Checkpoint SHD dashboard design system

src/lib/server/auth/authorization.ts

@@ -0,0 +1,12 @@
+import type { AuthUser } from './session';
+import { error } from '@sveltejs/kit';
+
+/**
+ * Every admin page, action, and endpoint must call this server-side.
+ * The capability-based permission checks will replace the broad admin role
+ * as the permission editor is introduced.
+ */
+export function requireAdmin(user: AuthUser | null): asserts user is AuthUser {
+	if (!user) error(401, 'Sign in required');
+	if (user.role !== 'admin') error(403, 'Administrator permission required');
+}