Role-based access control enforced

Broken Function Level Authorization (OWASP API Security Top 10 2023 API5) is what happens when authentication and object-level checks exist but role enforcement doesn't — any logged-in user reaches admin-only functions. CWE-269 (Improper Privilege Management) covers the pattern: the application knows what role a user has but doesn't consult it before executing privileged operations. A user who discovers /api/admin/delete-user or /api/billing/refund-all can invoke it if role checks are missing. Compromised non-admin accounts become full admin accounts. Internal tools are a common gap — developers add auth but skip role checks on 'internal' routes.

Add explicit role assertions at the top of every privileged route handler, not just in middleware. Middleware handles authentication; role authorization belongs at the route level where the required role is clear.

// src/app/api/admin/users/route.ts
export async function DELETE(req: Request) {
  const user = await getAuthUser(req)
  if (!user) return new Response('Unauthorized', { status: 401 })

  // Role check — explicit, not delegated to a generic middleware flag
  if (user.role !== 'admin') return new Response('Forbidden', { status: 403 })

  const { userId } = await req.json()
  await db.user.delete({ where: { id: userId } })
  return Response.json({ deleted: true })
}

For complex role hierarchies, centralize checks in a src/lib/authz.ts policy module so role requirements are auditable in one place.