From 9e9ea181e63568e9e9987d8db55de034358b1041 Mon Sep 17 00:00:00 2001 From: bruno Date: Mon, 13 Jul 2026 13:19:38 -0400 Subject: [PATCH] fix: admin_required check DB direct en fallback (session cookie stale) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Le cookie de session peut dater d'avant le flag is_admin → vérification DB directe si la session ne contient pas is_admin --- app/routers/admin.py | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/app/routers/admin.py b/app/routers/admin.py index 272ddcd..c29767b 100644 --- a/app/routers/admin.py +++ b/app/routers/admin.py @@ -9,8 +9,15 @@ router = APIRouter(tags=["admin"], prefix="/api/admin") async def admin_required(request: Request): from app.auth.session import get_current_user user = await get_current_user(request) - if not user or not user.get("is_admin"): + if not user: raise HTTPException(status_code=403, detail="Admin access required") + # Also check DB directly (session cookie may be stale) + if not user.get("is_admin"): + from app.db import get_conn + with get_conn() as conn: + row = conn.execute("SELECT is_admin FROM users WHERE id=?", (user.get("id"),)).fetchone() + if not row or not row["is_admin"]: + raise HTTPException(status_code=403, detail="Admin access required") return user