Role‑Based Access

Roles are free‑form strings on your AuthUser.
Augment the type if you store role or banned on users (see /getting-started/type-augmentation).

Pages

definePageMeta({
  auth: { role: 'admin' },
})

Server

export default defineEventHandler(async (event) => {
  const { user } = await requireUserSession(event, { role: 'admin' })
  return { ok: true, user }
})

requireUserSession also checks user.banned and throws 403 if true.