From cbcf3f55db8b96941e3096b595de8fd850058454 Mon Sep 17 00:00:00 2001
From: Kavehhn174 <Kavehhn174@gmail.com>
Date: Fri, 21 Aug 2026 13:35:16 +0330
Subject: [PATCH] fix(perm): allow array of permissions in permissionMiddleware
 and accept classes:update or classes:delete

---
 components/classes/classRoutes.js   | 4 ++--
 middlewares/permissionMiddleware.js | 5 +++--
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/components/classes/classRoutes.js b/components/classes/classRoutes.js
index 027cb9e..294fffe 100644
--- a/components/classes/classRoutes.js
+++ b/components/classes/classRoutes.js
@@ -23,8 +23,8 @@ router.get('/admin/get-all', perm.requires(PERMISSIONS.CLASSES_READ), classContr
 router.get('/admin/get-one/:id', perm.requires(PERMISSIONS.CLASSES_READ), classController.getOne);
 router.post('/admin/create', perm.requires(PERMISSIONS.CLASSES_CREATE), classController.create);
 router.put('/admin/update/:id', perm.requires(PERMISSIONS.CLASSES_UPDATE), classController.update);
-router.delete('/admin/delete/:id', perm.requires(PERMISSIONS.CLASSES_DELETE), classController.delete);
-router.post('/admin/restore/:id', perm.requires(PERMISSIONS.CLASSES_DELETE), classController.restore);
+router.delete('/admin/delete/:id', perm.requires([PERMISSIONS.CLASSES_DELETE, PERMISSIONS.CLASSES_UPDATE]), classController.delete);
+router.post('/admin/restore/:id', perm.requires([PERMISSIONS.CLASSES_DELETE, PERMISSIONS.CLASSES_UPDATE]), classController.restore);
 router.post('/admin/:id/register-users', perm.requires(PERMISSIONS.CLASSES_REGISTER_USERS), classController.registerUsers);
 router.delete('/admin/:id/students/:userId', perm.requires(PERMISSIONS.CLASSES_REGISTER_USERS), classController.removeUser);
 
diff --git a/middlewares/permissionMiddleware.js b/middlewares/permissionMiddleware.js
index b676812..2cbfeb4 100644
--- a/middlewares/permissionMiddleware.js
+++ b/middlewares/permissionMiddleware.js
@@ -3,6 +3,7 @@
 const AppError = require('../utils/AppError');
 
 const requirePermission = (requiredPermission) => {
+  const perms = Array.isArray(requiredPermission) ? requiredPermission : [requiredPermission];
   return (req, res, next) => {
     try {
       if (!req.user) {
@@ -19,8 +20,8 @@ const requirePermission = (requiredPermission) => {
         return next();
       }
 
-      // Check if required permission is held by role
-      if (Array.isArray(role.permissions) && role.permissions.includes(requiredPermission)) {
+      // Check if any required permission is held by role
+      if (Array.isArray(role.permissions) && perms.some((p) => role.permissions.includes(p))) {
         return next();
       }