---
name: Role authorization for split account types
description: Why role-specific API endpoints must enforce roles server-side, not just hide UI nav.
---

When the product has distinct account types (e.g. MODEL vs PUBLIC USER), every
role-specific endpoint must enforce the role server-side with a `requireRole(...)`
middleware that returns 403 on mismatch. `requireAuth` alone is not enough.

**Why:** Hiding nav links in the frontend layout and choosing routes by `user.role`
does NOT prevent a logged-in user of the wrong type from calling the API directly
(curl, or navigating by URL). A public user could hit model-only `/me/*` and a model
could hit user-only `/favorites`. Authorization is a server concern.

**How to apply:**
- API: `requireRole("model")` on `/me/*`; `requireRole("user")` on `/favorites`.
  Admin is allowed through by convention inside `requireRole`.
- Frontend: also wrap role-restricted routes in a `RoleGuard` that redirects
  mismatched roles to `/` — this is UX only (avoids broken pages), the real
  boundary is the 403 from the server.
