From 2754c87d60921656f473267ad98c590ff38a5bdb Mon Sep 17 00:00:00 2001
From: demassimo <87481244+demassimo@users.noreply.github.com>
Date: Thu, 20 Nov 2025 22:17:59 +0200
Subject: [PATCH] Allow manageUsers roles through requireAdmin

---
 backend/src/auth.js | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/backend/src/auth.js b/backend/src/auth.js
index d3bfd94..6cbaf68 100644
--- a/backend/src/auth.js
+++ b/backend/src/auth.js
@@ -37,10 +37,9 @@ export function authMiddleware(secret, options = {}) {
 }
 
 export function requireAdmin(req, res, next) {
-  const isAdminUser = typeof req.authUser?.username === 'string' && req.authUser.username.toLowerCase() === 'admin';
   const isSuperuser = Boolean(req.authUser?.superuser);
-  const hasPermission = isSuperuser || req.authUser?.permissions?.global?.manageUsers;
-  if (!(isSuperuser || isAdminUser) || !hasPermission) {
+  const hasManageUsers = Boolean(req.authUser?.permissions?.global?.manageUsers);
+  if (!isSuperuser && !hasManageUsers) {
     return res.status(403).json({ error: 'forbidden' });
   }
   next();