auth/admin_actions.ts

Admin RPC action handlers — admin-only operations exposed on the JSON-RPC surface.

Four action categories:

• Account management: admin_account_list, admin_session_list, admin_session_revoke_all, admin_token_revoke_all.
• Audit log reads: audit_log_list, audit_log_role_grant_history.
• Invite CRUD: invite_create, invite_list, invite_delete.
• App settings: app_settings_get, app_settings_update. The update handler writes the app_settings row in the database; signup reads the open_signup toggle fresh from that row on every request, so no in-memory state is shared between this surface and signup.

The action specs themselves live in auth/admin_action_specs.ts. Mutations emit matching audit events via deps.audit.emit.

Authorization is declared at the spec level (auth: {role: 'admin'}) so the RPC dispatcher enforces it before the handler runs and the generated surface accurately reports the requirement. role_grant_revoke in auth/role_grant_offer_actions.ts uses the same spec-level pattern even though its sibling methods are authenticated-but-not-admin — the dispatcher checks auth per-spec, so mixed-auth endpoints compose cleanly. Handler-level gates are reserved for input-dependent elevation (e.g. role_grant_offer_list/_history elevate to admin only when the caller passes an account_id other than their own — an input-dependent check the spec can't express).