feat(auth): classify planning and resource read audiences

packages/api/src/trpc.ts

@@ -124,6 +124,61 @@ export const protectedProcedure = t.procedure.use(withLogging).use(({ ctx, next
   });
 });
 
+/**
+ * Resource overview procedure — requires broad people-directory visibility.
+ * Accepts explicit permission grants, not just elevated roles.
+ */
+export const resourceOverviewProcedure = protectedProcedure.use(({ ctx, next }) => {
+  const user = ctx.dbUser;
+  if (!user) throw new TRPCError({ code: "UNAUTHORIZED" });
+
+  const permissions = resolvePermissions(
+    user.systemRole as SystemRole,
+    user.permissionOverrides as import("@capakraken/shared").PermissionOverrides | null,
+    ctx.roleDefaults ?? undefined,
+  );
+
+  if (
+    !permissions.has(PermissionKey.VIEW_ALL_RESOURCES)
+    && !permissions.has(PermissionKey.MANAGE_RESOURCES)
+  ) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "Resource overview access required",
+    });
+  }
+
+  return next({ ctx: { ...ctx, user, permissions } });
+});
+
+/**
+ * Planning read procedure — allows broad planning/project read access without opening it to all users.
+ * This is an interim audience gate until dedicated project-read permissions exist.
+ */
+export const planningReadProcedure = protectedProcedure.use(({ ctx, next }) => {
+  const user = ctx.dbUser;
+  if (!user) throw new TRPCError({ code: "UNAUTHORIZED" });
+
+  const permissions = resolvePermissions(
+    user.systemRole as SystemRole,
+    user.permissionOverrides as import("@capakraken/shared").PermissionOverrides | null,
+    ctx.roleDefaults ?? undefined,
+  );
+
+  if (
+    !permissions.has(PermissionKey.VIEW_COSTS)
+    && !permissions.has(PermissionKey.MANAGE_PROJECTS)
+    && !permissions.has(PermissionKey.MANAGE_ALLOCATIONS)
+  ) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "Planning read access required",
+    });
+  }
+
+  return next({ ctx: { ...ctx, user, permissions } });
+});
+
 /**
  * Manager procedure — requires MANAGER or ADMIN role.
  */