fix: admin role bypasses path prefix guard — can access all protected routes

2026-07-12 15:03:56 +08:00
parent 706a075d73
commit 580a60bbd8
1 changed files with 1 additions and 1 deletions
@@ -54,7 +54,7 @@ export async function middleware(request: NextRequest) {
  if (user && !isPublicRoute && !isSharedRoute && pathname !== '/') {
    const { data: profile } = await supabase.from('users').select('role').eq('id', user.id).single()
    const role = profile?.role
-    if (isValidRole(role)) {
+    if (isValidRole(role) && role !== 'admin') {
      const allowedPrefix = ROLE_HOME[role as UserRole]
      if (!pathname.startsWith(allowedPrefix)) {
        const url = request.nextUrl.clone()