Role-Based Access Control (RBAC)
Role-Based Access Control (RBAC) is used to restrict access to APIs and routes based on user roles such as admin or user. This pattern is extremely common in real-world applications where different users have different permissions. This documentation shows a clean and scalable RBAC implementation using middleware.
User Role Structure
Defines a simple role system where each user has a role field.
Admin Authorization Middleware
Middleware that allows access only if the authenticated user has an admin role.
Protecting Admin Routes
Applies the isAdmin middleware to protect admin-only routes.
Related Documents
Next.js 16 Auth.js Login Setup
Full Auth.js v5 (NextAuth successor) configuration in Next.js 16 App Router with Credentials provider, database sessions (Prisma adapter), middleware for protected routes (/dashboard), OAuth providers (Google/GitHub), magic links, and React 19 useOptimistic for instant login UI.