From c404e93fb0aebb2928c1be98c9b169863524425b Mon Sep 17 00:00:00 2001
From: Adrian Bonpin <adrianbonpin@gmail.com>
Date: Sat, 25 Apr 2026 13:43:24 +0800
Subject: [PATCH] feat(auth): define RBAC with user, contributor, and admin
 roles

---
 lib/auth/permissions.ts | 40 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)
 create mode 100644 lib/auth/permissions.ts

diff --git a/lib/auth/permissions.ts b/lib/auth/permissions.ts
new file mode 100644
index 0000000..391d368
--- /dev/null
+++ b/lib/auth/permissions.ts
@@ -0,0 +1,40 @@
+import { createAccessControl } from "better-auth/plugins/access"
+import {
+  defaultStatements,
+  adminAc,
+} from "better-auth/plugins/admin/access"
+
+const statement = {
+  ...defaultStatements,
+  game: ["create", "update", "delete", "review"],
+  performance: ["submit", "verify", "delete"],
+  hardware: ["create", "update"],
+  profile: ["view", "edit"],
+} as const
+
+export const ac = createAccessControl(statement)
+
+export const user = ac.newRole({
+  profile: ["view"],
+  performance: ["submit"],
+})
+
+export const contributor = ac.newRole({
+  ...user.statements,
+  profile: ["view", "edit"],
+  performance: ["submit", "verify"],
+  game: ["create", "update"],
+  hardware: ["update"],
+})
+
+export const admin = ac.newRole({
+  ...adminAc.statements,
+  ...contributor.statements,
+  game: ["create", "update", "delete", "review"],
+  performance: ["submit", "verify", "delete"],
+  hardware: ["create", "update"],
+  profile: ["view", "edit"],
+})
+
+export const ROLES = ["user", "contributor", "admin"] as const
+export type RoleName = (typeof ROLES)[number]