feat(release): prepare 1.1.0 candidate

server/supabase/functions/_shared/admin-current-role.ts

@@ -0,0 +1,22 @@
+import type { SupabaseClient, User } from '@supabase/supabase-js'
+import { AdminPublicError, actorEmail, adminRpcError } from './admin-contract.ts'
+
+export type CurrentAdminRole = 'manager' | 'admin' | 'super_admin'
+
+export async function verifyCurrentAdminActor(
+  serviceClient: SupabaseClient,
+  user: User,
+  minimumRole: CurrentAdminRole = 'manager',
+): Promise<void> {
+  const { data, error } = await serviceClient.rpc('resolve_external_admin_actor_v1', {
+    p_email: actorEmail(user),
+    p_minimum_role: minimumRole,
+  })
+  if (error) throw adminRpcError(error)
+
+  const actor = Array.isArray(data) ? data[0] as Record<string, unknown> | undefined : undefined
+  if (!actor || typeof actor.actor_id !== 'string' ||
+      (actor.actor_role !== 'manager' && actor.actor_role !== 'admin' && actor.actor_role !== 'super_admin')) {
+    throw new AdminPublicError(502, 'invalid_admin_rpc_response')
+  }
+}