From 877dfa65d53b56814341a70f14d0f34678cb8f86 Mon Sep 17 00:00:00 2001 From: Kavehhn174 Date: Sat, 15 Aug 2026 03:27:21 +0330 Subject: [PATCH] fix: treat SuperAdmin role name case-insensitively in permission checks The seeded role is SuperAdmin, but the middleware only matched superAdmin, so SuperAdmin could be denied documents and other new permissions. --- middlewares/permissionMiddleware.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/middlewares/permissionMiddleware.js b/middlewares/permissionMiddleware.js index 21cbb1c..b676812 100644 --- a/middlewares/permissionMiddleware.js +++ b/middlewares/permissionMiddleware.js @@ -14,8 +14,8 @@ const requirePermission = (requiredPermission) => { return next(new AppError('FORBIDDEN')); } - // Check if user is superAdmin (by role name or system status) - if (role.name === 'superAdmin' || (role.isSystem && role.permissions.includes('*'))) { + const roleName = String(role.name || '').toLowerCase(); + if (roleName === 'superadmin' || (role.isSystem && role.permissions.includes('*'))) { return next(); }