From b6bdfb703b6f123940be69c0e2d87e1fb09b1e37 Mon Sep 17 00:00:00 2001
From: "Beau Beauchamp, WebTigers" <beau@webtigers.com>
Date: Wed, 21 Oct 2026 09:55:51 -0400
Subject: [PATCH 1/2] =?UTF-8?q?TIGER-335=20batch=203:=20=5FisAdmin()=20?=
 =?UTF-8?q?=E2=86=92=20=5FisAllowed()=20in=20system=20+=20agent=20(v1.34.0?=
 =?UTF-8?q?)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Mechanical, behavior-preserving conversion off the deprecated comparer across the two largest admin
modules: system (8 services, 37 sites incl. the Sites datatable flag) and agent (17 sites + the
RESOURCE_CHAT capability check → _isAllowed('send', Tiger_Agent::RESOURCE_CHAT)). All services are
wildcard-privilege grants; no acl.ini changes. Tests green: 327.

Closes TIGER-336, TIGER-338.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ASauLLscjqdsNqBNsx2Typ
---
 CHANGELOG.md                          |  8 ++++++
 library/Tiger/Version.php             |  2 +-
 modules/agent/services/Agent.php      |  2 +-
 modules/agent/services/Agents.php     |  6 ++--
 modules/agent/services/Mcp.php        |  8 +++---
 modules/agent/services/Settings.php   |  6 ++--
 modules/agent/services/Skills.php     | 14 +++++-----
 modules/system/services/Acl.php       |  4 +--
 modules/system/services/Dashboard.php |  6 ++--
 modules/system/services/Logs.php      |  2 +-
 modules/system/services/Modules.php   | 40 +++++++++++++--------------
 modules/system/services/Nav.php       |  2 +-
 modules/system/services/Settings.php  |  6 ++--
 modules/system/services/Sites.php     |  8 +++---
 modules/system/services/Updates.php   |  6 ++--
 15 files changed, 64 insertions(+), 56 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index dcc09a0e..25ee8f00 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,14 @@ All notable changes to **Tiger Core** (`webtigers/tiger-core`). Format follows
 
 ## [Unreleased]
 
+## [1.34.0] — 2026-10-21
+
+### Changed
+- **TIGER-335 migration (batch 3)** — `_isAdmin()` → `_isAllowed('<method>')` across **system**
+  (TIGER-336, 8 services incl. the Modules superadmin surface + the Sites datatable flag) and **agent**
+  (TIGER-338, incl. `_isAllowed('send', Tiger_Agent::RESOURCE_CHAT)`). Behavior-preserving; all services
+  are wildcard-privilege grants to their role (admin/superadmin/manager).
+
 ## [1.33.0] — 2026-10-21
 
 ### Changed
diff --git a/library/Tiger/Version.php b/library/Tiger/Version.php
index 31b37c36..fc6cd5bc 100644
--- a/library/Tiger/Version.php
+++ b/library/Tiger/Version.php
@@ -9,5 +9,5 @@
 class Tiger_Version
 {
     /** Current Tiger Core version. Keep in lockstep with the git tag cut for a release. */
-    const VERSION = '1.33.0';
+    const VERSION = '1.34.0';
 }
diff --git a/modules/agent/services/Agent.php b/modules/agent/services/Agent.php
index 49cb8c12..5eb4b33f 100644
--- a/modules/agent/services/Agent.php
+++ b/modules/agent/services/Agent.php
@@ -257,7 +257,7 @@ public function history(array $params): void
     /** The agent must be enabled, connected, and the caller allowed. */
     protected function _ready(): bool
     {
-        if (!$this->_isAdmin(Tiger_Agent::RESOURCE_CHAT, 'send')) {
+        if (!$this->_isAllowed('send', Tiger_Agent::RESOURCE_CHAT)) {
             $this->_error('core.api.error.not_allowed');
             return false;
         }
diff --git a/modules/agent/services/Agents.php b/modules/agent/services/Agents.php
index 674f90dc..9c1dcc40 100644
--- a/modules/agent/services/Agents.php
+++ b/modules/agent/services/Agents.php
@@ -32,7 +32,7 @@ private function _scope(): string
      */
     public function list(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('list')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $agents = [];
         foreach ((new Tiger_Model_Agent())->allForOrg($this->_scope()) as $row) {
@@ -51,7 +51,7 @@ public function list(array $params): void
      */
     public function save(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('save')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $form = new Agent_Form_Agent();
         if (!$form->isValid($params)) { $this->_formErrors($form); return; }
@@ -123,7 +123,7 @@ public function save(array $params): void
      */
     public function delete(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('delete')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $scope   = $this->_scope();
         $model   = new Tiger_Model_Agent();
diff --git a/modules/agent/services/Mcp.php b/modules/agent/services/Mcp.php
index 0afa7da1..2302406a 100644
--- a/modules/agent/services/Mcp.php
+++ b/modules/agent/services/Mcp.php
@@ -15,14 +15,14 @@ class Agent_Service_Mcp extends Tiger_Service_Service
     /** The configured connections (token replaced by a has_token flag). */
     public function connections(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('connections')) { $this->_error('core.api.error.not_allowed'); return; }
         $this->_success(['connections' => Tiger_Agent_Mcp::forAdmin()]);
     }
 
     /** Create or update a connection (a blank token keeps the existing one). */
     public function save(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('save')) { $this->_error('core.api.error.not_allowed'); return; }
         $url = trim((string) ($params['url'] ?? ''));
         if (!preg_match('#^https?://#i', $url)) { $this->_error('agent.mcp.bad_url'); return; }
         $label = trim((string) ($params['label'] ?? ''));
@@ -46,7 +46,7 @@ public function save(array $params): void
     /** Remove a connection. */
     public function remove(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('remove')) { $this->_error('core.api.error.not_allowed'); return; }
         Tiger_Agent_Mcp::remove((string) ($params['id'] ?? ''));
         $this->_success(['connections' => Tiger_Agent_Mcp::forAdmin()], 'agent.mcp.removed');
     }
@@ -54,7 +54,7 @@ public function remove(array $params): void
     /** Test a connection — list its tools live. */
     public function test(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('test')) { $this->_error('core.api.error.not_allowed'); return; }
         $conn = Tiger_Agent_Mcp::connection((string) ($params['id'] ?? ''));
         if ($conn === null) { $this->_error('agent.mcp.not_found'); return; }
 
diff --git a/modules/agent/services/Settings.php b/modules/agent/services/Settings.php
index e8275f8b..e2718c29 100644
--- a/modules/agent/services/Settings.php
+++ b/modules/agent/services/Settings.php
@@ -23,7 +23,7 @@ class Agent_Service_Settings extends Tiger_Service_Service
      */
     public function save(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('save')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $form = new Agent_Form_Settings();
         if (!$form->isValid($params)) { $this->_formErrors($form); return; }
@@ -74,7 +74,7 @@ public function save(array $params): void
      */
     public function mode(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('mode')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $modeMax = (string) ($params['mode_max'] ?? '');
         if (!isset(Tiger_Agent::MODES[$modeMax])) { $modeMax = 'auto'; }
@@ -101,7 +101,7 @@ public function mode(array $params): void
      */
     public function models(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('models')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $provider = preg_replace('/[^a-z]/', '', strtolower((string) ($params['provider'] ?? 'anthropic')));
         if (!array_key_exists($provider, Tiger_Agent_Provider_Factory::options())) {
diff --git a/modules/agent/services/Skills.php b/modules/agent/services/Skills.php
index e63bf882..220ddf5b 100644
--- a/modules/agent/services/Skills.php
+++ b/modules/agent/services/Skills.php
@@ -19,7 +19,7 @@ class Agent_Service_Skills extends Tiger_Service_Service
      */
     public function search(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('search')) { $this->_error('core.api.error.not_allowed'); return; }
         $installed = [];
         foreach (Tiger_Agent_Skills::installed() as $s) { $installed[$s['key']] = true; }
 
@@ -45,7 +45,7 @@ public function search(array $params): void
     /** Installed skills + their active state (drives the "Installed" list). */
     public function installed(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('installed')) { $this->_error('core.api.error.not_allowed'); return; }
         $this->_success(['skills' => Tiger_Agent_Skills::installed()], null);
     }
 
@@ -61,7 +61,7 @@ public function installed(array $params): void
      */
     public function datatable(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('datatable')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $dt      = $this->_dtParams($params);
         $search  = strtolower(trim((string) $dt['search']));
@@ -146,7 +146,7 @@ private function _row($key, $source, $name, $desc, $sourceLabel, $repo, $ref, $p
      */
     public function install(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('install')) { $this->_error('core.api.error.not_allowed'); return; }
         try {
             $keys = [];
             if (!empty($params['url'])) {
@@ -176,7 +176,7 @@ public function install(array $params): void
     /** Turn an installed skill on/off. */
     public function toggle(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('toggle')) { $this->_error('core.api.error.not_allowed'); return; }
         $key = (string) ($params['key'] ?? '');
         if ($key === '' || !Tiger_Agent_Skills::isInstalled($key)) { $this->_error('core.api.error.general'); return; }
         $on = !empty($params['active']) && $params['active'] !== '0' && $params['active'] !== 'false';
@@ -187,7 +187,7 @@ public function toggle(array $params): void
     /** Uninstall a skill (files + active set). */
     public function remove(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('remove')) { $this->_error('core.api.error.not_allowed'); return; }
         $key = (string) ($params['key'] ?? '');
         if ($key === '' || !Tiger_Agent_Skills::isInstalled($key)) { $this->_error('core.api.error.general'); return; }
         Tiger_Agent_Skills::remove($key);
@@ -203,7 +203,7 @@ public function remove(array $params): void
      */
     public function source(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('source')) { $this->_error('core.api.error.not_allowed'); return; }
         $key = (string) ($params['key'] ?? '');
         if ($key !== '' && Tiger_Agent_Skills::isInstalled($key)) {
             $this->_success(['source' => Tiger_Agent_Skills::body($key)], null);
diff --git a/modules/system/services/Acl.php b/modules/system/services/Acl.php
index 215e47c7..883842ee 100644
--- a/modules/system/services/Acl.php
+++ b/modules/system/services/Acl.php
@@ -18,7 +18,7 @@ class System_Service_Acl extends Tiger_Service_Service
      */
     public function simulate(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('simulate')) { $this->_error('core.api.error.not_allowed'); return; }
         $acl = $this->_acl();
         if (!$acl) { $this->_error('system.acl.unavailable'); return; }
 
@@ -37,7 +37,7 @@ public function simulate(array $params): void
      */
     public function catalog(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('catalog')) { $this->_error('core.api.error.not_allowed'); return; }
         $acl = $this->_acl();
         if (!$acl) { $this->_error('system.acl.unavailable'); return; }
 
diff --git a/modules/system/services/Dashboard.php b/modules/system/services/Dashboard.php
index cb84f531..eeb661bc 100644
--- a/modules/system/services/Dashboard.php
+++ b/modules/system/services/Dashboard.php
@@ -25,7 +25,7 @@ class System_Service_Dashboard extends Tiger_Service_Service
      */
     public function saveLayout(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('saveLayout')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $uid = $this->_uid();
         if ($uid === '') { $this->_error('core.api.error.not_allowed'); return; }
@@ -70,7 +70,7 @@ public function saveLayout(array $params): void
      */
     public function saveWidgetPrefs(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('saveWidgetPrefs')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $uid = $this->_uid();
         if ($uid === '') { $this->_error('core.api.error.not_allowed'); return; }
@@ -107,7 +107,7 @@ public function saveWidgetPrefs(array $params): void
      */
     public function widgetBody(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('widgetBody')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $id = (string) ($params['id'] ?? '');
         foreach (Tiger_Dashboard::allowed() as $w) {
diff --git a/modules/system/services/Logs.php b/modules/system/services/Logs.php
index e420b290..201bf367 100644
--- a/modules/system/services/Logs.php
+++ b/modules/system/services/Logs.php
@@ -34,7 +34,7 @@ class System_Service_Logs extends Tiger_Service_Service
      */
     public function search(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }   // defense-in-depth; acl.ini gates to superadmin
+        if (!$this->_isAllowed('search')) { $this->_error('core.api.error.not_allowed'); return; }   // defense-in-depth; acl.ini gates to superadmin
 
         $cfg    = Zend_Registry::get('Zend_Config');
         $logCfg = ($cfg->tiger && $cfg->tiger->log) ? $cfg->tiger->log : null;
diff --git a/modules/system/services/Modules.php b/modules/system/services/Modules.php
index ed6eb846..cc148818 100644
--- a/modules/system/services/Modules.php
+++ b/modules/system/services/Modules.php
@@ -85,7 +85,7 @@ public static function catalog(): array
      */
     public function datatable(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('datatable')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $dt  = $this->_dtParams($params);
         $all = self::catalog();
@@ -241,7 +241,7 @@ public function deactivate(array $params): void { $this->_toggle($params, false)
      */
     public function autoUpdate(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('autoUpdate')) { $this->_error('core.api.error.not_allowed'); return; }
         $slug = preg_replace('/[^a-zA-Z0-9_-]/', '', (string) ($params['slug'] ?? ''));
         if ($slug === '') { $this->_error('core.api.error.general'); return; }
         if (!isset(Tiger_Module_Discovery::all()[$slug])) { $this->_error('system.error.unknown'); return; }
@@ -265,7 +265,7 @@ public function autoUpdate(array $params): void
      */
     public function delete(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('delete')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $slug = preg_replace('/[^a-zA-Z0-9_-]/', '', (string) ($params['slug'] ?? ''));
         if ($slug === '') { $this->_error('core.api.error.general'); return; }
@@ -325,7 +325,7 @@ private static function _deleteToken(array $d): string
 
     protected function _toggle(array $params, $on): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('_toggle')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $slug = preg_replace('/[^a-zA-Z0-9_-]/', '', (string) ($params['slug'] ?? ''));
         if ($slug === '') { $this->_error('core.api.error.general'); return; }
@@ -440,7 +440,7 @@ protected function _toggleTheme($slug, array $d, $on, array $params = []): void
      */
     public function search(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('search')) { $this->_error('core.api.error.not_allowed'); return; }
         $sort    = (string) ($params['sort'] ?? 'featured');
         $refresh = !empty($params['refresh']);   // "Refresh directory" — bypass the 3h cache
 
@@ -467,7 +467,7 @@ public function search(array $params): void
      */
     public function passInfo(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('passInfo')) { $this->_error('core.api.error.not_allowed'); return; }
         $this->_success(['pass' => self::_passState(), 'nag' => self::_passNagState()]);
     }
 
@@ -481,7 +481,7 @@ public function passInfo(array $params): void
      */
     public function snoozePassNag(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('snoozePassNag')) { $this->_error('core.api.error.not_allowed'); return; }
         $uid = self::_currentUserId();
         if ($uid !== '') {
             (new Tiger_Model_Option())->set(Tiger_Model_Option::SCOPE_USER, $uid, self::NAG_DISMISSED_KEY, (string) time());
@@ -498,7 +498,7 @@ public function snoozePassNag(array $params): void
      */
     public function setPassNag(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('setPassNag')) { $this->_error('core.api.error.not_allowed'); return; }
         $uid = self::_currentUserId();
         if ($uid === '') { $this->_error('core.api.error.general'); return; }
         $disabled = in_array((string) ($params['disabled'] ?? ''), ['1', 'true', 'on'], true);
@@ -523,7 +523,7 @@ public function setPassNag(array $params): void
      */
     public function sources(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('sources')) { $this->_error('core.api.error.not_allowed'); return; }
         $this->_success(['sources' => self::_sourceList()]);
     }
 
@@ -537,7 +537,7 @@ public function sources(array $params): void
      */
     public function connectSource(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('connectSource')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $label = trim((string) ($params['label'] ?? ''));
         $url   = trim((string) ($params['url'] ?? ''));
@@ -579,7 +579,7 @@ public function connectSource(array $params): void
      */
     public function updateSource(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('updateSource')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $id = self::_slugId((string) ($params['id'] ?? ''));
         if ($id === '' || !self::_sourceExists($id)) { $this->_error('system.source.err_unknown'); return; }
@@ -608,7 +608,7 @@ public function updateSource(array $params): void
      */
     public function removeSource(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('removeSource')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $id = self::_slugId((string) ($params['id'] ?? ''));
         $src = null;
@@ -668,7 +668,7 @@ protected static function _slugId(string $id): string
      */
     public function activatePass(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('activatePass')) { $this->_error('core.api.error.not_allowed'); return; }
 
         // A TigerPASS key is the license key TigerLicense mints — a lowercase v7 UUID (not a branded
         // "TPASS-…" string). Normalize + shape-check as a UUID before any authority call.
@@ -710,7 +710,7 @@ public function activatePass(array $params): void
      */
     public function deactivatePass(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('deactivatePass')) { $this->_error('core.api.error.not_allowed'); return; }
         Tiger_License_Checker::forget(self::PASS_SLUG);
         $this->_success(['pass' => self::_passState()], 'system.pass.removed');
     }
@@ -825,7 +825,7 @@ protected static function _passConfig(string $key): string
      */
     public function inspect(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('inspect')) { $this->_error('core.api.error.not_allowed'); return; }
 
         // A marketplace (live-api) listing serves its OWN review copy: a paid/PASS module's code repo is
         // private, so its "View more" detail comes from the index (the marketplace vouches for + serves
@@ -953,7 +953,7 @@ protected function _inspectMarketplace(string $slug, string $source): void
      */
     public function install(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('install')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $url = (string) ($params['url'] ?? '');
         if (!Tiger_Module_Github::parseRepo($url)) { $this->_error('system.error.repo_url'); return; }
@@ -978,7 +978,7 @@ public function install(array $params): void
      */
     public function upload(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('upload')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $f = $_FILES['archive'] ?? null;
         if (!is_array($f) || ($f['error'] ?? UPLOAD_ERR_NO_FILE) === UPLOAD_ERR_NO_FILE) {
@@ -1013,7 +1013,7 @@ public function upload(array $params): void
      */
     public function connectVendor(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('connectVendor')) { $this->_error('core.api.error.not_allowed'); return; }
         $vendor = trim((string) ($params['vendor'] ?? ''));
         if ($vendor === '') { $this->_error('system.vendor.required'); return; }
 
@@ -1032,7 +1032,7 @@ public function connectVendor(array $params): void
      */
     public function pinVendor(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('pinVendor')) { $this->_error('core.api.error.not_allowed'); return; }
         $vendor = trim((string) ($params['vendor'] ?? ''));
         if ($vendor === '') { $this->_error('system.vendor.required'); return; }
 
@@ -1056,7 +1056,7 @@ public function pinVendor(array $params): void
      */
     public function installLicensed(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('installLicensed')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $vendor  = trim((string) ($params['vendor'] ?? ''));
         $product = trim((string) ($params['product'] ?? $params['slug'] ?? ''));
diff --git a/modules/system/services/Nav.php b/modules/system/services/Nav.php
index bb0206db..b8275010 100644
--- a/modules/system/services/Nav.php
+++ b/modules/system/services/Nav.php
@@ -25,7 +25,7 @@ class System_Service_Nav extends Tiger_Service_Service
      */
     public function sort(array $params): void
     {
-        if (!$this->_isAdmin()) {
+        if (!$this->_isAllowed('sort')) {
             $this->_error('core.api.error.not_allowed');
             return;
         }
diff --git a/modules/system/services/Settings.php b/modules/system/services/Settings.php
index f94e040e..fb53bda6 100644
--- a/modules/system/services/Settings.php
+++ b/modules/system/services/Settings.php
@@ -21,7 +21,7 @@ class System_Service_Settings extends Tiger_Service_Service
      */
     public function save(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('save')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $form = new System_Form_Settings();
         if (!$form->isValid($params)) { $this->_formErrors($form); return; }
@@ -123,7 +123,7 @@ public function save(array $params): void
      */
     public function locationTest(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('locationTest')) { $this->_error('core.api.error.not_allowed'); return; }
         if (!class_exists('Tiger_Location') || !method_exists('Tiger_Location', 'test')) {
             $this->_error('core.api.error.general'); return;
         }
@@ -176,7 +176,7 @@ protected static function _smtpDestinationChanged(array $params)
 
     public function mailTest(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('mailTest')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $to = trim((string) ($params['to'] ?? ''));
         if ($to === '' || !Zend_Validate::is($to, 'EmailAddress')) {
diff --git a/modules/system/services/Sites.php b/modules/system/services/Sites.php
index 24df09ad..ca6e4191 100644
--- a/modules/system/services/Sites.php
+++ b/modules/system/services/Sites.php
@@ -22,7 +22,7 @@ class System_Service_Sites extends Tiger_Service_Service
      */
     public function datatable(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('datatable')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $dt   = $this->_dtParams($params);
         $data = (new Tiger_Model_SiteDomain())->datatable([
@@ -33,7 +33,7 @@ public function datatable(array $params): void
             'limit'    => $dt['length'],
         ]);
 
-        $canDelete = $this->_isAdmin(static::class, 'delete');
+        $canDelete = $this->_isAllowed('delete');
 
         $rows = [];
         foreach ($data['rows'] as $r) {
@@ -60,7 +60,7 @@ public function datatable(array $params): void
      */
     public function save(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('save')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $form = new System_Form_Site();
         if (!$form->isValid($params)) { $this->_formErrors($form); return; }
@@ -101,7 +101,7 @@ public function save(array $params): void
      */
     public function delete(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('delete')) { $this->_error('core.api.error.not_allowed'); return; }
         $id = !empty($params['site_domain_id']) ? (string) $params['site_domain_id'] : '';
         if ($id === '') { $this->_error('core.api.error.general'); return; }
 
diff --git a/modules/system/services/Updates.php b/modules/system/services/Updates.php
index 9c466e24..c9498aa3 100644
--- a/modules/system/services/Updates.php
+++ b/modules/system/services/Updates.php
@@ -20,7 +20,7 @@ class System_Service_Updates extends Tiger_Service_Service
      */
     public function check(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('check')) { $this->_error('core.api.error.not_allowed'); return; }
         $this->_success(['updates' => Tiger_Update_Checker::all(!empty($params['refresh']))]);
     }
 
@@ -32,7 +32,7 @@ public function check(array $params): void
      */
     public function apply(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('apply')) { $this->_error('core.api.error.not_allowed'); return; }
 
         $slugs = $params['items'] ?? [];
         if (is_string($slugs)) { $slugs = array_filter(array_map('trim', explode(',', $slugs))); }
@@ -130,7 +130,7 @@ public static function runScheduledAutoUpdates(): array
      */
     public function history(array $params): void
     {
-        if (!$this->_isAdmin()) { $this->_error('core.api.error.not_allowed'); return; }
+        if (!$this->_isAllowed('history')) { $this->_error('core.api.error.not_allowed'); return; }
         $limit = (int) ($params['limit'] ?? 20);
         try {
             $this->_success(['history' => (new Tiger_Model_UpdateHistory())->recent($limit)]);

From 185bdbb2d9bc30cf97de76668b86ad8b71c29cc3 Mon Sep 17 00:00:00 2001
From: "Beau Beauchamp, WebTigers" <beau@webtigers.com>
Date: Wed, 21 Oct 2026 10:04:24 -0400
Subject: [PATCH 2/2] ci: re-trigger (unit 8.3 runner stall)