role-auth-extension

name	role-auth-extension
description	Use when extending user roles or securing pages behind custom roles (e.g. adding VENDOR, MANAGER, etc.).

Role and Authorization Extension Playbook

Follow these steps to add new roles (e.g., VENDOR, MANAGER, DELIVERY) and secure pages or endpoints accordingly:

1. Update schema.prisma:

   • Open prisma/schema.prisma.
   • Update enum Role to include your new role:

     enum Role {
       USER
       ADMIN
       VENDOR // New role
     }
     

   • Run npx prisma migrate dev --name add_role_vendor and npx prisma generate.

2. Update Type Definitions:

   • Open src/types/next-auth.d.ts and add the new role string to the typescript Union type if it is strictly typed.

3. Secure API Route Handlers:

   • For custom routes, fetch the session role and restrict access:

     const session = await auth();
     if (session?.user?.role !== "VENDOR") {
       return Response.json({ error: "Access denied" }, { status: 403 });
     }
     

   • Or when using the API helper createApiRoute:

     handler: async (req, { session }) => {
       if (session.user.role !== "VENDOR") {
         return Response.json({ error: "Forbidden" }, { status: 403 });
       }
       // ...
     }
     

4. Secure Frontend Pages:

   • Open src/middleware.ts to block unauthorized navigation.
   • Add route matchers protecting pages (e.g. /dashboard/vendor/*) and checking token.role.