feat(auth): classify planning and resource read audiences

packages/api/src/router/resource.ts

@@ -51,7 +51,7 @@ Write a 2–3 sentence professional bio. Be specific, use skill names. No fluff.
 import { TRPCError } from "@trpc/server";
 import { z } from "zod";
 import { findUniqueOrThrow } from "../db/helpers.js";
-import { adminProcedure, controllerProcedure, createTRPCRouter, managerProcedure, protectedProcedure, requirePermission } from "../trpc.js";
+import { adminProcedure, controllerProcedure, createTRPCRouter, managerProcedure, protectedProcedure, requirePermission, resourceOverviewProcedure } from "../trpc.js";
 import { ROLE_BRIEF_SELECT } from "../db/selects.js";
 import type { TRPCContext } from "../trpc.js";
 
@@ -831,7 +831,7 @@ export const resourceRouter = createTRPCRouter({
       return resource;
     }),
 
-  resolveResponsiblePersonName: protectedProcedure
+  resolveResponsiblePersonName: resourceOverviewProcedure
     .input(z.object({ name: z.string() }))
     .query(async ({ ctx, input }) => {
       const exact = await ctx.db.resource.findFirst({
@@ -1176,7 +1176,7 @@ export const resourceRouter = createTRPCRouter({
       };
     }),
 
-  listSummaries: protectedProcedure
+  listSummaries: resourceOverviewProcedure
     .input(z.object({
       search: z.string().optional(),
       country: z.string().optional(),
@@ -1199,7 +1199,7 @@ export const resourceRouter = createTRPCRouter({
       return resources.map(mapResourceSummary);
     }),
 
-  listSummariesDetail: protectedProcedure
+  listSummariesDetail: resourceOverviewProcedure
     .input(z.object({
       search: z.string().optional(),
       country: z.string().optional(),
@@ -1433,17 +1433,9 @@ export const resourceRouter = createTRPCRouter({
       return { resources, total, page, limit, nextCursor };
     }),
 
-  listStaff: protectedProcedure
+  listStaff: resourceOverviewProcedure
     .input(ResourceListQuerySchema)
-    .query(async ({ ctx, input }) => {
-      if (!canReadAllResources(ctx)) {
-        throw new TRPCError({
-          code: "FORBIDDEN",
-          message: "You need resource overview access to list staff resource data",
-        });
-      }
-      return listStaffResources(ctx, input);
-    }),
+    .query(async ({ ctx, input }) => listStaffResources(ctx, input)),
 
   /** Lightweight resource card for hover tooltips on the timeline. */
   getHoverCard: protectedProcedure