set admin behind a cookie and check role on profile

app/api/auth/session/route.ts

@@ -0,0 +1,38 @@
+import { NextResponse } from "next/server";
+
+export async function POST(req: Request) {
+  const { token, role } = await req.json();
+
+  if (!token) {
+    return NextResponse.json({ ok: false }, { status: 400 });
+  }
+
+  const res = NextResponse.json({ ok: true });
+
+  // Server-readable, JS-unreadable
+  res.cookies.set("bb_access_token", token, {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === "production",
+    sameSite: "lax",
+    path: "/",
+  });
+
+  // Optional: for quick middleware role checks (not “secure” by itself)
+  if (role) {
+    res.cookies.set("bb_role", role, {
+      httpOnly: false,
+      secure: process.env.NODE_ENV === "production",
+      sameSite: "lax",
+      path: "/",
+    });
+  }
+
+  return res;
+}
+
+export async function DELETE() {
+  const res = NextResponse.json({ ok: true });
+  res.cookies.set("bb_access_token", "", { path: "/", maxAge: 0 });
+  res.cookies.set("bb_role", "", { path: "/", maxAge: 0 });
+  return res;
+}