Add role autorisation

[Asbjoedt]

Goals

1. Allow autentifacted users to be recognized by the app as belonging to one or several autorisation roles i.e. a basic example for a website is often "admin", "editor" and "user"
2. At the moment I cannot protect my admin panel, I can use middleware to protect from unautenticated users but any autentifacated regular user should not be bale to see the admin panel.

Non-Goals

No response

Background

Your website AI told me this after some conversation back and forth:

Looking at the provided schema in the documentation, Auth.js provides a minimal default schema focused on core authentication functionality with these basic tables:

users (with id, name, email, emailVerified, image)
sessions
accounts
verification_tokens
You raise a good point about roles not being included by default. Since this appears to be a common need, I recommend:

Visit File an Issue
Visit Ask a question
Ask questions on Discord
This would be valuable feedback for the Auth.js team to consider adding role support in the default schema.

Proposal

I use the Postgres adapter. Extend the schema with one colum as such:

role VARCHAR(255) NOT NULL,

Like this:

CREATE TABLE users
(
  id SERIAL,
  name VARCHAR(255),
  email VARCHAR(255),
  "emailVerified" TIMESTAMPTZ,
  image TEXT,
  role VARCHAR(255) NOT NULL,
 
  PRIMARY KEY (id)
);

So that when I call session.user in the future, I will be able to call session.user.role and get the role desgination(s) of the user to stratify regular users from being able to access certain pages or perform certain actrions.

[JacoboGanon]

You can extend what gets passed in the session in your auth configuration (for example if you wanted to add a role you could do):

callbacks: {
  session: ({ session, user }) => {
    session.user.id = user.id;
    session.user.role = user.role;
    return session;
  },
}