How quickly should removing an admin role take effect?

Say it in 30 seconds

Say it like this (20-30 seconds)

I define the guarantee at the authorization check. MiniTickets reads the user’s current role from Postgres for every admin request, so a completed role change affects later checks without waiting for a seven-day session to expire. It does not undo an operation that already passed its check. The trade-off is a database dependency on admin routes; ordinary routes avoid that role lookup, and a lookup failure never grants admin access.

The deeper answer

The context resolves only the session’s user identifier. The admin middleware then distinguishes missing authentication, a deleted user and a non-admin role. Those become unauthorized or forbidden responses as appropriate. A database error remains an error; it is not permission to continue.

The make-admin service revokes sessions before changing the role and again afterwards. That narrows a concurrent-login window and requires fresh login after a successful promotion. It is still two systems with no shared transaction: a failure after the database update can leave a changed role even though the overall command failed.

For a high-risk demotion, I would discuss checking authorization again inside the protected write transaction or introducing a durable security version. Those are proposed hardening choices, not guarantees the current code provides.

Counter-questions

Why not put the role in the cookie?

A trusted signed claim can still be stale. Without expiry or revocation checks, removing privileges would not affect an already issued token.

What if the account was deleted?

The admin lookup returns no role, and the middleware rejects the request as unauthorized. A session record alone does not prove that an admin account still exists.

Does checking on every request remove every race?

No. A request can pass the check before a concurrent demotion commits and perform its write later. The required guarantee must say whether that window is acceptable.

Where in MiniTickets

Read Rbac, then inspect the api-app piece →.

apps/api/src/trpc/init.ts → isAdmin