@sanvika/auth 2.5.8 → 2.5.9

package/dist/server.js

@@ -302,6 +302,17 @@ async function authenticateAdmin(request) {
       return _buildUnauthorized("Invalid or expired token.", "INVALID_TOKEN");
     }
     const uid = saPayload.sub;
+    const jwtRole = saPayload.role;
+    if (jwtRole === "superadmin" && uid) {
+      const adminData2 = {
+        uid,
+        adminId: null,
+        role: "superadmin",
+        mobile: saPayload.mobile || null
+      };
+      _adminCache.set(cacheKey, { adminData: adminData2, expires: Date.now() + _ADMIN_CACHE_TTL });
+      return { success: true, admin: adminData2 };
+    }
     const admin = await verifyAdminFromAuth(uid);
     if (!admin) {
       return _buildUnauthorized("Unauthorized or admin account not found.", "ADMIN_NOT_FOUND");
@@ -309,13 +320,14 @@ async function authenticateAdmin(request) {
     if (admin.isBlocked) {
       return _buildForbidden("Admin account is blocked.", "ADMIN_BLOCKED");
     }
-    if (!["admin", "superadmin", "moderator"].includes(admin.role)) {
+    const effectiveRole = admin.role || (jwtRole && ["admin", "superadmin", "moderator"].includes(jwtRole) ? jwtRole : null);
+    if (!effectiveRole || !["admin", "superadmin", "moderator"].includes(effectiveRole)) {
       return _buildForbidden("Invalid admin role.", "INVALID_ADMIN_ROLE");
     }
     const adminData = {
       uid: admin.uid,
       adminId: admin.adminId,
-      role: admin.role,
+      role: effectiveRole,
       mobile: admin.mobile
     };
     _adminCache.set(cacheKey, { adminData, expires: Date.now() + _ADMIN_CACHE_TTL });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sanvika/auth",
-  "version": "2.5.8",
+  "version": "2.5.9",
   "description": "Sanvika Auth SDK — React components/hooks + server-side token verification and user proxy",
   "type": "module",
   "main": "dist/index.js",