Admin

TurboJet uses a Prisma Role enum (USER | ADMIN) stored on the user and exposed as a Better Auth additional field. Platform admin checks compare against $Enums.Role.ADMIN — there is no Permix admin.access matrix in this kit.

Assign the admin role

This host does not ship a create:user CLI. To promote an existing user:

1. Start Prisma Studio:

pnpm --filter @repo/database db:studio

2. Open the User table, find the user, set role to ADMIN, and save.

You can also promote or demote users through the admin API once you already have an admin (POST /api/admin/users/:userId/make-admin and remove-admin).

Seed (packages/database/src/seed.ts) creates verified onboarded users but does not assign ADMIN by default.

Protect admin API routes

Admin routers chain requireAuth then requireAdmin:

import { $Enums } from "@repo/database";

export const requireAdmin = createMiddleware<AuthEnv>(async (c, next) => {
	const session = c.get("session");
	if (!session || session.user.role !== $Enums.Role.ADMIN) {
		fail(403, "Unauthorized");
	}
	await next();
});

const adminGuard = [rateLimit("READ"), requireAuth, requireAdmin] as const;
const adminWriteGuard = [rateLimit("WRITE"), requireAuth, requireAdmin] as const;

The admin module can list/search users, ban/unban, delete, make/remove admin, and read statistics. See packages/api/src/modules/admin/.

Full middleware patterns: Protect API endpoints.

Related

• User and session
• Protect API endpoints
• Authentication overview