diff --git a/app/Console/Commands/Test.php b/app/Console/Commands/Test.php
index 30cd7da8..45b77e30 100644
--- a/app/Console/Commands/Test.php
+++ b/app/Console/Commands/Test.php
@@ -78,7 +78,7 @@ class Test extends Command
      */
     public function handle()
     {
-       $r = \Composer\InstalledVersions::getPrettyVersion('filament/filament');
+       $r = NexusDB::cache_get('ssbb');
        dd($r);
     }
 
diff --git a/app/Filament/Resources/System/ExamResource/Pages/CreateExam.php b/app/Filament/Resources/System/ExamResource/Pages/CreateExam.php
index 675aaa7a..897b48b7 100644
--- a/app/Filament/Resources/System/ExamResource/Pages/CreateExam.php
+++ b/app/Filament/Resources/System/ExamResource/Pages/CreateExam.php
@@ -17,7 +17,7 @@ class CreateExam extends CreateRecord
 //        dd($data);
         $examRep = new ExamRepository();
         try {
-            $examRep->store($data);
+            $this->record = $examRep->store($data);
             $this->notify('success', $this->getCreatedNotificationMessage());
             if ($another) {
                 // Ensure that the form record is anonymized so that relationships aren't loaded.
diff --git a/app/Filament/Resources/System/ExamResource/Pages/EditExam.php b/app/Filament/Resources/System/ExamResource/Pages/EditExam.php
index 95d1fedc..a29a2ba9 100644
--- a/app/Filament/Resources/System/ExamResource/Pages/EditExam.php
+++ b/app/Filament/Resources/System/ExamResource/Pages/EditExam.php
@@ -23,7 +23,7 @@ class EditExam extends EditRecord
         $data = $this->form->getState();
         $examRep = new ExamRepository();
         try {
-            $examRep->update($data, $this->record->id);
+            $this->record = $examRep->update($data, $this->record->id);
             $this->notify('success', $this->getSavedNotificationMessage());
             $this->redirect($this->getResource()::getUrl('index'));
         } catch (\Exception $exception) {
diff --git a/app/Filament/Resources/System/MedalResource/Pages/CreateMedal.php b/app/Filament/Resources/System/MedalResource/Pages/CreateMedal.php
index f927f58b..0c952f5f 100644
--- a/app/Filament/Resources/System/MedalResource/Pages/CreateMedal.php
+++ b/app/Filament/Resources/System/MedalResource/Pages/CreateMedal.php
@@ -9,4 +9,9 @@ use Filament\Resources\Pages\CreateRecord;
 class CreateMedal extends CreateRecord
 {
     protected static string $resource = MedalResource::class;
+
+    protected function getRedirectUrl(): string
+    {
+        return $this->getResource()::getUrl('index');
+    }
 }
diff --git a/app/Filament/Resources/System/TorrentStateResource.php b/app/Filament/Resources/System/TorrentStateResource.php
new file mode 100644
index 00000000..60015652
--- /dev/null
+++ b/app/Filament/Resources/System/TorrentStateResource.php
@@ -0,0 +1,81 @@
+<?php
+
+namespace App\Filament\Resources\System;
+
+use App\Filament\Resources\System\TorrentStateResource\Pages;
+use App\Filament\Resources\System\TorrentStateResource\RelationManagers;
+use App\Models\Torrent;
+use App\Models\TorrentState;
+use Filament\Forms;
+use Filament\Resources\Form;
+use Filament\Resources\Resource;
+use Filament\Resources\Table;
+use Filament\Tables;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\SoftDeletingScope;
+use Nexus\Database\NexusDB;
+
+class TorrentStateResource extends Resource
+{
+    protected static ?string $model = TorrentState::class;
+
+    protected static ?string $navigationIcon = 'heroicon-o-speakerphone';
+
+    protected static ?string $navigationGroup = 'System';
+
+    protected static ?int $navigationSort = 99;
+
+    protected static function getNavigationLabel(): string
+    {
+        return __('admin.sidebar.torrent_state');
+    }
+
+    public static function getBreadcrumb(): string
+    {
+        return self::getNavigationLabel();
+    }
+
+    public static function form(Form $form): Form
+    {
+        return $form
+            ->schema([
+                Forms\Components\Select::make('global_sp_state')
+                    ->options(Torrent::listPromotionTypes(true))
+                    ->label(__('label.torrent_state.global_sp_state'))
+                    ->required(),
+                Forms\Components\DateTimePicker::make('deadline')
+                    ->required()
+                    ->label(__('label.deadline')),
+            ])->columns(1);
+    }
+
+    public static function table(Table $table): Table
+    {
+        return $table
+            ->columns([
+                Tables\Columns\TextColumn::make('global_sp_state_text')->label(__('label.torrent_state.global_sp_state')),
+                Tables\Columns\TextColumn::make('deadline')->label(__('label.deadline')),
+            ])
+            ->filters([
+                //
+            ])
+            ->actions([
+                Tables\Actions\EditAction::make()->after(function () {
+                    do_log("cache_del: global_promotion_state");
+                    NexusDB::cache_del('global_promotion_state');
+                    NexusDB::cache_del('global_promotion_state_deadline');
+                }),
+//                Tables\Actions\DeleteAction::make(),
+            ])
+            ->bulkActions([
+//                Tables\Actions\DeleteBulkAction::make(),
+            ]);
+    }
+
+    public static function getPages(): array
+    {
+        return [
+            'index' => Pages\ManageTorrentStates::route('/'),
+        ];
+    }
+}
diff --git a/app/Filament/Resources/System/TorrentStateResource/Pages/ManageTorrentStates.php b/app/Filament/Resources/System/TorrentStateResource/Pages/ManageTorrentStates.php
new file mode 100644
index 00000000..910afc6b
--- /dev/null
+++ b/app/Filament/Resources/System/TorrentStateResource/Pages/ManageTorrentStates.php
@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Filament\Resources\System\TorrentStateResource\Pages;
+
+use App\Filament\Resources\System\TorrentStateResource;
+use Filament\Pages\Actions;
+use Filament\Resources\Pages\ManageRecords;
+use Nexus\Database\NexusDB;
+
+class ManageTorrentStates extends ManageRecords
+{
+    protected static string $resource = TorrentStateResource::class;
+
+    protected function getActions(): array
+    {
+        return [
+//            Actions\CreateAction::make(),
+        ];
+    }
+
+    protected function isTablePaginationEnabled(): bool
+    {
+        return false;
+    }
+
+}
diff --git a/app/Filament/Resources/User/UserResource/Pages/UserProfile.php b/app/Filament/Resources/User/UserResource/Pages/UserProfile.php
index b371a1ac..a3f11fb2 100644
--- a/app/Filament/Resources/User/UserResource/Pages/UserProfile.php
+++ b/app/Filament/Resources/User/UserResource/Pages/UserProfile.php
@@ -6,6 +6,7 @@ use App\Filament\Resources\User\UserResource;
 use App\Models\Medal;
 use App\Models\User;
 use App\Repositories\ExamRepository;
+use App\Repositories\MedalRepository;
 use App\Repositories\UserRepository;
 use Filament\Resources\Pages\Concerns\HasRelationManagers;
 use Filament\Resources\Pages\Concerns\InteractsWithRecord;
@@ -36,7 +37,12 @@ class UserProfile extends Page
 
     public function mount($record)
     {
-        $this->updateRecord($record);
+        static::authorizeResourceAccess();
+
+        $this->record = $this->resolveRecord($record);
+
+        abort_unless(static::getResource()::canView($this->getRecord()), 403);
+
     }
 
     protected function getActions(): array
@@ -196,9 +202,9 @@ class UserProfile extends Page
 
             ])
             ->action(function ($data) {
-                $examRep = new ExamRepository();
+                $medalRep = new MedalRepository();
                 try {
-                    $examRep->assignToUser($this->record->id, $data['exam_id'], $data['begin'], $data['end']);
+                    $medalRep->grantToUser($this->record->id, $data['medal_id'], $data['duration']);
                     $this->notify('success', 'Success!');
                     $this->emitSelf(self::EVENT_RECORD_UPDATED, $this->record->id);
                 } catch (\Exception $exception) {
diff --git a/app/Models/TorrentState.php b/app/Models/TorrentState.php
index fbe8f7b7..f0d32f1b 100644
--- a/app/Models/TorrentState.php
+++ b/app/Models/TorrentState.php
@@ -5,7 +5,12 @@ namespace App\Models;
 
 class TorrentState extends NexusModel
 {
-    public $incrementing = false;
+    protected $fillable = ['global_sp_state', 'deadline'];
 
     protected $table = 'torrents_state';
+
+    public function getGlobalSpStateTextAttribute()
+    {
+        return Torrent::$promotionTypes[$this->global_sp_state]['text'] ?? '';
+    }
 }
diff --git a/app/Models/User.php b/app/Models/User.php
index 0727ee13..d7217bca 100644
--- a/app/Models/User.php
+++ b/app/Models/User.php
@@ -17,10 +17,11 @@ use Laravel\Sanctum\HasApiTokens;
 use Nexus\Database\NexusDB;
 use Filament\Models\Contracts\FilamentUser;
 use Filament\Models\Contracts\HasName;
+use Spatie\Permission\Traits\HasRoles;
 
 class User extends Authenticatable implements FilamentUser, HasName
 {
-    use HasFactory, Notifiable, HasApiTokens;
+    use HasFactory, Notifiable, HasApiTokens, HasRoles;
 
     public $timestamps = false;
 
@@ -476,7 +477,7 @@ class User extends Authenticatable implements FilamentUser, HasName
 
     public function canAccessAdmin(): bool
     {
-        $targetClass = self::CLASS_SYSOP;
+        $targetClass = Setting::get('authority.staffmem');
         if (!$this->class || $this->class < $targetClass) {
             do_log(sprintf('user: %s, no class or class < %s, can not access admin.', $this->id, $targetClass));
             return false;
diff --git a/app/Policies/AgentAllowPolicy.php b/app/Policies/AgentAllowPolicy.php
new file mode 100644
index 00000000..6385e586
--- /dev/null
+++ b/app/Policies/AgentAllowPolicy.php
@@ -0,0 +1,102 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\AgentAllow;
+use App\Models\User;
+use Illuminate\Auth\Access\HandlesAuthorization;
+
+class AgentAllowPolicy extends BasePolicy
+{
+    use HandlesAuthorization;
+
+    /**
+     * Determine whether the user can view any models.
+     *
+     * @param  \App\Models\User  $user
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function viewAny(User $user)
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can view the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\AgentAllow  $agentAllow
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function view(User $user, AgentAllow $agentAllow)
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can create models.
+     *
+     * @param  \App\Models\User  $user
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function create(User $user)
+    {
+        return $this->can($user);
+    }
+
+    /**
+     * Determine whether the user can update the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\AgentAllow  $agentAllow
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function update(User $user, AgentAllow $agentAllow)
+    {
+        return $this->can($user);
+    }
+
+    /**
+     * Determine whether the user can delete the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\AgentAllow  $agentAllow
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function delete(User $user, AgentAllow $agentAllow)
+    {
+        return $this->can($user);
+    }
+
+    /**
+     * Determine whether the user can restore the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\AgentAllow  $agentAllow
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function restore(User $user, AgentAllow $agentAllow)
+    {
+        //
+    }
+
+    /**
+     * Determine whether the user can permanently delete the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\AgentAllow  $agentAllow
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function forceDelete(User $user, AgentAllow $agentAllow)
+    {
+        //
+    }
+
+    private function can(User $user)
+    {
+        if ($user->class >= User::CLASS_SYSOP) {
+            return true;
+        }
+        return false;
+    }
+}
diff --git a/app/Policies/AgentDenyPolicy.php b/app/Policies/AgentDenyPolicy.php
new file mode 100644
index 00000000..95ac94b2
--- /dev/null
+++ b/app/Policies/AgentDenyPolicy.php
@@ -0,0 +1,102 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\AgentDeny;
+use App\Models\User;
+use Illuminate\Auth\Access\HandlesAuthorization;
+
+class AgentDenyPolicy extends BasePolicy
+{
+    use HandlesAuthorization;
+
+    /**
+     * Determine whether the user can view any models.
+     *
+     * @param  \App\Models\User  $user
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function viewAny(User $user)
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can view the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\AgentDeny  $agentDeny
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function view(User $user, AgentDeny $agentDeny)
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can create models.
+     *
+     * @param  \App\Models\User  $user
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function create(User $user)
+    {
+        return $this->can($user);
+    }
+
+    /**
+     * Determine whether the user can update the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\AgentDeny  $agentDeny
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function update(User $user, AgentDeny $agentDeny)
+    {
+        return $this->can($user);
+    }
+
+    /**
+     * Determine whether the user can delete the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\AgentDeny  $agentDeny
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function delete(User $user, AgentDeny $agentDeny)
+    {
+        return $this->can($user);
+    }
+
+    /**
+     * Determine whether the user can restore the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\AgentDeny  $agentDeny
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function restore(User $user, AgentDeny $agentDeny)
+    {
+        //
+    }
+
+    /**
+     * Determine whether the user can permanently delete the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\AgentDeny  $agentDeny
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function forceDelete(User $user, AgentDeny $agentDeny)
+    {
+        //
+    }
+
+    private function can(User $user)
+    {
+        if ($user->class >= User::CLASS_SYSOP) {
+            return true;
+        }
+        return false;
+    }
+}
diff --git a/app/Policies/BasePolicy.php b/app/Policies/BasePolicy.php
new file mode 100644
index 00000000..08a2d5f7
--- /dev/null
+++ b/app/Policies/BasePolicy.php
@@ -0,0 +1,20 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\User;
+
+class BasePolicy
+{
+    /**
+     * @param  \App\Models\User  $user
+     * @param  string  $ability
+     * @return void|bool
+     */
+    public function before(User $user, $ability)
+    {
+        if ($user->class >= User::CLASS_STAFF_LEADER) {
+            return true;
+        }
+    }
+}
diff --git a/app/Policies/ClaimPolicy.php b/app/Policies/ClaimPolicy.php
new file mode 100644
index 00000000..5bc77d12
--- /dev/null
+++ b/app/Policies/ClaimPolicy.php
@@ -0,0 +1,102 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\Claim;
+use App\Models\User;
+use Illuminate\Auth\Access\HandlesAuthorization;
+
+class ClaimPolicy extends BasePolicy
+{
+    use HandlesAuthorization;
+
+    /**
+     * Determine whether the user can view any models.
+     *
+     * @param  \App\Models\User  $user
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function viewAny(User $user)
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can view the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\Claim  $claim
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function view(User $user, Claim $claim)
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can create models.
+     *
+     * @param  \App\Models\User  $user
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function create(User $user)
+    {
+        return $this->can($user);
+    }
+
+    /**
+     * Determine whether the user can update the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\Claim  $claim
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function update(User $user, Claim $claim)
+    {
+        return $this->can($user);
+    }
+
+    /**
+     * Determine whether the user can delete the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\Claim  $claim
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function delete(User $user, Claim $claim)
+    {
+        return $this->can($user);
+    }
+
+    /**
+     * Determine whether the user can restore the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\Claim  $claim
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function restore(User $user, Claim $claim)
+    {
+        //
+    }
+
+    /**
+     * Determine whether the user can permanently delete the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\Claim  $claim
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function forceDelete(User $user, Claim $claim)
+    {
+        //
+    }
+
+    private function can(User $user)
+    {
+        if ($user->class >= User::CLASS_SYSOP) {
+            return true;
+        }
+        return false;
+    }
+}
diff --git a/app/Policies/ExamPolicy.php b/app/Policies/ExamPolicy.php
new file mode 100644
index 00000000..0722c67a
--- /dev/null
+++ b/app/Policies/ExamPolicy.php
@@ -0,0 +1,102 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\Exam;
+use App\Models\User;
+use Illuminate\Auth\Access\HandlesAuthorization;
+
+class ExamPolicy extends BasePolicy
+{
+    use HandlesAuthorization;
+
+    /**
+     * Determine whether the user can view any models.
+     *
+     * @param  \App\Models\User  $user
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function viewAny(User $user)
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can view the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\Exam  $exam
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function view(User $user, Exam $exam)
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can create models.
+     *
+     * @param  \App\Models\User  $user
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function create(User $user)
+    {
+        return $this->can($user);
+    }
+
+    /**
+     * Determine whether the user can update the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\Exam  $exam
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function update(User $user, Exam $exam)
+    {
+        return $this->can($user);
+    }
+
+    /**
+     * Determine whether the user can delete the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\Exam  $exam
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function delete(User $user, Exam $exam)
+    {
+        return $this->can($user);
+    }
+
+    /**
+     * Determine whether the user can restore the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\Exam  $exam
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function restore(User $user, Exam $exam)
+    {
+        //
+    }
+
+    /**
+     * Determine whether the user can permanently delete the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\Exam  $exam
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function forceDelete(User $user, Exam $exam)
+    {
+        //
+    }
+
+    private function can(User $user)
+    {
+        if ($user->class >= User::CLASS_SYSOP) {
+            return true;
+        }
+        return false;
+    }
+}
diff --git a/app/Policies/ExamUserPolicy.php b/app/Policies/ExamUserPolicy.php
new file mode 100644
index 00000000..0d08f874
--- /dev/null
+++ b/app/Policies/ExamUserPolicy.php
@@ -0,0 +1,102 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\ExamUser;
+use App\Models\User;
+use Illuminate\Auth\Access\HandlesAuthorization;
+
+class ExamUserPolicy extends BasePolicy
+{
+    use HandlesAuthorization;
+
+    /**
+     * Determine whether the user can view any models.
+     *
+     * @param  \App\Models\User  $user
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function viewAny(User $user)
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can view the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\ExamUser  $examUser
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function view(User $user, ExamUser $examUser)
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can create models.
+     *
+     * @param  \App\Models\User  $user
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function create(User $user)
+    {
+        return $this->can($user);
+    }
+
+    /**
+     * Determine whether the user can update the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\ExamUser  $examUser
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function update(User $user, ExamUser $examUser)
+    {
+        return $this->can($user);
+    }
+
+    /**
+     * Determine whether the user can delete the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\ExamUser  $examUser
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function delete(User $user, ExamUser $examUser)
+    {
+        return $this->can($user);
+    }
+
+    /**
+     * Determine whether the user can restore the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\ExamUser  $examUser
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function restore(User $user, ExamUser $examUser)
+    {
+        //
+    }
+
+    /**
+     * Determine whether the user can permanently delete the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\ExamUser  $examUser
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function forceDelete(User $user, ExamUser $examUser)
+    {
+        //
+    }
+
+    private function can(User $user)
+    {
+        if ($user->class >= User::CLASS_SYSOP) {
+            return true;
+        }
+        return false;
+    }
+}
diff --git a/app/Policies/HitAndRunPolicy.php b/app/Policies/HitAndRunPolicy.php
new file mode 100644
index 00000000..1a1131ed
--- /dev/null
+++ b/app/Policies/HitAndRunPolicy.php
@@ -0,0 +1,102 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\HitAndRun;
+use App\Models\User;
+use Illuminate\Auth\Access\HandlesAuthorization;
+
+class HitAndRunPolicy extends BasePolicy
+{
+    use HandlesAuthorization;
+
+    /**
+     * Determine whether the user can view any models.
+     *
+     * @param  \App\Models\User  $user
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function viewAny(User $user)
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can view the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\HitAndRun  $hitAndRun
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function view(User $user, HitAndRun $hitAndRun)
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can create models.
+     *
+     * @param  \App\Models\User  $user
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function create(User $user)
+    {
+        return $this->can($user);
+    }
+
+    /**
+     * Determine whether the user can update the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\HitAndRun  $hitAndRun
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function update(User $user, HitAndRun $hitAndRun)
+    {
+        return $this->can($user);
+    }
+
+    /**
+     * Determine whether the user can delete the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\HitAndRun  $hitAndRun
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function delete(User $user, HitAndRun $hitAndRun)
+    {
+        return $this->can($user);
+    }
+
+    /**
+     * Determine whether the user can restore the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\HitAndRun  $hitAndRun
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function restore(User $user, HitAndRun $hitAndRun)
+    {
+        //
+    }
+
+    /**
+     * Determine whether the user can permanently delete the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\HitAndRun  $hitAndRun
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function forceDelete(User $user, HitAndRun $hitAndRun)
+    {
+        //
+    }
+
+    private function can(User $user)
+    {
+        if ($user->class >= User::CLASS_SYSOP) {
+            return true;
+        }
+        return false;
+    }
+}
diff --git a/app/Policies/MedalPolicy.php b/app/Policies/MedalPolicy.php
new file mode 100644
index 00000000..568fe00b
--- /dev/null
+++ b/app/Policies/MedalPolicy.php
@@ -0,0 +1,102 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\Medal;
+use App\Models\User;
+use Illuminate\Auth\Access\HandlesAuthorization;
+
+class MedalPolicy extends BasePolicy
+{
+    use HandlesAuthorization;
+
+    /**
+     * Determine whether the user can view any models.
+     *
+     * @param  \App\Models\User  $user
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function viewAny(User $user)
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can view the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\Medal  $medal
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function view(User $user, Medal $medal)
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can create models.
+     *
+     * @param  \App\Models\User  $user
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function create(User $user)
+    {
+        return $this->can($user);
+    }
+
+    /**
+     * Determine whether the user can update the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\Medal  $medal
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function update(User $user, Medal $medal)
+    {
+        return $this->can($user);
+    }
+
+    /**
+     * Determine whether the user can delete the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\Medal  $medal
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function delete(User $user, Medal $medal)
+    {
+        return $this->can($user);
+    }
+
+    /**
+     * Determine whether the user can restore the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\Medal  $medal
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function restore(User $user, Medal $medal)
+    {
+        //
+    }
+
+    /**
+     * Determine whether the user can permanently delete the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\Medal  $medal
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function forceDelete(User $user, Medal $medal)
+    {
+        //
+    }
+
+    private function can(User $user)
+    {
+        if ($user->class >= User::CLASS_SYSOP) {
+            return true;
+        }
+        return false;
+    }
+}
diff --git a/app/Policies/SettingPolicy.php b/app/Policies/SettingPolicy.php
new file mode 100644
index 00000000..d6fd797d
--- /dev/null
+++ b/app/Policies/SettingPolicy.php
@@ -0,0 +1,103 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\Setting;
+use App\Models\User;
+use Illuminate\Auth\Access\HandlesAuthorization;
+
+class SettingPolicy extends BasePolicy
+{
+    use HandlesAuthorization;
+
+    /**
+     * Determine whether the user can view any models.
+     *
+     * @param  \App\Models\User  $user
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function viewAny(User $user)
+    {
+        //
+    }
+
+    /**
+     * Determine whether the user can view the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\Setting  $setting
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function view(User $user, Setting $setting)
+    {
+        //
+    }
+
+    /**
+     * Determine whether the user can create models.
+     *
+     * @param  \App\Models\User  $user
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function create(User $user)
+    {
+        //
+    }
+
+    /**
+     * Determine whether the user can update the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\Setting  $setting
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function update(User $user, Setting $setting)
+    {
+        //
+    }
+
+    /**
+     * Determine whether the user can delete the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\Setting  $setting
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function delete(User $user, Setting $setting)
+    {
+        //
+    }
+
+    /**
+     * Determine whether the user can restore the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\Setting  $setting
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function restore(User $user, Setting $setting)
+    {
+        //
+    }
+
+    /**
+     * Determine whether the user can permanently delete the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\Setting  $setting
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function forceDelete(User $user, Setting $setting)
+    {
+        //
+    }
+
+    private function can(User $user)
+    {
+        if ($user->class >= User::CLASS_SYSOP) {
+            return true;
+        }
+        return false;
+    }
+
+}
diff --git a/app/Policies/TagPolicy.php b/app/Policies/TagPolicy.php
new file mode 100644
index 00000000..8fb7316e
--- /dev/null
+++ b/app/Policies/TagPolicy.php
@@ -0,0 +1,102 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\Tag;
+use App\Models\User;
+use Illuminate\Auth\Access\HandlesAuthorization;
+
+class TagPolicy extends BasePolicy
+{
+    use HandlesAuthorization;
+
+    /**
+     * Determine whether the user can view any models.
+     *
+     * @param  \App\Models\User  $user
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function viewAny(User $user)
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can view the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\Tag  $tag
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function view(User $user, Tag $tag)
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can create models.
+     *
+     * @param  \App\Models\User  $user
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function create(User $user)
+    {
+        return $this->can($user);
+    }
+
+    /**
+     * Determine whether the user can update the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\Tag  $tag
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function update(User $user, Tag $tag)
+    {
+        return $this->can($user);
+    }
+
+    /**
+     * Determine whether the user can delete the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\Tag  $tag
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function delete(User $user, Tag $tag)
+    {
+        return $this->can($user);
+    }
+
+    /**
+     * Determine whether the user can restore the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\Tag  $tag
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function restore(User $user, Tag $tag)
+    {
+        //
+    }
+
+    /**
+     * Determine whether the user can permanently delete the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\Tag  $tag
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function forceDelete(User $user, Tag $tag)
+    {
+        //
+    }
+
+    private function can(User $user)
+    {
+        if ($user->class >= User::CLASS_ADMINISTRATOR) {
+            return true;
+        }
+        return false;
+    }
+}
diff --git a/app/Policies/TorrentPolicy.php b/app/Policies/TorrentPolicy.php
new file mode 100644
index 00000000..1a60b993
--- /dev/null
+++ b/app/Policies/TorrentPolicy.php
@@ -0,0 +1,102 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\Torrent;
+use App\Models\User;
+use Illuminate\Auth\Access\HandlesAuthorization;
+
+class TorrentPolicy extends BasePolicy
+{
+    use HandlesAuthorization;
+
+    /**
+     * Determine whether the user can view any models.
+     *
+     * @param  \App\Models\User  $user
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function viewAny(User $user)
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can view the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\Torrent  $torrent
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function view(User $user, Torrent $torrent)
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can create models.
+     *
+     * @param  \App\Models\User  $user
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function create(User $user)
+    {
+        //
+    }
+
+    /**
+     * Determine whether the user can update the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\Torrent  $torrent
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function update(User $user, Torrent $torrent)
+    {
+        //
+    }
+
+    /**
+     * Determine whether the user can delete the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\Torrent  $torrent
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function delete(User $user, Torrent $torrent)
+    {
+        //
+    }
+
+    /**
+     * Determine whether the user can restore the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\Torrent  $torrent
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function restore(User $user, Torrent $torrent)
+    {
+        //
+    }
+
+    /**
+     * Determine whether the user can permanently delete the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\Torrent  $torrent
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function forceDelete(User $user, Torrent $torrent)
+    {
+        //
+    }
+
+    private function can(User $user)
+    {
+        if ($user->class >= User::CLASS_SYSOP) {
+            return true;
+        }
+        return false;
+    }
+}
diff --git a/app/Policies/TorrentStatePolicy.php b/app/Policies/TorrentStatePolicy.php
new file mode 100644
index 00000000..c4b3671e
--- /dev/null
+++ b/app/Policies/TorrentStatePolicy.php
@@ -0,0 +1,95 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\TorrentState;
+use App\Models\User;
+use Illuminate\Auth\Access\HandlesAuthorization;
+
+class TorrentStatePolicy extends BasePolicy
+{
+    use HandlesAuthorization;
+
+
+    /**
+     * Determine whether the user can view any models.
+     *
+     * @param  \App\Models\User  $user
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function viewAny(User $user)
+    {
+        //
+    }
+
+    /**
+     * Determine whether the user can view the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\TorrentState  $torrentState
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function view(User $user, TorrentState $torrentState)
+    {
+        //
+    }
+
+    /**
+     * Determine whether the user can create models.
+     *
+     * @param  \App\Models\User  $user
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function create(User $user)
+    {
+        //
+    }
+
+    /**
+     * Determine whether the user can update the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\TorrentState  $torrentState
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function update(User $user, TorrentState $torrentState)
+    {
+        //
+    }
+
+    /**
+     * Determine whether the user can delete the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\TorrentState  $torrentState
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function delete(User $user, TorrentState $torrentState)
+    {
+        //
+    }
+
+    /**
+     * Determine whether the user can restore the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\TorrentState  $torrentState
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function restore(User $user, TorrentState $torrentState)
+    {
+        //
+    }
+
+    /**
+     * Determine whether the user can permanently delete the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\TorrentState  $torrentState
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function forceDelete(User $user, TorrentState $torrentState)
+    {
+        //
+    }
+}
diff --git a/app/Policies/UserMedalPolicy.php b/app/Policies/UserMedalPolicy.php
new file mode 100644
index 00000000..0ce8067b
--- /dev/null
+++ b/app/Policies/UserMedalPolicy.php
@@ -0,0 +1,102 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\User;
+use App\Models\UserMedal;
+use Illuminate\Auth\Access\HandlesAuthorization;
+
+class UserMedalPolicy extends BasePolicy
+{
+    use HandlesAuthorization;
+
+    /**
+     * Determine whether the user can view any models.
+     *
+     * @param  \App\Models\User  $user
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function viewAny(User $user)
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can view the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\UserMedal  $userMedal
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function view(User $user, UserMedal $userMedal)
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can create models.
+     *
+     * @param  \App\Models\User  $user
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function create(User $user)
+    {
+        return $this->can($user);
+    }
+
+    /**
+     * Determine whether the user can update the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\UserMedal  $userMedal
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function update(User $user, UserMedal $userMedal)
+    {
+        return $this->can($user);
+    }
+
+    /**
+     * Determine whether the user can delete the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\UserMedal  $userMedal
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function delete(User $user, UserMedal $userMedal)
+    {
+        return $this->can($user);
+    }
+
+    /**
+     * Determine whether the user can restore the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\UserMedal  $userMedal
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function restore(User $user, UserMedal $userMedal)
+    {
+        //
+    }
+
+    /**
+     * Determine whether the user can permanently delete the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\UserMedal  $userMedal
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function forceDelete(User $user, UserMedal $userMedal)
+    {
+        //
+    }
+
+    private function can(User $user)
+    {
+        if ($user->class >= User::CLASS_SYSOP) {
+            return true;
+        }
+        return false;
+    }
+}
diff --git a/app/Policies/UserPolicy.php b/app/Policies/UserPolicy.php
new file mode 100644
index 00000000..9f3fce00
--- /dev/null
+++ b/app/Policies/UserPolicy.php
@@ -0,0 +1,101 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\User;
+use Illuminate\Auth\Access\HandlesAuthorization;
+
+class UserPolicy extends BasePolicy
+{
+    use HandlesAuthorization;
+
+    /**
+     * Determine whether the user can view any models.
+     *
+     * @param  \App\Models\User  $user
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function viewAny(User $user)
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can view the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\User  $model
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function view(User $user, User $model)
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can create models.
+     *
+     * @param  \App\Models\User  $user
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function create(User $user)
+    {
+        return $this->can($user);
+    }
+
+    /**
+     * Determine whether the user can update the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\User  $model
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function update(User $user, User $model)
+    {
+        return $this->can($user);
+    }
+
+    /**
+     * Determine whether the user can delete the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\User  $model
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function delete(User $user, User $model)
+    {
+        return $this->can($user);
+    }
+
+    /**
+     * Determine whether the user can restore the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\User  $model
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function restore(User $user, User $model)
+    {
+        //
+    }
+
+    /**
+     * Determine whether the user can permanently delete the model.
+     *
+     * @param  \App\Models\User  $user
+     * @param  \App\Models\User  $model
+     * @return \Illuminate\Auth\Access\Response|bool
+     */
+    public function forceDelete(User $user, User $model)
+    {
+        //
+    }
+
+    private function can(User $user)
+    {
+        if ($user->class >= User::CLASS_SYSOP) {
+            return true;
+        }
+        return false;
+    }
+}
diff --git a/composer.json b/composer.json
index f806f5d8..c31fa0c8 100644
--- a/composer.json
+++ b/composer.json
@@ -49,6 +49,7 @@
         "orangehill/iseed": "^3.0",
         "phpgangsta/googleauthenticator": "dev-master",
         "rhilip/bencode": "^2.0",
+        "spatie/laravel-permission": "^5.5",
         "spiral/roadrunner": "^2.8"
     },
     "require-dev": {
diff --git a/composer.lock b/composer.lock
index 63d07265..a452c95b 100644
--- a/composer.lock
+++ b/composer.lock
@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "3f8e2bfc2d866abff6ef37466f43be7c",
+    "content-hash": "7a9971b631dca4a5322634b89075a35b",
     "packages": [
         {
             "name": "akaunting/laravel-money",
@@ -6181,6 +6181,94 @@
             ],
             "time": "2022-06-28T14:29:26+00:00"
         },
+        {
+            "name": "spatie/laravel-permission",
+            "version": "5.5.5",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/spatie/laravel-permission.git",
+                "reference": "f2303a70be60919811ca8afc313e8244fda00974"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/spatie/laravel-permission/zipball/f2303a70be60919811ca8afc313e8244fda00974",
+                "reference": "f2303a70be60919811ca8afc313e8244fda00974",
+                "shasum": "",
+                "mirrors": [
+                    {
+                        "url": "https://mirrors.aliyun.com/composer/dists/%package%/%reference%.%type%",
+                        "preferred": true
+                    }
+                ]
+            },
+            "require": {
+                "illuminate/auth": "^7.0|^8.0|^9.0",
+                "illuminate/container": "^7.0|^8.0|^9.0",
+                "illuminate/contracts": "^7.0|^8.0|^9.0",
+                "illuminate/database": "^7.0|^8.0|^9.0",
+                "php": "^7.3|^8.0|^8.1"
+            },
+            "require-dev": {
+                "orchestra/testbench": "^5.0|^6.0|^7.0",
+                "phpunit/phpunit": "^9.4",
+                "predis/predis": "^1.1"
+            },
+            "type": "library",
+            "extra": {
+                "laravel": {
+                    "providers": [
+                        "Spatie\\Permission\\PermissionServiceProvider"
+                    ]
+                },
+                "branch-alias": {
+                    "dev-main": "5.x-dev",
+                    "dev-master": "5.x-dev"
+                }
+            },
+            "autoload": {
+                "files": [
+                    "src/helpers.php"
+                ],
+                "psr-4": {
+                    "Spatie\\Permission\\": "src"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Freek Van der Herten",
+                    "email": "freek@spatie.be",
+                    "homepage": "https://spatie.be",
+                    "role": "Developer"
+                }
+            ],
+            "description": "Permission handling for Laravel 6.0 and up",
+            "homepage": "https://github.com/spatie/laravel-permission",
+            "keywords": [
+                "acl",
+                "laravel",
+                "permission",
+                "permissions",
+                "rbac",
+                "roles",
+                "security",
+                "spatie"
+            ],
+            "support": {
+                "issues": "https://github.com/spatie/laravel-permission/issues",
+                "source": "https://github.com/spatie/laravel-permission/tree/5.5.5"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/spatie",
+                    "type": "github"
+                }
+            ],
+            "time": "2022-06-29T23:11:42+00:00"
+        },
         {
             "name": "spiral/goridge",
             "version": "v3.1.2",
@@ -12771,5 +12859,5 @@
         "ext-xml": "*"
     },
     "platform-dev": [],
-    "plugin-api-version": "2.3.0"
+    "plugin-api-version": "2.2.0"
 }
diff --git a/config/permission.php b/config/permission.php
new file mode 100644
index 00000000..5b6e184c
--- /dev/null
+++ b/config/permission.php
@@ -0,0 +1,161 @@
+<?php
+
+return [
+
+    'models' => [
+
+        /*
+         * When using the "HasPermissions" trait from this package, we need to know which
+         * Eloquent model should be used to retrieve your permissions. Of course, it
+         * is often just the "Permission" model but you may use whatever you like.
+         *
+         * The model you want to use as a Permission model needs to implement the
+         * `Spatie\Permission\Contracts\Permission` contract.
+         */
+
+        'permission' => Spatie\Permission\Models\Permission::class,
+
+        /*
+         * When using the "HasRoles" trait from this package, we need to know which
+         * Eloquent model should be used to retrieve your roles. Of course, it
+         * is often just the "Role" model but you may use whatever you like.
+         *
+         * The model you want to use as a Role model needs to implement the
+         * `Spatie\Permission\Contracts\Role` contract.
+         */
+
+        'role' => Spatie\Permission\Models\Role::class,
+
+    ],
+
+    'table_names' => [
+
+        /*
+         * When using the "HasRoles" trait from this package, we need to know which
+         * table should be used to retrieve your roles. We have chosen a basic
+         * default value but you may easily change it to any table you like.
+         */
+
+        'roles' => 'roles',
+
+        /*
+         * When using the "HasPermissions" trait from this package, we need to know which
+         * table should be used to retrieve your permissions. We have chosen a basic
+         * default value but you may easily change it to any table you like.
+         */
+
+        'permissions' => 'permissions',
+
+        /*
+         * When using the "HasPermissions" trait from this package, we need to know which
+         * table should be used to retrieve your models permissions. We have chosen a
+         * basic default value but you may easily change it to any table you like.
+         */
+
+        'model_has_permissions' => 'model_has_permissions',
+
+        /*
+         * When using the "HasRoles" trait from this package, we need to know which
+         * table should be used to retrieve your models roles. We have chosen a
+         * basic default value but you may easily change it to any table you like.
+         */
+
+        'model_has_roles' => 'model_has_roles',
+
+        /*
+         * When using the "HasRoles" trait from this package, we need to know which
+         * table should be used to retrieve your roles permissions. We have chosen a
+         * basic default value but you may easily change it to any table you like.
+         */
+
+        'role_has_permissions' => 'role_has_permissions',
+    ],
+
+    'column_names' => [
+        /*
+         * Change this if you want to name the related pivots other than defaults
+         */
+        'role_pivot_key' => null, //default 'role_id',
+        'permission_pivot_key' => null, //default 'permission_id',
+
+        /*
+         * Change this if you want to name the related model primary key other than
+         * `model_id`.
+         *
+         * For example, this would be nice if your primary keys are all UUIDs. In
+         * that case, name this `model_uuid`.
+         */
+
+        'model_morph_key' => 'model_id',
+
+        /*
+         * Change this if you want to use the teams feature and your related model's
+         * foreign key is other than `team_id`.
+         */
+
+        'team_foreign_key' => 'team_id',
+    ],
+
+    /*
+     * When set to true, the method for checking permissions will be registered on the gate.
+     * Set this to false, if you want to implement custom logic for checking permissions.
+     */
+
+    'register_permission_check_method' => true,
+
+    /*
+     * When set to true the package implements teams using the 'team_foreign_key'. If you want
+     * the migrations to register the 'team_foreign_key', you must set this to true
+     * before doing the migration. If you already did the migration then you must make a new
+     * migration to also add 'team_foreign_key' to 'roles', 'model_has_roles', and
+     * 'model_has_permissions'(view the latest version of package's migration file)
+     */
+
+    'teams' => false,
+
+    /*
+     * When set to true, the required permission names are added to the exception
+     * message. This could be considered an information leak in some contexts, so
+     * the default setting is false here for optimum safety.
+     */
+
+    'display_permission_in_exception' => false,
+
+    /*
+     * When set to true, the required role names are added to the exception
+     * message. This could be considered an information leak in some contexts, so
+     * the default setting is false here for optimum safety.
+     */
+
+    'display_role_in_exception' => false,
+
+    /*
+     * By default wildcard permission lookups are disabled.
+     */
+
+    'enable_wildcard_permission' => false,
+
+    'cache' => [
+
+        /*
+         * By default all permissions are cached for 24 hours to speed up performance.
+         * When permissions or roles are updated the cache is flushed automatically.
+         */
+
+        'expiration_time' => \DateInterval::createFromDateString('24 hours'),
+
+        /*
+         * The cache key used to store all permissions.
+         */
+
+        'key' => 'spatie.permission.cache',
+
+        /*
+         * You may optionally indicate a specific cache driver to use for permission and
+         * role caching using any of the `store` drivers listed in the cache.php config
+         * file. Using 'default' here means to use the `default` set in cache.php.
+         */
+
+        'store' => 'default',
+    ],
+];
diff --git a/database/migrations/2022_07_08_215348_add_deadline_to_torrents_state_table.php b/database/migrations/2022_07_08_215348_add_deadline_to_torrents_state_table.php
new file mode 100644
index 00000000..dc8112aa
--- /dev/null
+++ b/database/migrations/2022_07_08_215348_add_deadline_to_torrents_state_table.php
@@ -0,0 +1,33 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     *
+     * @return void
+     */
+    public function up()
+    {
+        Schema::table('torrents_state', function (Blueprint $table) {
+            $table->id();
+            $table->dateTime('deadline')->nullable();
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     *
+     * @return void
+     */
+    public function down()
+    {
+        Schema::table('torrents_state', function (Blueprint $table) {
+            $table->dropColumn(['id', 'deadline']);
+        });
+    }
+};
diff --git a/database/migrations/2022_07_09_011856_create_permission_tables.php b/database/migrations/2022_07_09_011856_create_permission_tables.php
new file mode 100644
index 00000000..f3711956
--- /dev/null
+++ b/database/migrations/2022_07_09_011856_create_permission_tables.php
@@ -0,0 +1,141 @@
+<?php
+
+use Illuminate\Support\Facades\Schema;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Database\Migrations\Migration;
+use Spatie\Permission\PermissionRegistrar;
+
+class CreatePermissionTables extends Migration
+{
+    /**
+     * Run the migrations.
+     *
+     * @return void
+     */
+    public function up()
+    {
+        $tableNames = config('permission.table_names');
+        $columnNames = config('permission.column_names');
+        $teams = config('permission.teams');
+
+        if (empty($tableNames)) {
+            throw new \Exception('Error: config/permission.php not loaded. Run [php artisan config:clear] and try again.');
+        }
+        if ($teams && empty($columnNames['team_foreign_key'] ?? null)) {
+            throw new \Exception('Error: team_foreign_key on config/permission.php not loaded. Run [php artisan config:clear] and try again.');
+        }
+
+        Schema::create($tableNames['permissions'], function (Blueprint $table) {
+            $table->bigIncrements('id'); // permission id
+            $table->string('name', 125);       // For MySQL 8.0 use string('name', 125);
+            $table->string('guard_name', 125); // For MySQL 8.0 use string('guard_name', 125);
+            $table->timestamps();
+
+            $table->unique(['name', 'guard_name']);
+        });
+
+        Schema::create($tableNames['roles'], function (Blueprint $table) use ($teams, $columnNames) {
+            $table->bigIncrements('id'); // role id
+            if ($teams || config('permission.testing')) { // permission.testing is a fix for sqlite testing
+                $table->unsignedBigInteger($columnNames['team_foreign_key'])->nullable();
+                $table->index($columnNames['team_foreign_key'], 'roles_team_foreign_key_index');
+            }
+            $table->string('name', 125);       // For MySQL 8.0 use string('name', 125);
+            $table->string('guard_name', 125); // For MySQL 8.0 use string('guard_name', 125);
+            $table->timestamps();
+            if ($teams || config('permission.testing')) {
+                $table->unique([$columnNames['team_foreign_key'], 'name', 'guard_name']);
+            } else {
+                $table->unique(['name', 'guard_name']);
+            }
+        });
+
+        Schema::create($tableNames['model_has_permissions'], function (Blueprint $table) use ($tableNames, $columnNames, $teams) {
+            $table->unsignedBigInteger(PermissionRegistrar::$pivotPermission);
+
+            $table->string('model_type');
+            $table->unsignedBigInteger($columnNames['model_morph_key']);
+            $table->index([$columnNames['model_morph_key'], 'model_type'], 'model_has_permissions_model_id_model_type_index');
+
+            $table->foreign(PermissionRegistrar::$pivotPermission)
+                ->references('id') // permission id
+                ->on($tableNames['permissions'])
+                ->onDelete('cascade');
+            if ($teams) {
+                $table->unsignedBigInteger($columnNames['team_foreign_key']);
+                $table->index($columnNames['team_foreign_key'], 'model_has_permissions_team_foreign_key_index');
+
+                $table->primary([$columnNames['team_foreign_key'], PermissionRegistrar::$pivotPermission, $columnNames['model_morph_key'], 'model_type'],
+                    'model_has_permissions_permission_model_type_primary');
+            } else {
+                $table->primary([PermissionRegistrar::$pivotPermission, $columnNames['model_morph_key'], 'model_type'],
+                    'model_has_permissions_permission_model_type_primary');
+            }
+
+        });
+
+        Schema::create($tableNames['model_has_roles'], function (Blueprint $table) use ($tableNames, $columnNames, $teams) {
+            $table->unsignedBigInteger(PermissionRegistrar::$pivotRole);
+
+            $table->string('model_type');
+            $table->unsignedBigInteger($columnNames['model_morph_key']);
+            $table->index([$columnNames['model_morph_key'], 'model_type'], 'model_has_roles_model_id_model_type_index');
+
+            $table->foreign(PermissionRegistrar::$pivotRole)
+                ->references('id') // role id
+                ->on($tableNames['roles'])
+                ->onDelete('cascade');
+            if ($teams) {
+                $table->unsignedBigInteger($columnNames['team_foreign_key']);
+                $table->index($columnNames['team_foreign_key'], 'model_has_roles_team_foreign_key_index');
+
+                $table->primary([$columnNames['team_foreign_key'], PermissionRegistrar::$pivotRole, $columnNames['model_morph_key'], 'model_type'],
+                    'model_has_roles_role_model_type_primary');
+            } else {
+                $table->primary([PermissionRegistrar::$pivotRole, $columnNames['model_morph_key'], 'model_type'],
+                    'model_has_roles_role_model_type_primary');
+            }
+        });
+
+        Schema::create($tableNames['role_has_permissions'], function (Blueprint $table) use ($tableNames) {
+            $table->unsignedBigInteger(PermissionRegistrar::$pivotPermission);
+            $table->unsignedBigInteger(PermissionRegistrar::$pivotRole);
+
+            $table->foreign(PermissionRegistrar::$pivotPermission)
+                ->references('id') // permission id
+                ->on($tableNames['permissions'])
+                ->onDelete('cascade');
+
+            $table->foreign(PermissionRegistrar::$pivotRole)
+                ->references('id') // role id
+                ->on($tableNames['roles'])
+                ->onDelete('cascade');
+
+            $table->primary([PermissionRegistrar::$pivotPermission, PermissionRegistrar::$pivotRole], 'role_has_permissions_permission_id_role_id_primary');
+        });
+
+        app('cache')
+            ->store(config('permission.cache.store') != 'default' ? config('permission.cache.store') : null)
+            ->forget(config('permission.cache.key'));
+    }
+
+    /**
+     * Reverse the migrations.
+     *
+     * @return void
+     */
+    public function down()
+    {
+        $tableNames = config('permission.table_names');
+
+        if (empty($tableNames)) {
+            throw new \Exception('Error: config/permission.php not found and defaults could not be merged. Please publish the package configuration before proceeding, or drop the tables manually.');
+        }
+
+        Schema::drop($tableNames['role_has_permissions']);
+        Schema::drop($tableNames['model_has_roles']);
+        Schema::drop($tableNames['model_has_permissions']);
+        Schema::drop($tableNames['roles']);
+        Schema::drop($tableNames['permissions']);
+    }
+}
diff --git a/include/functions.php b/include/functions.php
index 48af7714..e8944e98 100644
--- a/include/functions.php
+++ b/include/functions.php
@@ -1939,7 +1939,7 @@ function get_user_row($id)
 }
 
 function userlogin() {
-    do_log("COOKIE:" . json_encode($_COOKIE) . ", uid: " . (isset($_COOKIE['c_secure_uid']) ? base64($_COOKIE["c_secure_uid"],false) : ''));
+//    do_log("COOKIE:" . json_encode($_COOKIE) . ", uid: " . (isset($_COOKIE['c_secure_uid']) ? base64($_COOKIE["c_secure_uid"],false) : ''));
     static $loginResult;
     if (!is_null($loginResult)) {
         return $loginResult;
@@ -2637,7 +2637,7 @@ else {
                 <font class='color_connectable'><?php echo $lang_functions['text_connectable'] ?></font><?php echo $connectable?> <?php echo maxslots();?>
                 <?php if(\App\Models\HitAndRun::getIsEnabled()) { ?><font class='color_bonus'>H&R: </font> <?php echo sprintf('[<a href="myhr.php">%s</a>]', (new \App\Repositories\HitAndRunRepository())->getStatusStats($CURUSER['id']))?><?php }?>
                 <?php if(\App\Models\Claim::getConfigIsEnabled()) { ?><font class='color_bonus'><?php echo $lang_functions['menu_claim']?></font> <?php echo sprintf('[<a href="claim.php?uid=%s">%s</a>]', $CURUSER['id'], (new \App\Repositories\ClaimRepository())->getStats($CURUSER['id']))?><?php }?>
-                <?php if(get_user_class() >= UC_SYSOP) printf('[<a href="%s" target="_blank">%s</a>]', nexus_env('FILAMENT_PATH', 'nexusphp'), $lang_functions['text_management_system'])?>
+                <?php if(get_user_class() >= get_setting('authority.staffmem')) printf('[<a href="%s" target="_blank">%s</a>]', nexus_env('FILAMENT_PATH', 'nexusphp'), $lang_functions['text_management_system'])?>
             </span>
         </td>
 	<td class="bottom" align="right"><span class="medium"><?php echo $lang_functions['text_the_time_is_now'] ?><?php echo $datum['hours'].":".$datum['minutes']?><br />
@@ -2684,7 +2684,11 @@ if ($msgalert)
 {
     $spStateGlobal = get_global_sp_state();
     if ($spStateGlobal != \App\Models\Torrent::PROMOTION_NORMAL) {
-        msgalert("torrents.php", sprintf($lang_functions['full_site_promotion_in_effect'], \App\Models\Torrent::$promotionTypes[$spStateGlobal]['text']), "green");
+        $deadline = \Nexus\Database\NexusDB::cache_get('global_promotion_state_deadline');
+        if (!$deadline) {
+            $deadline = \App\Models\TorrentState::query()->first(['deadline'])->deadline ?? '';
+        }
+        msgalert("torrents.php", sprintf($lang_functions['full_site_promotion_in_effect'], \App\Models\Torrent::$promotionTypes[$spStateGlobal]['text'], $deadline), "green");
     }
 	if($CURUSER['leechwarn'] == 'yes')
 	{
@@ -3008,7 +3012,7 @@ function loggedinorreturn($mainpage = false) {
 		}
 		exit();
 	}
-	do_log("[USER]: " . $CURUSER['id']);
+//	do_log("[USER]: " . $CURUSER['id']);
 }
 
 function deletetorrent($id) {
diff --git a/include/globalfunctions.php b/include/globalfunctions.php
index 6f99d263..79d7de0b 100644
--- a/include/globalfunctions.php
+++ b/include/globalfunctions.php
@@ -8,8 +8,14 @@ function get_global_sp_state()
 		if (!$global_promotion_state = $Cache->get_value('global_promotion_state')){
 			$res = mysql_query("SELECT * FROM torrents_state");
 			$row = mysql_fetch_assoc($res);
-			$global_promotion_state = $row["global_sp_state"];
-			$Cache->cache_value('global_promotion_state', $global_promotion_state, 57226);
+			if (isset($row['deadline']) && $row['deadline'] < date('Y-m-d H:i:s')) {
+			    //expired
+                $global_promotion_state = \App\Models\Torrent::PROMOTION_NORMAL;
+            } else {
+                $global_promotion_state = $row["global_sp_state"];
+            }
+			$Cache->cache_value('global_promotion_state', $global_promotion_state, 600);
+			$Cache->cache_value('global_promotion_state_deadline', $row['deadline'], 600);
 		}
 	}
 	return $global_promotion_state;
diff --git a/lang/chs/lang_functions.php b/lang/chs/lang_functions.php
index e78780fc..dea8444a 100644
--- a/lang/chs/lang_functions.php
+++ b/lang/chs/lang_functions.php
@@ -321,7 +321,7 @@ $lang_functions = array
     'menu_claim' => '认领: ',
     'text_complains' => '有%s%u个待处理的申诉%s',
     'text_contactstaff' => '联系管理组',
-    'full_site_promotion_in_effect' => '全站 [%s] 生效中！',
+    'full_site_promotion_in_effect' => '全站 [%s] 生效中！截止时间：%s',
     'text_torrent_to_approval' => '有 %s%u 个待审核的种子%s',
 );
 
diff --git a/lang/cht/lang_functions.php b/lang/cht/lang_functions.php
index f0583685..20708a8c 100644
--- a/lang/cht/lang_functions.php
+++ b/lang/cht/lang_functions.php
@@ -328,7 +328,7 @@ $lang_functions = array
     'menu_claim' => '認領: ',
     'text_complains' => '有%s%u個待處理的申诉%s',
     'text_contactstaff' => '聯系管理組',
-    'full_site_promotion_in_effect' => '全站 [%s] 生效中！',
+    'full_site_promotion_in_effect' => '全站 [%s] 生效中！截止時間：%s',
     'text_torrent_to_approval' => '有 %s%u 個待審核的種子%s',
 );
 
diff --git a/lang/en/lang_functions.php b/lang/en/lang_functions.php
index 6c9c8d0f..b41ae1b4 100644
--- a/lang/en/lang_functions.php
+++ b/lang/en/lang_functions.php
@@ -329,7 +329,7 @@ $lang_functions = array
     'menu_claim' => 'Claim: ',
     'text_complains' => 'There %s %u pending complaint%s.',
     'text_contactstaff' => 'Contact staff',
-    'full_site_promotion_in_effect' => 'Full site [%s] in effect!',
+    'full_site_promotion_in_effect' => 'Full site [%s] in effect! Deadline: %s',
     'text_torrent_to_approval' => 'There %s%u not approval torrent%s.',
 );
 
diff --git a/nexus/Imdb/Imdb.php b/nexus/Imdb/Imdb.php
index 5da42934..baad02f9 100644
--- a/nexus/Imdb/Imdb.php
+++ b/nexus/Imdb/Imdb.php
@@ -102,6 +102,10 @@ class Imdb
     public function purgeSingle($id)
     {
         $mainCacheFile =  $this->getCacheFilePath($id);
+        if (!is_file($mainCacheFile)) {
+            do_log("mainCacheFile: $mainCacheFile not exists, return");
+            return true;
+        }
         foreach (glob("$mainCacheFile*") as $file) {
             if (file_exists($file)) {
                 do_log("unlink: $file");
diff --git a/resources/lang/en/admin.php b/resources/lang/en/admin.php
index eeb4980d..bc633c2e 100644
--- a/resources/lang/en/admin.php
+++ b/resources/lang/en/admin.php
@@ -14,6 +14,7 @@ return [
         'users_medals' => 'User medals',
         'claims' => 'User claims',
         'torrent_list' => 'Torrents',
+        'torrent_state' => 'Free leach',
     ],
     'resources' => [
         'agent_allow' => [
diff --git a/resources/lang/en/label.php b/resources/lang/en/label.php
index a602e26f..64d54e57 100644
--- a/resources/lang/en/label.php
+++ b/resources/lang/en/label.php
@@ -25,6 +25,7 @@ return [
     'duration' => 'Duration',
     'description' => 'Description',
     'price' => 'Price',
+    'deadline' => 'Deadline',
     'setting' => [
         'nav_text' => 'Setting',
         'backup' => [
@@ -157,4 +158,7 @@ return [
         'uploaded_this_month' => 'Up. this month',
         'is_reached_this_month' => 'Reached',
     ],
+    'torrent_state' => [
+        'global_sp_state' => 'Global promotion state',
+    ],
 ];
diff --git a/resources/lang/zh_CN/admin.php b/resources/lang/zh_CN/admin.php
index c82431df..78e15086 100644
--- a/resources/lang/zh_CN/admin.php
+++ b/resources/lang/zh_CN/admin.php
@@ -14,6 +14,7 @@ return [
         'users_medals' => '用户勋章',
         'claims' => '用户认领',
         'torrent_list' => '种子',
+        'torrent_state' => '全站优惠',
     ],
     'resources' => [
         'agent_allow' => [
diff --git a/resources/lang/zh_CN/label.php b/resources/lang/zh_CN/label.php
index c6306785..440eae8e 100644
--- a/resources/lang/zh_CN/label.php
+++ b/resources/lang/zh_CN/label.php
@@ -25,6 +25,7 @@ return [
     'duration' => '时长',
     'description' => '描述',
     'price' => '价格',
+    'deadline' => '截止时间',
     'setting' => [
         'nav_text' => '设置',
         'backup' => [
@@ -156,4 +157,7 @@ return [
         'uploaded_this_month' => '本月上传量',
         'is_reached_this_month' => '本月是否达标',
     ],
+    'torrent_state' => [
+        'global_sp_state' => '全站优惠',
+    ],
 ];
diff --git a/resources/lang/zh_TW/admin.php b/resources/lang/zh_TW/admin.php
index 664e355e..2d7729fb 100644
--- a/resources/lang/zh_TW/admin.php
+++ b/resources/lang/zh_TW/admin.php
@@ -14,6 +14,7 @@ return [
         'users_medals' => '用戶勛章',
         'claims' => '用戶認領',
         'torrent_list' => '種子',
+        'torrent_state' => '全站優惠',
     ],
     'resources' => [
         'agent_allow' => [
diff --git a/resources/lang/zh_TW/label.php b/resources/lang/zh_TW/label.php
index 19d065d3..835b6ee7 100644
--- a/resources/lang/zh_TW/label.php
+++ b/resources/lang/zh_TW/label.php
@@ -25,6 +25,7 @@ return [
     'duration' => '時長',
     'description' => '描述',
     'price' => '價格',
+    'deadline' => '截止時間',
     'setting' => [
         'nav_text' => '設置',
         'backup' => [
@@ -157,4 +158,7 @@ return [
         'uploaded_this_month' => '本月上傳量',
         'is_reached_this_month' => '本月是否達標',
     ],
+    'torrent_state' => [
+        'global_sp_state' => '全站優惠',
+    ],
 ];