?
auth.roles
The role ids the current user holds, as an array.
auth.roles → string[]
The array of role ids on the current user, empty when the request is unauthenticated or before any role has been assigned. requireRole and hasRole both read from it. Read it directly when you need the actual roles rather than a yes-or-no on one.
Read the caller's roles
const isStaff = auth.roles.includes('admin') || auth.roles.includes('editor');