if (path === '/api/staff/news' && request.method === 'GET') {
  const userId = await verifyJWT(getAuthToken(request), env.JWT_SECRET)
  if (!userId) return unauthorized()
  
  if (!await hasPermission(userId, 'news:read', env)) {
    return forbidden()
  }
  
  const news = await env.DB.prepare('SELECT * FROM news').all()
  return json(news.results)
}

try {
  const result = await performOperation()
  return json(result)
} catch (error) {
  return json({ error: 'Internal server error' }, 500)
}