trpc: check unlimited in middleware

apps/web/server/middleware.ts

@@ -25,9 +25,17 @@ export const userMiddleware = t.middleware(async ({ ctx, next }) => {
     },
   });
 
+  const unlimited = systemuser?.roles?.some((x) => x?.name && unlimitedRoles.includes(x.name));
+
+  if (!unlimited) {
+    throw new TRPCError({
+      code: 'UNAUTHORIZED',
+    });
+  }
+
   return next({
     ctx: {
-      unlimited: systemuser?.roles?.some((x) => x?.name && unlimitedRoles.includes(x.name)),
+      unlimited,
     },
   });
 });