Enforce roleId checks on all admin page actions

src/routes/(protected)/admin/proclamations/+page.server.ts

@@ -1,5 +1,6 @@
 import type { PageServerLoad } from './$types';
 import { prisma } from '$lib/db';
+import { isSuper } from '$lib/server/roles';
 import { superValidate } from 'sveltekit-superforms/server';
 import { zod4 } from 'sveltekit-superforms/adapters';
 import { z } from 'zod';
@@ -13,18 +14,6 @@ const ProclamationSchema = z.object({
 	content: z.string().optional().default('')
 });
 
-async function isSuper(locals: App.Locals): Promise<boolean> {
-	if (!locals.user?.id) return false;
-
-	// The Better Auth session user does not include `roleId`, so read the
-	// current role from the database.
-	const user = await prisma.user.findUnique({
-		where: { id: locals.user.id },
-		select: { roleId: true }
-	});
-	return (user?.roleId ?? 4) <= 1;
-}
-
 export const load: PageServerLoad = async ({ locals }) => {
 	const [proclamations, frequencies, categories, groups] = await Promise.all([
 		prisma.proclamation.findMany({
@@ -48,7 +37,7 @@ export const load: PageServerLoad = async ({ locals }) => {
 	const records = proclamations as unknown as Record<string, unknown>[];
 
 	// Strip content from non-Super users
-	if (!(await isSuper(locals))) {
+	if (!isSuper(locals)) {
 		for (const record of records) {
 			delete record.content;
 		}
@@ -63,7 +52,7 @@ export const actions = {
 			return { success: false, action: 'upsert', error: 'Unauthorized' };
 		}
 
-		if (!(await isSuper(locals))) {
+		if (!isSuper(locals)) {
 			return {
 				success: false,
 				action: 'upsert',
@@ -106,7 +95,7 @@ export const actions = {
 		return { success: true, action: 'upsert' };
 	},
 	delete: async ({ request, locals }) => {
-		if (!(await isSuper(locals))) {
+		if (!isSuper(locals)) {
 			return {
 				success: false,
 				action: 'delete',