portabase/app/api/auth/[...all]/route.ts

import { auth } from "@/lib/auth/auth";
import { toNextJsHandler } from "better-auth/next-js";
import { NextRequest, NextResponse } from "next/server";
import { headers } from "next/headers";

const authHandler = toNextJsHandler(auth.handler);

async function blockApiKeyCreateForRestrictedUsers(
  req: NextRequest,
): Promise<NextResponse | null> {
  const url = req.nextUrl;
  if (req.method !== "POST" || !url.pathname.endsWith("/api-key/create")) {
    return null;
  }
  const session = await auth.api.getSession({ headers: await headers() });
  if (!session?.user) {
    return null;
  }
  // @ts-ignore
  if (session.user.banned || (session.user.role as string) === "pending") {
    return NextResponse.json(
      { error: "Account not eligible to create API keys" },
      { status: 403 },
    );
  }
  return null;
}

export async function GET(req: NextRequest) {
  return authHandler.GET(req);
}

export async function POST(req: NextRequest) {
  const guard = await blockApiKeyCreateForRestrictedUsers(req);
  if (guard) return guard;
  return authHandler.POST(req);
}