setia/ims
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(middleware): exclude /api/ routes from role-prefix guard

Browse Source 
API routes were being redirected for non-admin roles (e.g. capa_owner
calling PATCH /api/capa/[id] got redirected to /capa-owner, breaking
all API calls from role-restricted users).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WMymkhHZiaYZtUeH9MEHZQ
This commit is contained in:
admin
2026-07-22 20:00:27 +08:00
co-authored by Claude Sonnet 4.6
parent 0e479b648f
commit 1a813d54f2
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
middleware.ts
+1 -1
View File
@@ -49,7 +49,7 @@ export async function middleware(request: NextRequest) {
} }
} }
if (user && !isPublicRoute && !isSharedRoute && pathname !== '/') { if (user && !isPublicRoute && !isSharedRoute && !pathname.startsWith('/api/') && pathname !== '/') {
const { data: profile } = await supabase.from('users').select('role').eq('id', user.id).single() const { data: profile } = await supabase.from('users').select('role').eq('id', user.id).single()
const role = profile?.role const role = profile?.role
if (isValidRole(role) && role !== 'admin') { if (isValidRole(role) && role !== 'admin') {