Expose roleId on the Better Auth session user

src/lib/server/roles.ts

@@ -0,0 +1,28 @@
+/**
+ * Role hierarchy. Lower ids are more privileged:
+ *   SUPER = 1, ADMIN = 2, STAFF = 3, USER = 4
+ *
+ * `roleId` is exposed on the Better Auth session user (see `auth.ts`
+ * `user.additionalFields`), so these helpers never need a database call.
+ */
+export const SUPER = 1;
+export const ADMIN = 2;
+export const STAFF = 3;
+export const USER = 4;
+
+/** The current user's role id, defaulting to the least privileged role. */
+export function roleId(locals: App.Locals): number {
+	return locals.user?.roleId ?? USER;
+}
+
+export function isSuper(locals: App.Locals): boolean {
+	return roleId(locals) <= SUPER;
+}
+
+export function isAdmin(locals: App.Locals): boolean {
+	return roleId(locals) <= ADMIN;
+}
+
+export function isStaff(locals: App.Locals): boolean {
+	return roleId(locals) <= STAFF;
+}