/** * Admin middleware — blocks non-admin users. * Must be used AFTER softAuth or requireAuth. */ import { createMiddleware } from "hono/factory"; import type { AuthEnv } from "./auth"; export const requireAdmin = createMiddleware(async (c, next) => { const user = c.get("user"); if (!user) { return c.redirect(`/login?redirect=${encodeURIComponent(c.req.path)}`); } if (!user.isAdmin) { return c.html( `

403

Admin access required.

Go home

`, 403 ); } return next(); });