface.

Four action categories:

- Account management: admin_account_list, admin_session_list, admin_session_revoke_all, admin_token_revoke_all. - Audit log reads: audit_log_list, audit_log_permit_history. - Invite CRUD: invite_create, invite_list, invite_delete. - App settings: app_settings_get, app_settings_update (registered only when AdminActionOptions.app_settings is provided — the mutable ref is owned by the server context and shared with signup middleware).

The action specs themselves live in auth/admin_action_specs.ts. Mutations emit matching audit events via audit_log_fire_and_forget.

Authorization is declared at the spec level (auth: {role: 'admin'}) so the RPC dispatcher enforces it before the handler runs and the generated surface accurately reports the requirement. permit_revoke in auth/permit_offer_actions.ts uses the same spec-level pattern even though its sibling methods are authenticated-but-not-admin — the dispatcher checks auth per-spec, so mixed-auth endpoints compose cleanly. Handler-level gates are reserved for input-dependent elevation (e.g. permit_offer_list/_history elevate to admin only when the caller passes an account_id other than their own — an input-dependent check the spec can't express).