1) in commit description is list-commands instead of list-permissions
2) Are all variants of command accessible without admin permissions (on first sight it seems to me that yes, but better to check)

sorry for typo, updated for 1)

for 2)
I checked cli and hub code again and find
handle_add_pkg
handle_block_pkg
handle_remove_pkg
handle_set_pkg_arches
handle_set_pkg_owner
handle_unblock_pkg

are not exactly admin commands. it's related to policy.

handle_clone_tag is the same as above, because it also invoke packageListAdd on hub.

handle_import is on a complex situation. The uploading can be done without admin permission, until session.importRPM() is executed
handle_import_archive faces the same problem, and it requires *-import permission but not admin
handle_spin_livemedia is similar, and it requires 'livecd', 'appliance', 'livemedia', or 'admin' permission

handle_import_sig
handle_write_signed_rpm

request "sign" permission instead of "admin"

handle_prune_signed_copies looks have no privilege limitation, has not look deep into its code

handle_list_signed has no permission checking on hub side

handle_regen_repo requests repo or regen-repo perm, but not admin

handle_runroot requests runroot

The categories are not perfect, but I think they're good enough for now.

I'm not sure we should overhaul them at this point. We should see how the granular permissions works out first.

For commands that make changes, require special access, are not typical commands needed by devs, and don't obviously belong in some other category, I think the 'admin' category is fine.

that said, fine with moving list-permissions

Commit 642f5e83 fixes this pull-request