Expose roleId on the Better Auth session user

src/app.d.ts

@@ -1,11 +1,11 @@
-import type { Session, User } from 'better-auth';
+import type { auth } from '$lib/auth';
 import type { ApiKeyRecord } from '$lib/server/api-key';
 
 declare global {
 	namespace App {
 		interface Locals {
-			session: Session | null;
+			session: typeof auth.$Infer.Session.session | null;
-			user: User | null;
+			user: typeof auth.$Infer.Session.user | null;
 			apiKey?: ApiKeyRecord;
 		}
 	}

src/lib/auth.ts

@@ -27,6 +27,18 @@ export const auth = betterAuth({
 	database: prismaAdapter(prisma, {
 		provider: 'postgresql'
 	}),
+	user: {
+		// Expose our custom role column on the session user so role checks can
+		// read `locals.user.roleId` without a database round-trip.
+		additionalFields: {
+			roleId: {
+				type: 'number',
+				required: false,
+				defaultValue: 4,
+				input: false
+			}
+		}
+	},
 	emailVerification: {
 		sendOnSignUp: true,
 		sendVerificationEmail: async ({ user, token }) => {

src/lib/server/roles.ts

@@ -0,0 +1,28 @@
+/**
+ * Role hierarchy. Lower ids are more privileged:
+ *   SUPER = 1, ADMIN = 2, STAFF = 3, USER = 4
+ *
+ * `roleId` is exposed on the Better Auth session user (see `auth.ts`
+ * `user.additionalFields`), so these helpers never need a database call.
+ */
+export const SUPER = 1;
+export const ADMIN = 2;
+export const STAFF = 3;
+export const USER = 4;
+
+/** The current user's role id, defaulting to the least privileged role. */
+export function roleId(locals: App.Locals): number {
+	return locals.user?.roleId ?? USER;
+}
+
+export function isSuper(locals: App.Locals): boolean {
+	return roleId(locals) <= SUPER;
+}
+
+export function isAdmin(locals: App.Locals): boolean {
+	return roleId(locals) <= ADMIN;
+}
+
+export function isStaff(locals: App.Locals): boolean {
+	return roleId(locals) <= STAFF;
+}