minir fix

apps/admin/src/app/api/admin/attendance/route.ts

@@ -10,7 +10,7 @@ export async function GET(req: Request) {
         const db = await getDatabase()
         const user = await db.getUserById(userId)
 
-        if (!user || user.role !== 'admin') {
+        if (!user || (user.role !== 'admin' && user.role !== 'superAdmin')) {
             return new NextResponse('Forbidden', { status: 403 })
         }
 

apps/admin/src/app/api/admin/stats/route.ts

@@ -8,6 +8,12 @@ export async function GET() {
         if (!userId) return new NextResponse('Unauthorized', { status: 401 })
 
         const db = await getDatabase()
+        const user = await db.getUserById(userId)
+
+        if (!user || (user.role !== 'admin' && user.role !== 'superAdmin')) {
+            return new NextResponse('Forbidden', { status: 403 })
+        }
+
         const stats = await db.getDashboardStats()
 
         return NextResponse.json(stats)