/auth/lib/acl.php; other repos carry a COPY. // Admin-on-admin checks. Needs acct_admin_level() and json_out() from the site. // An admin may change another account only when their own level is strictly // higher (and may always change themselves). function require_privilege(string $acting_uuid, int $acting_level, string $target_uuid): void { if ($target_uuid === $acting_uuid) return; $target_level = acct_admin_level($target_uuid); if ($target_level >= $acting_level) { json_out(['ok' => false, 'error' => 'insufficient_privilege'], 403); } }