Protect Admin Routes with AI Prompts

Implement role-based access control for my application.

Roles needed:

• user: basic access
• moderator: can manage content
• admin: full access
• super_admin: can manage admins

Framework: Next.js/Express/Django

Implementation:

1. Add role column to users table
2. Create middleware to check role
3. Define permissions per role
4. Apply to routes/endpoints

Middleware should:

• Check user is authenticated
• Fetch user's role from session/token
• Verify role has required permission
• Return 403 if insufficient permissions
• Log access attempts

Create helper: requireRole('admin') middleware Create helper: hasPermission(user, 'manage_users')

Add comprehensive protection to all admin routes.

Admin routes: /admin/, /api/admin/

Protection layers:

1. Authentication required
2. Admin role required
3. Rate limiting (stricter than normal)
4. Audit logging for all actions
5. CSRF protection on mutations

Additional security:

• Separate admin session with shorter timeout
• Re-authenticate for destructive actions
• IP allowlist option for admin access
• 2FA required for admin accounts

Implement:

• adminAuthMiddleware that chains all checks
• Audit log: who, what, when, from where
• Alert on suspicious admin activity
• Admin action requires confirmation for bulk operations

Require password re-entry for sensitive admin actions.

Sensitive actions:

• Deleting users
• Changing user roles
• Accessing payment data
• Modifying security settings
• Bulk operations

Implementation:

1. Check if action is sensitive
2. Check if user recently authenticated (within 5 min)
3. If not, prompt for password
4. Verify password before proceeding
5. Create short-lived "elevated" session

Flow:

• User clicks "Delete User"
• Modal asks for password
• Backend verifies password
• Creates elevatedUntil timestamp
• Allows action if within window
• Logs the elevation event

Don't: Trust client-side confirmation alone

Implement comprehensive audit logging for admin actions.

Log every admin action:

• Who: admin user ID and email
• What: action type and details
• When: timestamp (UTC)
• Where: IP address, user agent
• Result: success or failure

Actions to log:

• User management (create, update, delete, role change)
• Content moderation
• Settings changes
• Data exports
• Failed access attempts

Storage:

• Separate audit_logs table
• Immutable (no updates/deletes)
• Indexed for querying
• Retention policy (keep 2+ years)

Also implement:

• Real-time alerts for suspicious activity
• Regular audit report generation
• Search/filter interface for audit logs