| import { db, schema } from "@superlog/db"; | |
| import { eq } from "drizzle-orm"; | |
| import { HTTPException } from "hono/http-exception"; | |
| // Staff gate for the remaining operational routes. | |
| // | |
| // Staff is anyone whose user row has "admin" in the Better Auth admin plugin's | |
| // `role` column (comma-separated list). Grant/revoke at runtime via SQL or | |
| // `authClient.admin.setRole` — no redeploy required. | |
| export function userIsStaff(role: string | null | undefined): boolean { | |
| if (!role) return false; | |
| return role.split(",").some((r) => r.trim() === "admin"); | |
| } | |
| export async function isStaff(userId: string): Promise<boolean> { | |
| const user = await db.query.users.findFirst({ where: eq(schema.users.id, userId) }); | |
| // Banned admins lose access here too — Better Auth's session middleware | |
| // already gates banned users, but defense-in-depth in case that gate is | |
| // ever bypassed or misconfigured. | |
| if (!user || user.banned) return false; | |
| return userIsStaff(user.role); | |
| } | |
| export async function requireStaff(userId: string): Promise<void> { | |
| if (!(await isStaff(userId))) { | |
| throw new HTTPException(403, { message: "admin access required" }); | |
| } | |
| } | |