From 580a60bbd8b68516b2f66214cee1a001a1e4356e Mon Sep 17 00:00:00 2001
From: weeihan <whyap79@gmail.com>
Date: Sun, 12 Jul 2026 15:03:56 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20admin=20role=20bypasses=20path=20prefix?=
 =?UTF-8?q?=20guard=20=E2=80=94=20can=20access=20all=20protected=20routes?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 middleware.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/middleware.ts b/middleware.ts
index 26cc074..a3d9700 100644
--- a/middleware.ts
+++ b/middleware.ts
@@ -54,7 +54,7 @@ export async function middleware(request: NextRequest) {
   if (user && !isPublicRoute && !isSharedRoute && pathname !== '/') {
     const { data: profile } = await supabase.from('users').select('role').eq('id', user.id).single()
     const role = profile?.role
-    if (isValidRole(role)) {
+    if (isValidRole(role) && role !== 'admin') {
       const allowedPrefix = ROLE_HOME[role as UserRole]
       if (!pathname.startsWith(allowedPrefix)) {
         const url = request.nextUrl.clone()