From 1a813d54f2fc94673cc7694dde665cbff43fc38e Mon Sep 17 00:00:00 2001
From: weeihan <whyap79@gmail.com>
Date: Wed, 22 Jul 2026 20:00:27 +0800
Subject: [PATCH] fix(middleware): exclude /api/ routes from role-prefix guard

API routes were being redirected for non-admin roles (e.g. capa_owner
calling PATCH /api/capa/[id] got redirected to /capa-owner, breaking
all API calls from role-restricted users).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WMymkhHZiaYZtUeH9MEHZQ
---
 middleware.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/middleware.ts b/middleware.ts
index bc5de9f..7693a2f 100644
--- a/middleware.ts
+++ b/middleware.ts
@@ -49,7 +49,7 @@ export async function middleware(request: NextRequest) {
     }
   }
 
-  if (user && !isPublicRoute && !isSharedRoute && pathname !== '/') {
+  if (user && !isPublicRoute && !isSharedRoute && !pathname.startsWith('/api/') && pathname !== '/') {
     const { data: profile } = await supabase.from('users').select('role').eq('id', user.id).single()
     const role = profile?.role
     if (isValidRole(role) && role !== 'admin') {