I'm trying to make an app with pretty much only server actions, the app doesn't need to interact with the outside, session is stored in cookies with iron-session. I want to have permissions for different roles for those server actions, how and where can I define the middleware for handling this stuff.

I've tought about putting the logic to check the role in the middleware but I don't know how to identify whether a request is a server action or not.

Then I've tought about making a wrapper but when I console logged inside the server action, it displayed on the browser console, probably because it's returning a function and not the result of it but I couldn't get it to work (my previous question was about this but couldn't get a good answer)

import { getSession } from '@/actions/login';

//only checks if there's a session
export async function protect(fn: any) {
    return async (...params: any) => {
        if(await getSession()) {
            return await fn(...params);
        } else {
            throw new Error("invalid session")
        }
    }
}

The easy solution is to make another server action that checks for the role and fn name in each server action but I would have to call it in every single server action and that would be repeating too much code kind of

So how could I handle authorization for my server actions, on the server side so that I can read the session from the cookies and check it against the db before executing them?