pub fn require_admin(token: &str) -> Result<(), Error>Expand description
Return Ok(()) when the caller carries the admin role (pa_admin);
Err(Error::BadRequest(...)) otherwise.
Use at handler boundaries that restrict an operation to admin users. Centralises the check so a future policy change (e.g. a different admin-role name, or audit-logging on admin access) touches one place.