feat: Add authorization checks to admin and player actions

app/actions/admin/matches/index.rb

@@ -7,9 +7,34 @@ module EuchreCamp
         class Index < EuchreCamp::Action
           include Deps[repo: 'repositories.matches']
 
-          def handle(_request, response)
+          def handle(request, response)
+            # Check authorization - view all matches
+            user = current_user(request)
+            unless user && EuchreCamp::Services::Authorization.can?(user, :view_all)
+              response.flash[:error] = 'Access denied'
+              response.redirect_to '/rankings'
+              return
+            end
+
             matches = repo.all
-            response.render(view, matches: matches)
+            enhanced_matches = enhance_matches_with_player_names(matches)
+            response.render(view, matches: enhanced_matches)
+          end
+
+          private
+
+          def enhance_matches_with_player_names(matches)
+            rom = EuchreCamp::App["persistence.rom"]
+            all_players = rom.relations[:players].to_a.to_h { |p| [p[:id], p] }
+
+            matches.map do |match|
+              match.to_h.merge(
+                team_1_p1_name: all_players[match.team_1_p1_id]&.[](:name) || 'Unknown',
+                team_1_p2_name: all_players[match.team_1_p2_id]&.[](:name) || 'Unknown',
+                team_2_p1_name: all_players[match.team_2_p1_id]&.[](:name) || 'Unknown',
+                team_2_p2_name: all_players[match.team_2_p2_id]&.[](:name) || 'Unknown'
+              )
+            end
           end
         end
       end

app/actions/admin/players/edit.rb

@@ -5,7 +5,20 @@ module EuchreCamp
     module Admin
       module Players
         class Edit < EuchreCamp::Action
+          include Deps[players_repo: 'repositories.players']
+
           def handle(request, response)
+            player_id = request.params[:id]
+            player = players_repo.by_id(player_id)
+            user = current_user(request)
+
+            # Authorization: User can edit own profile, or admin can edit any
+            unless authorize(request, response, :edit_own_profile, { id: player_id }) ||
+                   authorize(request, response, :edit_any_record)
+              return
+            end
+
+            render_with_player(request, response, player: player)
           end
         end
       end

app/actions/admin/tournaments/show.rb

@@ -16,6 +16,14 @@ module EuchreCamp
           def handle(request, response)
             tournament_id = request.params[:id]
             tournament = events_repo.by_id(tournament_id)
+            user = current_user(request)
+
+            # Check authorization - tournament admin can manage their tournaments
+            unless user && EuchreCamp::Services::Authorization.can?(user, :manage_tournament, tournament)
+              response.flash[:error] = 'Access denied'
+              response.redirect_to '/rankings'
+              return
+            end
 
             # Get all registered participants for this tournament
             participants = participants_repo.by_event(tournament_id)

app/actions/players/profile.rb

@@ -60,7 +60,7 @@ module EuchreCamp
             won = player_on_team_1 ? (match[:team_1_score] > match[:team_2_score]) : (match[:team_2_score] > match[:team_1_score])
 
             {
-              date: match[:played_at] || match[:created_at],
+              date: match[:played_at],
               team_1: team_1_players,
               team_2: team_2_players,
               score: "#{match[:team_1_score]}-#{match[:team_2_score]}",