Addressing review comments

website/src/lib/auth.ts

@@ -0,0 +1,19 @@
+import type { NextApiRequest, NextApiResponse } from "next";
+import { getToken } from "next-auth/jwt";
+
+/**
+ * Wraps any API Route handler and verifies that the user has the appropriate
+ * role before running the handler.  Returns a 403 otherwise.
+ */
+const withRole = (role: string, handler: (arg0: NextApiRequest, arg1: NextApiResponse<any>) => any) => {
+  return async (req: NextApiRequest, res: NextApiResponse) => {
+    const token = await getToken({ req });
+    if (!token || token.role !== role) {
+      res.status(403).end();
+      return;
+    }
+    return handler(req, res);
+  };
+};
+
+export default withRole;