Lucas Berger f9c70ab6a8 feat(10-02): implement requireAdmin DB-backed MiddlewareHandler ...

- reads users.isAdmin from DB (never trusts context user's isAdmin claim)
- 403 with { error: 'Forbidden' } for non-admins and missing user
- side-effect import of devBypass.js for ContextVariableMap augmentation
- bypass path skips OIDC only, not the DB check (T-10-04/T-10-05)

2026-06-13 14:32:04 -04:00

..

api

feat(10-02): implement requireAdmin DB-backed MiddlewareHandler

2026-06-13 14:32:04 -04:00

pwa

feat(10-01): seed dev-bypass user id=1 as is_admin=true in e2e global-setup

2026-06-13 14:23:09 -04:00