feat: basic admin interface

server/utils/admin.ts

@@ -0,0 +1,26 @@
+import type { H3Event } from 'h3';
+import { db } from '~~/server/lib/db';
+
+/**
+ * Like protectRoute(), but only lets admins through.
+ *
+ * The role is read from the database: the session cookie keeps a copy of the
+ * user for a few minutes, and someone who just stopped being an admin should
+ * not keep the access for that long.
+ */
+export const protectAdminRoute = async (event: H3Event) => {
+    await protectRoute(event);
+
+    const account = await db.query.users.findFirst({
+        where: {
+            id: event.context.user!.id as string,
+        },
+    });
+
+    if (account?.role !== 'admin' || account.banned) {
+        throw createError({
+            statusCode: 403,
+            statusMessage: 'Forbidden',
+        });
+    }
+};