setia/ims
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: admin role bypasses path prefix guard — can access all protected routes

Browse Source
This commit is contained in:
admin
2026-07-12 15:03:56 +08:00
parent 706a075d73
commit 580a60bbd8
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
middleware.ts
+1 -1
View File
@@ -54,7 +54,7 @@ export async function middleware(request: NextRequest) {
if (user && !isPublicRoute && !isSharedRoute && pathname !== '/') { if (user && !isPublicRoute && !isSharedRoute && pathname !== '/') {
const { data: profile } = await supabase.from('users').select('role').eq('id', user.id).single() const { data: profile } = await supabase.from('users').select('role').eq('id', user.id).single()
const role = profile?.role const role = profile?.role
if (isValidRole(role)) { if (isValidRole(role) && role !== 'admin') {
const allowedPrefix = ROLE_HOME[role as UserRole] const allowedPrefix = ROLE_HOME[role as UserRole]
if (!pathname.startsWith(allowedPrefix)) { if (!pathname.startsWith(allowedPrefix)) {
const url = request.nextUrl.clone() const url = request.nextUrl.clone()