feat(auth): check for admin role

lib/auth/authorization.test.ts

@@ -8,14 +8,17 @@ const verified = {
   id: "admin",
   email: "[email protected]",
   emailVerified: true,
+  role: "admin",
 };
 
 describe("admin authorization", () => {
-  it("allows any verified credential user", () => {
+  it("allows only verified admins", () => {
     expect(isAuthorizedAdmin(verified)).toBe(true);
     expect(
       isAuthorizedAdmin({ ...verified, emailVerified: false }),
     ).toBe(false);
+    expect(isAuthorizedAdmin({ ...verified, role: "user" })).toBe(false);
+    expect(isAuthorizedAdmin({ ...verified, role: null })).toBe(false);
   });
 
   it("denies missing users", () => {

lib/auth/authorization.ts

@@ -2,6 +2,7 @@ export interface SessionUserLike {
   id: string;
   email: string;
   emailVerified: boolean;
+  role?: string | null;
   name?: string | null;
   image?: string | null;
 }
@@ -9,5 +10,5 @@ export interface SessionUserLike {
 export function isAuthorizedAdmin(
   user: SessionUserLike | null | undefined,
 ): user is SessionUserLike {
-  return Boolean(user?.email && user.emailVerified === true);
+  return Boolean(user?.email && user.emailVerified === true && user.role === "admin");
 }

lib/auth/server.ts

@@ -94,6 +94,7 @@ export async function getAdminSession(): Promise<AdminSession | null> {
         id: "demo-admin",
         email: "[email protected]",
         emailVerified: true,
+        role: "admin",
         name: "Demo Admin",
       },
       session: { id: "demo-session" },