feat: admin controls

server/utils/admin.ts

@@ -1,26 +1,20 @@
 import type { H3Event } from 'h3';
-import { db } from '~~/server/lib/db';
 
 /**
  * Like protectRoute(), but only lets admins through.
  *
- * The role is read from the database: the session cookie keeps a copy of the
- * user for a few minutes, and someone who just stopped being an admin should
- * not keep the access for that long.
+ * protectRoute() reads the user from the database on every request, so someone
+ * who just stopped being an admin loses the access right away.
  */
 export const protectAdminRoute = async (event: H3Event) => {
-    await protectRoute(event);
+    const sessionData = await protectRoute(event);
 
-    const account = await db.query.users.findFirst({
-        where: {
-            id: event.context.user!.id as string,
-        },
-    });
-
-    if (account?.role !== 'admin' || account.banned) {
+    if (sessionData.user.role !== 'admin') {
         throw createError({
             statusCode: 403,
             statusMessage: 'Forbidden',
         });
     }
+
+    return sessionData;
 };