desert flicker
I'm trying to make an app with pretty much only server actions, the app doesn't need to interact with the outside, session is stored in cookies with iron-session. I want to have permissions for different roles for those server actions, how and where can I define the middleware for handling this stuff.
I've tought about putting the logic to check the role in the middleware but I don't know how to identify whether a request is a server action or not.
Then I've tought about making a wrapper but when I console logged inside the server action, it displayed on the browser console, probably because it's returning a function and not the result of it but I couldn't get it to work (my previous question was about this but couldn't get a good answer)
//only checks if there's a session
export async function protect(fn: any) {
return async (...params: any) => {
if(await getSession()) {
return await fn(...params);
} else {
throw new Error("invalid session")
}
}
}```
The easy solution is to make another server action that checks for the role and fn name in each server action but I would have to call it in every single server action and that would be repeating too much code kind of
So how could I handle authorization for my server actions, on the server side so that I can read the session from the cookies and check it against the db before executing them?
rare crown
rotund plume
lethal sinew