Role Hierarchy Enforced

When roles are checked with exact string equality (role === 'member'), a higher-privilege user fails checks designed for lower-privilege users — they must be explicitly listed in every condition they should satisfy. This creates access gaps that worsen as the role model grows. An Admin denied access to a Member-gated feature is a support burden at best; an Admin who can bypass a Member-gated resource because the hierarchy isn't enforced is a CWE-284 / OWASP A01 violation at worst. NIST 800-53 AC-3 expects access enforcement to reflect the intended privilege model, not accidental exclusion through literal comparisons.

Replace exact role comparisons with a hasMinimumRole helper that encodes the hierarchy numerically. Once the rank table exists, every future role check becomes a single function call.

// lib/auth/roles.ts
const ROLE_RANK: Record<string, number> = { viewer: 1, member: 2, admin: 3 };

export function hasMinimumRole(user: { role: string }, required: string): boolean {
  return (ROLE_RANK[user.role] ?? 0) >= (ROLE_RANK[required] ?? Infinity);
}

// Usage: if (!hasMinimumRole(user, 'member')) return forbidden();

Review all existing user.role === 'x' checks and replace with hasMinimumRole(user, 'x') wherever hierarchy applies.