Add centralized auth guards to server actions

- New src/lib/utils/auth.ts with getSessionUser, requireUser, isAdmin, requireAdmin
- Gate all admin server actions (getForms, getAllFormDetails, getSubmissions)
- Fix otherUser escalation: only admins may act on behalf of other users
- Move form reads out of admin actions into plain server module so
  member-facing pages stop importing from the admin RPC surface

Author: hamin2006

src/app/portal/admin/actions.ts

@@ -1,6 +1,7 @@
 "use server";
 import { db } from "@/db";
-import { createClient } from "@/lib/utils/supabase/server";
+import { requireAdmin } from "@/lib/utils/auth";
+import { getFormById } from "@/lib/utils/forms/server";
 import { FormStep } from "@/lib/types/questions";
 import { FormFields } from "@/components/forms/applications/columns";
 import { sendEmail } from "@/lib/utils/forms/email";
@@ -9,41 +10,15 @@ import { render } from "@react-email/components";
 import { object } from "zod";
 
 export async function getForms() {
+  await requireAdmin();
   return db.forms.findMany();
 }
 
-async function requireAdmin() {
-  const supabase = createClient();
-  const { data, error } = await supabase.auth.getUser();
-  if (error || !data.user) {
-    throw new Error("Unauthorized");
-  }
-  const role = await db.roles.findUnique({
-    where: { id: data.user.id },
-  });
-  if (!role || role.roles?.split(",")[0] !== "admin") {
-    throw new Error("Unauthorized");
-  }
-}
-
 export async function createForm(data: { title: string; description: string }) {
   await requireAdmin();
   return db.forms.create({ data: { ...data, config: {}, questions: [] } });
 }
 
-export async function getForm(id: number | bigint) {
-  try {
-    return db.forms.findFirst({
-      where: {
-        id: BigInt(id),
-      },
-    });
-  } catch (e) {
-    console.log(e);
-    return null;
-  }
-}
-
 export async function updateForm(
   id: number,
   data: {
@@ -62,6 +37,7 @@ export async function getSubmissions(
   onlySubmitted: boolean = true,
   filters: any | undefined = {},
 ) {
+  await requireAdmin();
   const app = await db.submissions.findMany({
     include: {
       users: true,
@@ -116,6 +92,7 @@ function formatFormFields(questionSteps: FormStep[]): FormFields {
 export async function getAllFormDetails(
   formId: bigint,
 ): Promise<{ rawForm: any; formFields: FormFields; submissions: any[] }> {
+  await requireAdmin();
   try {
     const form = await db.forms.findFirst({
       where: { id: formId },
@@ -268,7 +245,7 @@ async function sendStatusEmail({
   formId: bigint;
   userId: string;
 }) {
-  const form = await getForm(formId);
+  const form = await getFormById(formId);
 
   if (!form) {
     console.log("Form not found");

src/app/portal/admin/forms/[id]/settings/actions.ts

@@ -1,5 +1,6 @@
 "use server";
 import { db } from "@/db";
+import { requireAdmin } from "@/lib/utils/auth";
 
 type EmailTemplate = {
   title: string;
@@ -11,6 +12,7 @@ export async function updateOrCreateEmailTemplate(
   status: string,
   template: EmailTemplate,
 ) {
+  await requireAdmin();
   try {
     // First get the current form to access existing config
     const form = await db.forms.findFirst({

src/app/portal/forms/[id]/application/page.tsx

@@ -1,6 +1,6 @@
 import { redirect } from "next/navigation";
 import { GenericResult, AcceptedResult } from "@/components/forms/resultPages";
-import { getForm } from "@/app/portal/admin/actions";
+import { getFormById } from "@/lib/utils/forms/server";
 import { getUserApplication } from "@/app/portal/forms/actions";
 import { Form } from "@/lib/types/application";
 import GenericGreeter from "@/components/layouts/genericGreeter";
@@ -22,7 +22,7 @@ export default async function page({
   if (!params.id) {
     redirect("/portal/forms");
   }
-  const formP = getForm(Number(params.id)) as unknown as Promise<Form>;
+  const formP = getFormById(Number(params.id)) as unknown as Promise<Form>;
   const appP = getUserApplication({
     formId: Number(params.id) as unknown as bigint,
     includeApp: true,

src/app/portal/forms/[id]/apply/page.tsx

@@ -2,7 +2,7 @@ import { getUserApplication } from "../../actions";
 import { redirect } from "next/navigation";
 import ApplicationForm from "@/components/forms/applications/applicationForm";
 import { Application } from "@/lib/types/questions";
-import { getForm } from "@/app/portal/admin/actions";
+import { getFormById } from "@/lib/utils/forms/server";
 import { Form } from "@/lib/types/application";
 import { isFormOpen } from "@/lib/utils/forms/helpers";
 import { toast } from "sonner";
@@ -13,7 +13,7 @@ export default async function page({
   params: { id: string };
   searchParams: { [key: string]: string | string[] | undefined };
 }) {
-  const form = (await getForm(Number(params.id))) as unknown as Form;
+  const form = (await getFormById(Number(params.id))) as unknown as Form;
 
   if (!form) {
     return redirect(`/portal`);

src/app/portal/forms/[id]/page.tsx

@@ -1,14 +1,13 @@
-// page.tsx
 import { redirect } from "next/navigation";
 import { isFormOpen } from "@/lib/utils/forms/helpers";
-import { getForm } from "@/app/portal/admin/actions";
+import { getFormById } from "@/lib/utils/forms/server";
 import { getUserApplication } from "@/app/portal/forms/actions";
 import { Form } from "@/lib/types/application";
 import GenericGreeter from "@/components/layouts/genericGreeter";
 import { MainResultPage } from "@/components/forms/resultPages/MainResultPage";
 
 async function getPageData(id: string) {
-  const formP = getForm(Number(id)) as unknown as Promise<Form>;
+  const formP = getFormById(Number(id)) as unknown as Promise<Form>;
   const appP = getUserApplication({
     formId: Number(id) as unknown as bigint,
   });

src/app/portal/forms/actions.ts

@@ -3,7 +3,7 @@ import { render } from "@react-email/components";
 import { db } from "@/db";
 import { FormStep, Obj } from "@/lib/types/questions";
 import { Trigger } from "@/lib/types/forms";
-import { createClient } from "@/lib/utils/supabase/server";
+import { getSessionUser, requireUser, isAdmin } from "@/lib/utils/auth";
 import { JSONValidationToZod } from "@/lib/utils/forms/helpers";
 import { sendEmail } from "@/lib/utils/forms/email";
 import { SubmissionTemplate } from "@/components/forms/emailTemplates/submissionTemplate";
@@ -15,12 +15,13 @@ export async function submitApplication({
   formId: bigint;
   otherUser?: string;
 }) {
-  const supabase = createClient();
-  const userId = otherUser || (await supabase.auth.getUser()).data?.user?.id;
-  const { data, error } = await supabase.auth.getUser();
-  if (!data.user || error) {
-    return null;
+  const user = await requireUser();
+  // otherUser lets admins submit on behalf of an applicant (support flow);
+  // regular users may only ever act as themselves.
+  if (otherUser && !(await isAdmin(user.id))) {
+    throw new Error("Unauthorized");
   }
+  const userId = otherUser ? otherUser : user.id;
   const resPromise = db.submissions.findUnique({
     where: {
       user_id_form_id: {
@@ -121,7 +122,7 @@ export async function submitApplication({
   await sendEmail({
     from: "no-reply@ubclaunchpad.com",
     fromName: "No-reply UBC Launch Pad",
-    to: data.user.email!.toString(),
+    to: user.email!.toString(),
     subject: `${form.title} - Form Submitted`,
     html: template,
     cc: appEmail?.email as string,
@@ -138,12 +139,11 @@ export async function updateApplication({
   formId: bigint;
   otherUser?: string;
 }) {
-  const supabase = createClient();
-  const userId = otherUser || (await supabase.auth.getUser()).data?.user?.id;
-  const { data, error } = await supabase.auth.getUser();
-  if (!data.user || error) {
-    return null;
+  const user = await requireUser();
+  if (otherUser && !(await isAdmin(user.id))) {
+    throw new Error("Unauthorized");
   }
+  const userId = otherUser ? otherUser : user.id;
 
   const res = await db.submissions.findUnique({
     where: {
@@ -176,16 +176,15 @@ export async function getUserApplication({
   formId: bigint;
   includeApp?: boolean;
 }) {
-  const supabase = createClient();
-  const { data, error } = await supabase.auth.getUser();
-  if (!data.user || error) {
+  const user = await getSessionUser();
+  if (!user) {
     return null;
   }
   return db.submissions.findUnique({
     where: {
       user_id_form_id: {
         form_id: formId,
-        user_id: data.user.id,
+        user_id: user.id,
       },
     },
     include: {
@@ -219,16 +218,12 @@ function validateFormAnswers({
 }
 
 export async function startApplication({ formId }: { formId: bigint }) {
-  const supabase = createClient();
-  const { data, error } = await supabase.auth.getUser();
-  if (!data.user || error) {
-    return null;
-  }
+  const user = await requireUser();
   const res = await db.submissions.findUnique({
     where: {
       user_id_form_id: {
         form_id: formId,
-        user_id: data.user.id,
+        user_id: user.id,
       },
     },
   });
@@ -240,7 +235,7 @@ export async function startApplication({ formId }: { formId: bigint }) {
       where: {
         user_id_form_id: {
           form_id: formId,
-          user_id: data.user.id,
+          user_id: user.id,
         },
       },
       data: {
@@ -250,7 +245,7 @@ export async function startApplication({ formId }: { formId: bigint }) {
   }
   return db.submissions.create({
     data: {
-      user_id: data.user.id,
+      user_id: user.id,
       form_id: formId,
       status: "pending",
     },

src/lib/utils/auth.ts

@@ -0,0 +1,38 @@
+import { createClient } from "@/lib/utils/supabase/server";
+import { db } from "@/db";
+import { User } from "@supabase/supabase-js";
+
+export async function getSessionUser(): Promise<User | null> {
+  const supabase = createClient();
+  const { data, error } = await supabase.auth.getUser();
+  if (error || !data.user) {
+    return null;
+  }
+  return data.user;
+}
+
+export async function isAdmin(userId: string): Promise<boolean> {
+  const role = await db.roles.findUnique({
+    where: { id: userId },
+  });
+  return !!role && role.roles?.split(",")[0] === "admin";
+}
+
+export async function requireUser(): Promise<User> {
+  const user = await getSessionUser();
+  if (!user) {
+    throw new Error("Unauthorized");
+  }
+  return user;
+}
+
+export async function requireAdmin() {
+  const user = await getSessionUser();
+  if (!user) {
+    throw new Error("Unauthorized");
+  }
+  if (!(await isAdmin(user.id))) {
+    throw new Error("Unauthorized");
+  }
+  return user;
+}

src/lib/utils/forms/server.ts

@@ -0,0 +1,16 @@
+import { db } from "@/db";
+
+// Plain server module (no "use server") — internal reads shared by
+// member-facing pages and admin flows. Not an invokable RPC endpoint.
+export async function getFormById(id: number | bigint) {
+  try {
+    return await db.forms.findFirst({
+      where: {
+        id: BigInt(id),
+      },
+    });
+  } catch (e) {
+    console.log(e);
+    return null;
+  }
+}