Authorisation and the Data Access Layer

// A page
export default async function AdminPage() {
  const user = await requireUser()
  if (user.role !== 'admin') return <Forbidden />
}

// A server action — a public POST endpoint, remember
'use server'
export async function deleteProblem(id: string) {
  const user = await requireUser()
  if (user.role !== 'admin') throw new Error('Forbidden')
}

// A route handler
export async function DELETE(req: NextRequest) {
  const user = await getSession()
  if (!user) return new NextResponse('Unauthorized', { status: 401 })
}

// Middleware may redirect for convenience, but it is NOT the check —
// see the middleware concept and CVE-2025-29927.

// And the check that is actually forgotten most often is ownership,
// not role:
const submission = await db.submission.findUnique({ where: { id } })
return submission                                   // whose?
const submission = await db.submission.findUnique({
  where: { id, userId: user.id },                   // theirs
})
if (!submission) notFound()                          // 404, not 403 —
                                                     // do not confirm it exists

// lib/dal.ts
import 'server-only'                    // a client import fails the build

export const getProblemsForUser = cache(async () => {
  const user = await requireUser()      // the DAL authorises itself
  return db.problem.findMany({
    where: { OR: [{ authorId: user.id }, { published: true }] },
  })
})

export const getSubmission = cache(async (id: string) => {
  const user = await requireUser()
  return db.submission.findUnique({ where: { id, userId: user.id } })
})

// A page cannot get data without going through it:
export default async function Page() {
  const problems = await getProblemsForUser()      // already authorised
  return <ProblemList problems={problems} />
}

// Two properties that make this worth the indirection:
//   1. A new page, action or handler inherits the check automatically.
//   2. Reviewing authorisation means reading one file, not grepping
//      for db. across the codebase.

// Enforce it: an ESLint rule banning direct db imports outside
// lib/dal.ts turns the convention into a build failure.

// Also strip fields here, not in the component — a DTO at the
// boundary, so passwordHash cannot reach a client component's props:
return { id: u.id, name: u.name, role: u.role }

// Hiding a locked feature in the UI is a courtesy, not a control.
{isPro ? <Solution /> : <UpgradePrompt />}

// The server must also refuse to SEND the gated content — otherwise
// it is in the HTML payload for anyone who opens DevTools:
const problem = await getProblem(slug)
const canSeeSolution = user?.isPro || user?.role === 'admin'
return (
  <ProblemView
    problem={{
      ...problem,
      solution: canSeeSolution ? problem.solution : null,   // stripped
      hints: canSeeSolution ? problem.hints : [],
    }}
  />
)

// Compute entitlements once, server-side, and pass the booleans down.
// The client re-deriving "is this user Pro" from a plan string is how
// the two sides drift apart.

// Tier checks belong in the DAL too:
export const getSolution = cache(async (slug: string) => {
  const user = await requireUser()
  if (!user.isPro) throw new ForbiddenError('pro_required')
  return db.problem.findUnique({ where: { slug }, select: { solution: true } })
})

// And keep the metered limits on the server. A client-side counter is
// a suggestion; the server's count is the limit.