Next.js RBAC

export const routeRoleMap: Record<string, UserRole> = {
  "/dashboard": "user",
  "/dashboard/settings": "admin",
  "/dashboard/form": "admin",
};

export async function proxy(request: NextRequest) {
  const session = await auth.api.getSession(request);

  if (!session) {
    return NextResponse.redirect(new URL("/application", request.url));
  }

  const pathname = request.nextUrl.pathname;

  const matchedRoute = Object.keys(routeRoleMap)
    .sort((a, b) => b.length - a.length)
    .find((route) => pathname.startsWith(route));

  if (matchedRoute) {
    const requiredRole: UserRole = routeRoleMap[matchedRoute];

    if (!isBetter(session.user.role, requiredRole)) {
      return unauthorized();
    }
  }

  return NextResponse.next();
}

export const config = {
  matcher: [
    "/((?!api|my-application|application|login|_next/static|_next/image|.*\\.(?:png|svg)$).*)",
  ],
};