Roles & Permissions
Control access with user roles, procedure middleware, and ban enforcement.
The User.role field distinguishes standard user accounts and elevated admin accounts. ADMIN_EMAILS can grant admin role at signup; existing accounts can use the explicit promotion command. Team membership roles are a separate OWNER / MEMBER enum.
Reuse server guards
Import publicProcedure, protectedProcedure or adminProcedure from packages/api/trpc/base.ts as appropriate. Do not recreate role middleware in individual features. An unauthenticated admin call fails with UNAUTHORIZED; an authenticated non-admin call fails with FORBIDDEN.
For team resources, use ctx.abilities.isTeamMember(teamId) or isTeamOwner(teamId) and scope database access to that team. The existing helpers intentionally grant admins team-owner access. Hiding an action in the UI is not an authorization boundary.
Account bans
The schema includes banned, banReason and banExpires. Use Better Auth's existing admin operations for ban and session management rather than editing those fields directly and assuming sessions were revoked. Test both an existing session and a fresh login when extending moderation.