feat: bootstrap SuperAdmin from env and lock one-time seeding

Production creates the SuperAdmin from env credentials, and dashboard seeding is authenticated, SuperAdmin-only, and locked after the first run.

middlewares/authMiddleware.js

@@ -4,6 +4,7 @@ const jwt = require('jsonwebtoken');
 const config = require('../config/config');
 const AppError = require('../utils/AppError');
 const User = require('../components/users/userModel');
+const { isBootstrapSuperAdminDisabled } = require('../utils/superAdmin');
 
 const authMiddleware = async (req, res, next) => {
   try {
@@ -29,7 +30,7 @@ const authMiddleware = async (req, res, next) => {
     }
 
     const user = await User.findById(decoded.id).populate('role');
-    if (!user || !user.isActive) {
+    if (!user || !user.isActive || isBootstrapSuperAdminDisabled(user)) {
       return next(new AppError('UNAUTHORIZED'));
     }
 

middlewares/requireSuperAdmin.js

@@ -0,0 +1,18 @@
+// /middlewares/requireSuperAdmin.js
+'use strict';
+
+const AppError = require('../utils/AppError');
+
+const requireSuperAdmin = (req, res, next) => {
+  if (!req.user) {
+    return next(new AppError('UNAUTHORIZED'));
+  }
+
+  if (req.user.role?.name !== 'SuperAdmin') {
+    return next(new AppError('FORBIDDEN'));
+  }
+
+  return next();
+};
+
+module.exports = requireSuperAdmin;