Harden form auth and submission handling

app/form/[id]/page.tsx

@@ -3,8 +3,8 @@ import { FormFillerClient } from "../client";
 import { getServerSession } from "next-auth";
 import { authOptions } from "@/app/api/auth/[...nextauth]/route";
 import { notFound } from "next/navigation";
-import { getGuildMemberRoles } from "@/app/actions/discord";
 import LoginDialog from "@/components/login-dialog";
+import { canAccessForm, getSessionDiscordId } from "@/lib/auth";
 
 export const dynamic = "force-dynamic";
 
@@ -15,7 +15,7 @@ export default async function FormsSubmitPage(
 ) {
   const params = await props.params;
   const session = await getServerSession(authOptions);
-  const discordId = (session?.user as { discordId?: string })?.discordId;
+  const discordId = getSessionDiscordId(session);
 
   const form = await db.query.forms.findFirst({
     where: (f, { eq }) => eq(f.id, params.id),
@@ -25,30 +25,8 @@ export default async function FormsSubmitPage(
     return notFound();
   }
 
-  const allowedRoles = form.allowedRoles || [];
-  const deniedRoles = form.deniedRoles || [];
-  const hasRoleRestrictions = allowedRoles.length > 0 || deniedRoles.length > 0;
-
-  if (hasRoleRestrictions) {
-    if (!discordId) {
-      return notFound();
-    }
-
-    const userRoles = await getGuildMemberRoles(discordId);
-    
-    let isAllowed = allowedRoles.length === 0;
-    if (allowedRoles.length > 0) {
-      isAllowed = userRoles.some(r => allowedRoles.includes(r));
-    }
-
-    let isDenied = false;
-    if (deniedRoles.length > 0) {
-      isDenied = userRoles.some(r => deniedRoles.includes(r));
-    }
-
-    if (!isAllowed || isDenied) {
-      return notFound();
-    }
+  if (!(await canAccessForm(form, discordId))) {
+    return notFound();
   }
 
   const questionsList = await db.query.questions.findMany({
@@ -56,7 +34,7 @@ export default async function FormsSubmitPage(
     orderBy: (q, { asc }) => [asc(q.displayOrder)],
   });
 
-  let initialAnswers: Record<string, string> = {};
+  const initialAnswers: Record<string, string> = {};
   if (discordId) {
     const existingSubmission = await db.query.submissions.findFirst({
       where: (s, { eq, and }) =>