refactor(auth): replace admin plugin with ban guard (#2303)

server/apps/api/drizzle/0021_chilly_starjammers.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "session" DROP COLUMN "impersonated_by";--> statement-breakpoint
+ALTER TABLE "user" DROP COLUMN "role";

server/apps/api/drizzle/meta/_journal.json

@@ -148,6 +148,13 @@
       "when": 1786787455390,
       "tag": "0020_smart_war_machine",
       "breakpoints": true
+    },
+    {
+      "idx": 21,
+      "version": "7",
+      "when": 1786864179375,
+      "tag": "0021_chilly_starjammers",
+      "breakpoints": true
     }
   ]
 }

server/apps/api/src/libs/env.ts

@@ -76,7 +76,6 @@ const EnvSchema = object({
   TEST_AUTH_USER_ID: optional(pipe(string(), nonEmpty('TEST_AUTH_USER_ID must not be empty when set')), 'test-user'),
   TEST_AUTH_USER_EMAIL: optional(pipe(string(), nonEmpty('TEST_AUTH_USER_EMAIL must not be empty when set')), 'test@example.com'),
   TEST_AUTH_USER_NAME: optional(pipe(string(), nonEmpty('TEST_AUTH_USER_NAME must not be empty when set')), 'Test User'),
-  TEST_AUTH_USER_ROLE: optional(string(), ''),
 
   STRIPE_SECRET_KEY: optional(string()),
   STRIPE_WEBHOOK_SECRET: optional(string()),

server/apps/api/src/libs/request-auth.ts

@@ -18,7 +18,6 @@ interface RequestAuthEnv {
   TEST_AUTH_USER_ID: string
   TEST_AUTH_USER_EMAIL: string
   TEST_AUTH_USER_NAME: string
-  TEST_AUTH_USER_ROLE: string
 }
 
 interface TokenIssuerEnv {
@@ -49,8 +48,6 @@ function resolveTestAuthToken(env: RequestAuthEnv, accessToken: string): AuthSes
 
   const now = new Date()
   const expiresAt = new Date(now.getTime() + 60 * 60 * 1000)
-  const role = env.TEST_AUTH_USER_ROLE.trim()
-
   return {
     user: {
       id: env.TEST_AUTH_USER_ID,
@@ -58,7 +55,6 @@ function resolveTestAuthToken(env: RequestAuthEnv, accessToken: string): AuthSes
       name: env.TEST_AUTH_USER_NAME,
       emailVerified: true,
       image: null,
-      role: role || null,
       banned: false,
       banReason: null,
       banExpires: null,

server/apps/api/src/libs/tests/env.test.ts

@@ -47,7 +47,6 @@ describe('parseEnv', () => {
     expect(env.TEST_AUTH_USER_ID).toBe('test-user')
     expect(env.TEST_AUTH_USER_EMAIL).toBe('test@example.com')
     expect(env.TEST_AUTH_USER_NAME).toBe('Test User')
-    expect(env.TEST_AUTH_USER_ROLE).toBe('')
   })
 
   it('parses TEST_AUTH_TOKEN virtual user overrides', () => {
@@ -57,13 +56,11 @@ describe('parseEnv', () => {
       TEST_AUTH_USER_ID: 'admin-user',
       TEST_AUTH_USER_EMAIL: 'admin@example.com',
       TEST_AUTH_USER_NAME: 'Admin User',
-      TEST_AUTH_USER_ROLE: 'admin',
     })
 
     expect(env.TEST_AUTH_USER_ID).toBe('admin-user')
     expect(env.TEST_AUTH_USER_EMAIL).toBe('admin@example.com')
     expect(env.TEST_AUTH_USER_NAME).toBe('Admin User')
-    expect(env.TEST_AUTH_USER_ROLE).toBe('admin')
   })
 
   it('lLM_ROUTER_MASTER_KEY decodes a valid 32-byte base64 value into a Buffer', () => {

server/apps/api/src/libs/tests/request-auth.test.ts

@@ -20,7 +20,6 @@ const mockEnv = {
   TEST_AUTH_USER_ID: 'test-user',
   TEST_AUTH_USER_EMAIL: 'test@example.com',
   TEST_AUTH_USER_NAME: 'Test User',
-  TEST_AUTH_USER_ROLE: '',
 } as const
 
 function createUser(overrides: Partial<RequestAuthSession['user']> = {}): RequestAuthSession['user'] {
@@ -31,7 +30,6 @@ function createUser(overrides: Partial<RequestAuthSession['user']> = {}): Reques
     name: 'User',
     emailVerified: true,
     image: null,
-    role: null,
     banned: false,
     banReason: null,
     banExpires: null,
@@ -147,14 +145,12 @@ describe('resolveRequestAuth', () => {
         TEST_AUTH_USER_ID: 'test-user-1',
         TEST_AUTH_USER_EMAIL: 'Test@Example.com',
         TEST_AUTH_USER_NAME: 'Local Test User',
-        TEST_AUTH_USER_ROLE: 'admin',
       },
       new Headers({ Authorization: 'Bearer test-secret' }),
     )
 
     expect(result?.user.id).toBe('test-user-1')
     expect(result?.user.email).toBe('test@example.com')
-    expect(result?.user.role).toBe('admin')
     expect(mockedJwtVerify).not.toHaveBeenCalled()
   })